Written by: Haim Ravia, Dotan Hammer
On April 16, 2026, the European Data Protection Board adopted Guidelines 1/2026 on the processing of personal data for scientific research purposes, opening them for public consultation until June 25, 2026. The guidelines aim to clarify how the GDPR applies to academic, public-sector, and commercial research — including research that relies on artificial intelligence, large datasets, and the reuse of personal data.
A central contribution of the guidelines is the introduction of six key indicative factors for determining whether processing constitutes “scientific research” within the meaning of the GDPR: a methodical and systematic approach; adherence to ethical standards; verifiability and transparency (allowing peer review); autonomy and independence for the research team; objectives aimed at contributing to society’s general knowledge and well-being; and the potential to contribute to existing scientific knowledge or apply it in novel ways. If research activities meet all six factors, they can be presumed to constitute scientific research; if they do not meet all factors, the controller must justify why the activities should be considered scientific research.
The guidelines confirm that further processing for scientific research purposes is presumed to be compatible with the initial purpose for collecting personal data, meaning controllers do not need to carry out the GDPR purpose compatibility test. However, controllers must still ensure that the legal basis for the initial processing is also suitable for the further processing. On consent, the EDPB confirms that controllers may rely on “broad consent” when research purposes are not fully known at the time of data collection, provided appropriate safeguards are in place. A combination of broad and dynamic consent is also possible.
The guidelines address data subject rights, including the rights to erasure and objection, explaining when limitations may apply in the context of scientific research. The EDPB also clarifies how responsibilities should be allocated when several entities are involved in processing, and outlines safeguards such as anonymization, pseudonymization, secure processing environments, privacy-enhancing technologies, confidentiality arrangements, and conditions for further use.
Click here to read the EDPB’s Guidelines 1/2026 on Processing of Personal Data for Scientific Research.
