Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

European Health Data Space begins to apply by 26 March 2027

26 March 2027

By 26 March 2027, Regulation (EU) 2025/327 on the European Health Data Space begins to apply, catching health data holders and secondary users of electronic health data across the EU. Organisations must ensure their data is of high quality and interoperable, as this foundational work precedes registration with national health data access bodies.

The European Health Data Space Regulation (EU) 2025/327 mandates significant preparatory work for health data holders and secondary users of electronic health data well before its application date of 26 March 2027. This includes establishing robust data quality frameworks and ensuring technical and semantic interoperability of health data. These are essential prerequisites for compliance, as national health data access bodies will require evidence of these capabilities before organisations can register and participate in the new data sharing ecosystem.

Controllers of electronic health data must analyse their existing data governance structures, data processing operations, and technical infrastructure to align with the Regulation's requirements. This involves assessing data accuracy, completeness, and consistency, alongside implementing standardised formats and terminologies. Processors acting on behalf of these controllers will also need to demonstrate their capacity to support these interoperability and quality standards, potentially requiring updates to Article 28 agreements and internal procedures.

Authorities will expect to see documented evidence of these preparatory steps, including data quality reports, interoperability assessments, and records of technical implementations. Failure to demonstrate this foundational work could impede an organisation's ability to register with access bodies and participate in the secure and controlled sharing of health data for research, innovation, and public health purposes.

The European Commission's ongoing legislative programme to create sectoral data spaces necessitates new obligations for specific data categories and their holders.

Regulation (EU) 2025/327

Who this binds
Health data holders, health systems and secondary users of electronic health data in the EU
What changed
What is fixed is the date: 26 March 2027, when the first tranche of European Health Data Space obligations becomes applicable, covering primary use rights and data holder duties
What to check
Health data holders should start the data quality and interoperability work, because access body registration will not wait
What this does not mean
This is a date in the diary, not a new obligation published today. Nothing in force changed this morning.

Send this to your team

The European Health Data Space Regulation (EU) 2025/327 applies from 26 March 2027, requiring health data holders to ensure data quality and interoperability before registering with national access bodies.

Today's question

The European Data Protection Board (EDPB) has issued draft guidelines on anonymisation. Which of the following best reflects the EDPB's stance on anonymous data under the GDPR?

  1. Anonymous data is always subject to the GDPR, but with reduced obligations.
  2. Anonymous data falls outside the scope of the GDPR if it truly does not relate to an identified or identifiable natural person.
  3. Data can be considered anonymous if it has been pseudonymised, regardless of re identification risk.
  4. The EDPB considers all data that has undergone any form of de identification to be anonymous.

Answer this question on the site

Worth knowing

  1. French CNIL Publishes Exploratory Note on Agentic AI and Data Protection

    The French data protection authority (CNIL) has published a joint exploratory note with the French AI and Digital Council (CIANum) on the data protection implications of agentic AI. The Note provides considerations for when the EU’s General Data Protection Regulation (GDPR) might be strained by autonomous systems and identifies mitigation measures.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.