EDPB — Scientific research: last chance to comment

The European Data Protection Board (EDPB) closes its public consultation on Wednesday, 25 June 2026 (23:59 CEST) for the “Guidelines 1/2026 on processing of personal data for scientific research purposes.” The draft clarifies legal bases, broad consent, and Article 89 safeguards under the GDPR, with direct impact for Luxembourg stakeholders.

The facts

Adopted for public consultation on 15 April 2026, the draft details the compatibility presumption for further processing for research (Art. 5(1)(b)), the possible use of broad consent, and the safeguards required under Art. 89(1). Organisations can submit feedback via the EDPB’s official form until tonight’s deadline.

Legal framework and legal basis

• GDPR Article 5(1)(b) — compatibility presumption for scientific research, subject to Art. 89(1) safeguards and a valid legal basis for the further processing.
• Articles 6(1)(e) and 6(1)(f) — public interest task (including private actors where provided by law) or legitimate interest, with greater weight where research is “genuinely scientific.”
• Article 9 — guidance on special-category data derogations (explicit consent, manifestly made public data, Union/national regimes).
• Articles 12–14 — ongoing transparency, including where there is no direct contact; clarifications on Art. 14(5) exceptions.
• Article 89(1) — appropriate safeguards: anonymisation/pseudonymisation, access controls, secure environments, ethics oversight, and protection of outputs.

For an overview of GDPR obligations and legal bases, see our dedicated resource.

What this means for Luxembourg companies

• Who is impacted — healthcare providers, biotechs/pharma, universities and research centres, insurers/banks running analytics, IT firms in R&D (including AI projects aligned with the AI Act).
• Risk — over‑broad “scientific research” qualification can void the compatibility presumption, weaken the legal basis, and trigger transparency and data subject rights issues.
• Timing — feedback window closes on 25 June 2026 (23:59 CEST); expect accelerated compliance post‑adoption.

In the local context, review your CNPD compliance in Luxembourg for research processing, especially for data re‑use and inter‑institutional sharing.

Immediate actions this week

• Map ongoing research projects and identify, for each, the legal basis (Art. 6), any Art. 9(2) derogation, and Art. 89(1) safeguards; confirm applicability of the Art. 5(1)(b) presumption.
• Finalise and submit your EDPB comments: clarifications on broad consent, re‑use of care-derived data, joint public‑private responsibilities, and extended transparency (Arts. 12–14).
• Start a “research safeguards” uplift: anonymisation/pseudonymisation policy, granular access control, secure processing environment, ethics committee, and DPIAs for sensitive datasets.

Sources

• EDPB — Public consultation: Guidelines 1/2026 on processing of personal data for scientific research purposes
• EDPB — Guidelines 1/2026, public consultation version

Article generated by Luxgap regulatory watch. For tailored guidance on this topic, contact us.