--- title: "European Health Data Space I: Secondary Use, Access Bodies…" description: "How Chapter IV of Regulation (EU) 2025/327 opens health data for research, innovation and policy through health data access bodies, data permits and secure…" url: https://pitch.law/academy/european-health-data-space-secondary-use-and-data-permits --- [pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Data Protection](https://pitch.law/academy/topics/privacy) # European Health Data Space I: Secondary Use, Access Bodies and Data Permits How Chapter IV of Regulation (EU) 2025/327 opens health data for research, innovation and policy through health data access bodies, data permits and secure processing environments, and what it asks of the companies that hold the data. - - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law - 13 November 2026 - Updated 13-11-2026 ## The legal framework The European Health Data Space (EHDS) is [Regulation (EU) 2025/327](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R0327) of 11 February 2025. It entered into force on 25 March 2025. It has two halves. Primary use gives patients and health professionals access to health records across borders. Secondary use, the subject of this article, makes electronic health data available for research, innovation, policy and statistics. The rules for health-record software and wellness apps are covered in our [second EHDS article](https://pitch.law/academy/european-health-data-space-health-record-systems-and-wellness-apps). "Secondary use" means processing electronic health data for the purposes in Chapter IV, other than the purposes for which they were first collected or produced ([Article 2](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_2)). ### When Chapter IV applies [Article 105](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_105) staggers the dates: - **26 March 2027:** the Regulation applies in general. Within Chapter IV, a few provisions start now: Member States notify the Commission of their health data access bodies (Article 55(6)) and national contact point (Article 75(1)), and the Commission adopts the templates for applications, permits and requests (Article 70) and the requirements for secure processing environments (Article 73(5)). - **26 March 2029:** Chapter IV applies. - **26 March 2031:** five data categories join: factors impacting on health, genetic and genomic data, other "omic" data, clinical trial data and data from research cohorts and surveys (Article 51(1), points (b), (f), (g), (m) and (p)). - **26 March 2035:** third countries and international organisations can become authorised participants in the cross-border infrastructure HealthData\@EU (Article 75(5)). ### Who must make data available The duties fall on **health data holders**. The definition in Article 2 is broad. It covers the healthcare and care sectors and reimbursement services, and also anyone developing products or services for the health, healthcare or care sectors, developers and manufacturers of wellness applications, health researchers and mortality registries. They are caught if they process personal electronic health data as controller for purposes such as care, research or innovation, or if they can make non-personal health data available through control of a product's technical design. [Article 50](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_50) exempts natural persons, including individual researchers, and microenterprises. Member States may bring them back in by national law. [Article 51](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_51) lists seventeen minimum categories. Among them: data from electronic health records, healthcare administrative and claims data, genetic data, personal data generated automatically by medical devices, data from wellness applications, registry data and data from biobanks. A hospital, a health insurer, a medtech company and a fitness-tracker maker can all be holders. ### The duties of data holders Under [Article 60](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_60), a holder must: - make the requested data available to the health data access body under a permit or approved request, **within three months** of the body's request (extendable by three months in justified cases); - describe its datasets for the national dataset catalogue and check that description at least once a year; - document any data quality and utility label it uses. Intellectual property and trade secrets are not an excuse to withhold data. Under [Article 52](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_52), the holder flags which parts of a dataset are protected and justifies why. The access body then takes protective measures, which can include contractual arrangements between holder and user, and must refuse access where a serious risk to those rights cannot be addressed. ### Health data access bodies Each Member State designates one or more **health data access bodies** ([Article 55](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_55)). They decide on applications and requests, request the data from holders, prepare them (including pseudonymisation or anonymisation), provide access in a secure processing environment, supervise users and holders, and publish every permit issued or refused within 30 working days ([Article 57](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_57)). The Commission plays this role where the holder is an EU institution (Article 56). ### Permitted and prohibited purposes Access is granted only where the processing is necessary for a purpose in [Article 53(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_53): public and occupational health, policymaking, official statistics, education, scientific research related to health or care (expressly including product development and the training, testing and evaluation of algorithms in medical devices, AI systems and digital health applications), and improving the delivery of care. The first three are reserved for public sector bodies and EU institutions. [Article 54](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_54) prohibits using the data for decisions detrimental to individuals, for decisions on job offers, insurance or credit terms, for advertising or marketing, for developing harmful products such as tobacco, alcohol or addictive services, and for activities that breach ethical rules in national law. ### Two routes: a data permit or a data request A **health data access application** ([Article 67](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_67)) can come from any natural or legal person. It describes the applicant and the people who will see the data, the purpose and expected benefit, the data requested, whether pseudonymised data are needed and why anonymised data will not do, the safeguards, the period and the computing tools. For data in several Member States, one application goes to a single access body or through HealthData\@EU. The access body issues a **data permit** ([Article 68](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_68)) if the purpose fits Article 53, the data are necessary and proportionate, the processing has a legal basis under Article 6(1) GDPR, the applicant is qualified and shows adequate safeguards. It decides **within three months** of a complete application, extendable once by three months. A permit lasts as long as the purpose requires, up to **10 years**, renewable once for up to 10 more. It sets out the data, purpose, authorised persons, duration, tools and fees. A **health data request** ([Article 69](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_69)) is the lighter route. The applicant receives only an answer in anonymised statistical format and never sees the underlying data. The body assesses it within three months and, where possible, answers within a further three. Under [Article 66](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_66), data are provided anonymised wherever the purpose allows, and pseudonymised only when the user shows it cannot work otherwise. ### Fees Access bodies may charge fees in proportion to the cost of making the data available, without restricting competition ([Article 62](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_62)). Fees can include compensation for the holder's preparation costs, which is passed on to the holder. Member States may set reduced fees for public bodies, university researchers or microenterprises. The applicant hears the estimated fee before the permit is issued and can withdraw, paying only costs already incurred. ### Secure processing environments Data under a permit are accessed only in a **secure processing environment** ([Article 73](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_73)): access limited to the named persons, unique user identities, logs kept for at least one year, regular audits. Users may download only non-personal data, including anonymised statistics, and the access body reviews every download request. For GDPR purposes, the access body acts as **processor** for the health data user, who is controller for the processing in the environment ([Article 74](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_74)). ### Duties of data users Under [Article 61](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_61), users process the data only as the permit allows, give no access to third parties not named in it, never re-identify or attempt to re-identify anyone, and publish their results, in anonymous form, within 18 months of completing the processing. They report significant findings about a person's health to the access body. ### The opt-out Individuals may opt out of secondary use at any time, without giving reasons, and may reverse that choice ([Article 71](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_71)). Permits issued before the opt-out are not affected. Member States may provide a narrow exception for public-health bodies and research of important public interest where the data cannot be obtained otherwise. GDPR supervisory authorities enforce the opt-out (Article 65). ### Enforcement An access body can revoke a permit, stop the processing and exclude a user from EHDS access for up to five years ([Article 63](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_63)). Holders that miss the three-month deadline face periodic penalty payments. Under [Article 64](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32025R0327#art_64), breaches of holder and user duties carry fines up to EUR 10 million or 2% of worldwide turnover. Prohibited uses, extracting personal data from the environment or re-identification carry up to EUR 20 million or 4%. ## In practice ### A medtech company as data holder A Belgian company sells connected glucose monitors with a companion app. It is a health data holder: it develops products for the healthcare sector, and its devices generate data in Article 51 categories. Unless it is a microenterprise, it should by 2029 know which datasets it holds, prepare dataset descriptions for the catalogue, flag trade secrets and IP-protected parts with a justification, and set up a process to deliver data within three months of a request. The cost estimate it gives the access body feeds the fee. ### The same company as data user The same company wants to train a dosing algorithm on hospital records from several Member States. It files one application with an access body, explains why pseudonymised data are needed, describes its safeguards and tools, and plans for the work to happen inside a secure processing environment. Only the trained output, if it contains no personal data, leaves the environment. If a summary statistic would do, a data request is quicker and lighter. The results must be published within 18 months. ### Contracts and governance Health data holders and users should look at: - data-sharing agreements that promise exclusivity over datasets the EHDS may require them to share; - internal records showing which data fall in which Article 51 category; - controller and processor arrangements reflecting Article 74; - a DPIA for any project using pseudonymised data; - an internal rule that no one attempts to re-identify individuals, with logging to prove it. ## Frequently asked questions ### Can a private company get access, or is this only for academics? Any natural or legal person can apply. Purposes (a) to (c) of Article 53(1) are reserved for public bodies, but research, innovation, product development and algorithm training are open to companies, provided the work relates to health or care and the other conditions are met. ### Does the EHDS replace the GDPR legal basis? No. Article 68(1)(c) requires that the processing complies with Article 6(1) GDPR. The permit comes on top of that legal basis. ### Can we refuse to share data because they are our trade secret? Not outright. You must flag and justify the protected parts. The access body then decides on protective measures and refuses access only if a serious risk cannot be addressed. ### What happens to data of people who opt out? Their identifiable data are not included in datasets under permits or requests approved after the opt-out. Earlier permits continue. Member States may allow limited exceptions for public health. ## How this connects The EHDS turns health datasets into assets that others can request, so knowing what you hold and on what terms matters. We advise on dataset contracts and trade-secret protection as part of [data licensing and data sharing](https://pitch.law/solutions/data-licensing-sharing), and our [DPO as a service](https://pitch.law/solutions/dpo-as-a-service) supports controllers in the health sector. A [record of processing](https://pitch.law/technologies/privacy-register) is the natural place to map data against the Article 51 categories, and our [DPIA](https://pitch.law/technologies/digital-data-protection-impact-assessment) function documents the assessment for projects with pseudonymised data. When EHDS data are used for AI, see our article on [data for AI](https://pitch.law/academy/data-for-ai-data-spaces-and-licensing-training-data). ### At a glance - **Provisions cited:** EHDS Articles 2, 50 to 57, 60 to 69, 70, 71, 73 to 75 and 105; GDPR Article 6(1). - **Key dates:** in force 25-03-2025; general application and designation of access bodies 26-03-2027; Chapter IV applies 26-03-2029; Article 51(1)(b), (f), (g), (m) and (p) apply 26-03-2031; Article 75(5) applies 26-03-2035. - **In this series:** [European Health Data Space II: health-record systems and wellness apps](https://pitch.law/academy/european-health-data-space-health-record-systems-and-wellness-apps); [Data for AI: data spaces and licensing training data](https://pitch.law/academy/data-for-ai-data-spaces-and-licensing-training-data); [Non-personal data across borders](https://pitch.law/academy/non-personal-data-across-borders). - **Related reading:** [Database rights and trade secrets](https://pitch.law/academy/database-rights-and-trade-secrets); [The AI Act and the GDPR](https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap). ## In short - Which organisations must make health data available, and which are exempt - The permitted purposes and the uses that are prohibited - How a data permit or a data request works, with deadlines - Fees, secure processing environments and the opt-out - Application dates from 2027 to 2035 ## Related solutions - [Solutions](https://pitch.law/solutions/data-licensing-sharing) ### [Data Licensing and Data Sharing](https://pitch.law/solutions/data-licensing-sharing) [Share or license data without giving away more than you meant to. Clear scope, settled ownership of what is derived from it, and the GDPR layer built in.](https://pitch.law/solutions/data-licensing-sharing) - [Solutions](https://pitch.law/solutions/dpo-as-a-service) ### [Data Protection Officer as a Service](https://pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://pitch.law/solutions/dpo-as-a-service) ## Our proprietary Legal Tech - [Technology](https://pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://pitch.law/technologies/privacy-register) - [Technology](https://pitch.law/technologies/digital-data-protection-impact-assessment) ### [Data Protection Impact Assessment](https://pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://pitch.law/technologies/digital-data-protection-impact-assessment) ## More in Data Protection - ### [AI under Swiss Law and the GDPR: Key Differences](https://pitch.law/academy/ai-under-swiss-fadp-and-gdpr) [What the revised Swiss FADP and the GDPR mean for companies that build or use AI services: scope, legal bases, impact assessments, transfers, sanctions and the EU AI Act.](https://pitch.law/academy/ai-under-swiss-fadp-and-gdpr) - ### [Cookies and Consent](https://pitch.law/academy/cookie-compliance-and-consent-management) [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://pitch.law/academy/cookie-compliance-and-consent-management) - ### [GDPR Breach Notification: the 72-Hour Rule](https://pitch.law/academy/data-breach-response-the-72-hour-countdown) [Article 33 GDPR: notify the authority within 72 hours of becoming aware of a personal data breach. When to notify, how hours count, when to tell people.](https://pitch.law/academy/data-breach-response-the-72-hour-countdown) - ### [GDPR Data Retention: How Long to Keep Personal Data](https://pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) [The GDPR sets no fixed retention period: Article 5(1)(e) allows no longer than necessary. How to set retention periods, handle backups and delete data.](https://pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) - ### [How to Answer a DSAR Within the GDPR Deadline](https://pitch.law/academy/data-subject-access-requests-dsars-practical-guide) [Answer a data subject access request within one month, extendable by two (Articles 12 and 15 GDPR): what to send, what you may refuse, how to keep time.](https://pitch.law/academy/data-subject-access-requests-dsars-practical-guide) - ### [The Wider Digital Omnibus: What Would Change in the GDPR, Cookies and the Data Act](https://pitch.law/academy/digital-omnibus-gdpr-cookies-data-act) [The Commission's proposal COM(2025) 837 would amend the GDPR, the cookie rule in the ePrivacy Directive and the Data Act, and fold the Data Governance Act into the Data Act. What the proposal says, provision by provision, and where it stands.](https://pitch.law/academy/digital-omnibus-gdpr-cookies-data-act) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://pitch.law/schedule)