knowledge 25 May 2026 |

What counts as ‘scientific research’ under the GDPR? EDPB consults on Scientific Research Guidelines

The EDPB has published long-awaited guidelines on processing personal data for scientific research purposes for public consultation, and invited feedback by 25 June 2026. The Guidelines will be relevant to any organisation that uses personal data for research purposes, bearing in mind that specific provisions of the GDPR and national laws apply where personal data is processed for scientific research purposes. The Guidelines contain useful explanations of the EDPB’s views on issues such as purpose limitation, the legal basis for processing data, transparency and consent. A key topic that stakeholders will need to consider carefully is the EDPB’s views on how to determine whether research constitutes ‘scientific research’ for the purpose of the GDPR.

What counts as “scientific research”

A central message of the guidelines is that “only research that is genuinely scientific benefits from the specific rules applying to processing of personal data for scientific research purposes in the GDPR”.  The EDPB acknowledges that, in Recital 159 the GDPR, there is an express statement that for the purpose of the GDPR, the processing of personal data for scientific research purposes should be interpreted broadly. Despite this, the EDPB has opined that this concept should be interpreted to require “genuine” scientific activity. 

According to the Guidelines, six factors should be considered for these purposes and, if all of these are present, then research can be presumed to be scientific research.  If any of them is not, then the onus will be on the relevant organisation to be able to demonstrate that the research in question is ‘scientific’ for the purpose of the GDPR.  The six factors to be considered are as follows:

• methodical and systematic approach
• adherence to ethical standards
• verifiability and transparency
• autonomy and independence
• objective of contributing to society’s general knowledge and wellbeing
• potential to contribute to existing scientific knowledge or apply it in novel ways.

Some of these factors are non-controversial. However others are potentially contentious, since they may make it more difficult for organisations conducting research for commercial purposes to be able to demonstrate that their research fits within the concept of ‘scientific research’ that the EDPB has adopted. For example, according to the EDPB in order for research to be presumed to be scientific research, it should be the case that:

“The research activities aim to achieve verifiable results and the conduct of research allows the hypotheses, methods, data and conclusions to be open to criticism, normally following peer review. The results of the research are shared with other parties, for example by publication, or will be shared in the future, with due regard to legitimate limitations to access such as protection of intellectual property and trade secrets.”

The EDPB’s opinion is clearly based, in part, on an opinion published in 2020 by the European Data Protection Supervisor on data protection and scientific research. In this 2020 opinion, the EDPS stated that one of the indicators of ‘scientific research’ should be that “the research is carried out with the aim of growing society’s collective knowledge and wellbeing, as opposed to serving primarily one or several private interests”. The EDPB has not gone so far as to fully replicate this interpretation in its Guidelines, and it has expressly recognised that research carried out for commercial purposes can constitute ‘scientific research’. However, despite its stated goal of providing clarity, the EDPB is proposing to adopt a definition of ‘scientific research’ that is unique to the GDPR and that is ambiguous as to the extent to which research carried out for commercial purposes constitutes ‘scientific research’.

It remains to be seen how the Guidelines will be received by industry stakeholders.