Guidelines 1/2026 on processing of personal data for scientific research purposes

What it covers

These guidelines, adopted in consultation version, interpret the GDPR's specific rules for processing personal data for scientific research purposes, covering the scope of the concept of scientific research, the data protection principles applicable, the available legal bases including consent and legitimate interest, transparency obligations, and the exceptions to the rights to erasure and objection. They also address attribution of responsibility among multiple actors and appropriate safeguards such as pseudonymisation and anonymisation.

Why it matters

It is the EDPB's central interpretive document on the research-specific derogations scattered across the GDPR, which researchers, universities and research-based industry rely on when designing lawful data processing for scientific projects.

Refer to it when

• assessing whether an activity meets the GDPR definition of scientific research
• choosing a legal basis for a research project
• designing broad or dynamic consent mechanisms
• responding to erasure or objection requests concerning research data
• allocating responsibility among partners in a research collaboration

Questions this document addresses

• What factors determine whether processing qualifies as scientific research under the GDPR?
• When can broad or dynamic consent be relied upon for research?
• Can legitimate interest serve as a legal basis for scientific research?
• When does the research exception to the right to erasure apply?
• How are responsibilities allocated among multiple entities involved in a research project?

Topics

• Lawful basis
• Consent
• Scientific research
• Data subject rights
• Transparency