On 15 April 2026, the European Data Protection Board (EDPB) adopted draft Guidelines 1/2026 on the processing of personal data for scientific research purposes under the GDPR. Open for public consultation until 25 June, these guidelines aim to harmonise research data compliance across EU member states, an area previously marked by inconsistent national interpretations.
While they apply to scientific research broadly, their most practical impact will be felt in healthcare and life sciences, where patient records, imaging, genomic sequences, treatment outcomes, and disease registries are routinely used for research. For hospitals, academic medical centres, pharmaceutical sponsors, and contract research organisations operating across jurisdictions, including the UAE, understanding where the two frameworks align and differ is increasingly important.
What The EDPB Guidelines Say
- The guidelines address four recurring issues: what qualifies as “scientific research,” when further processing is permissible, how long data can be retained, and how consent works in a research context. These questions arise routinely in hospital trials, data sharing with universities, and disease registry work.
- The EDPB sets out six indicative factors that, when collectively met, establish that processing is for genuine scientific purposes: (i) a methodical and systematic approach; (ii) adherence to ethical standards; (iii) verifiability and transparency; (iv) autonomy and independence; (v) objectives aimed at advancing general knowledge or societal wellbeing; and (vi) potential to contribute to or apply existing scientific knowledge. The EDPB is clear that commercial research can qualify, but internal analytics undertaken purely for marketing will not, regardless of how it is labelled. Where not all six factors are present, controllers must justify and demonstrate why the activity should still fall within the scientific research definition.
- Further processing for scientific research is presumed compatible with the original collection purpose under Article 5(1)(b) GDPR, so a fresh compatibility assessment is not needed if the original legal basis remains valid and Article 89(1) safeguards, mainly pseudonymisation, are applied. This means patient data collected for treatment can be used for approved secondary research without a new legal basis analysis, provided it is adequately pseudonymised. For special category data such as genetic, biometric, sexual health, or mental health data, Article 9(2)(j) must also be properly invoked and documented.
- Data may be retained beyond the original purpose where it is held solely for scientific research. If future projects are not yet fully defined, identifying a research area is enough, so long as future activities within that area are reasonably foreseeable. This is especially relevant for biobanks, tissue repositories, and longitudinal cohort studies. Retention must still reflect a genuine research need and cannot be indefinite simply because the data might someday be useful.
- The EDPB permits broad consent where specific research purposes are not fully known at the point of collection, allowing organisations to collect data in a defined research area and refine purposes as projects evolve. Crucially, broad consent must be paired with meaningful safeguards: real-time information updates to data subjects as projects progress, access controls, time-limited consent validity, and independent or ethical oversight. The guidelines also permit a hybrid model combining broad and dynamic consent. This aligns well with biobank and cohort research, where patients often consent to a category of future research rather than a single study.
The UAE Position
- The UAE’s federal data protection regime, Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data (PDPL), in force since January 2022, also addresses scientific research, but in a very different way. This is especially relevant for UAE healthcare and life sciences institutions that participate in multi-site research involving both EU and UAE patient data.
- Unlike the GDPR, the PDPL treats scientific research mainly as an exception to consent. Article 4 allows processing without consent where necessary for archival, scientific, historical, or statistical studies in accordance with UAE law. The PDPL does not contain an equivalent to Article 9 GDPR for special category data, though sector-specific rules may still apply in practice.
- The PDPL gives no structured test for what counts as scientific research. There is no equivalent to the EDPB’s six factors, no published UAE guidance, and no statutory presumption of compatibility for further processing. As a result, hospitals using patient data for retrospective studies must document necessity carefully and apply safeguards such as pseudonymisation and ethics oversight even where not formally required. These issues are frequently assessed by a data protection lawyer in UAE when advising healthcare institutions on research compliance and data governance obligations.
- Consent also works differently. Under the GDPR, consent is one of six legal bases; under the PDPL, consent is the default and all other bases are departures from it. There is no standalone legitimate interests basis. This means a trial or observational study in the UAE may need to rely either on consent or squarely on the research exception.
- The EDPB’s broad consent approach has no direct PDPL equivalent. The PDPL requires consent to be specific, informed, and unambiguous, which creates tension for longitudinal studies, biobanks, oncology research, rare disease research, and genomics, where future uses may be unknown at enrolment. UAE healthcare organisations therefore often rely on narrow case-by-case consent or ethics board approval, but neither approach fully resolves the gap.
- The picture is further complicated by the UAE’s free zone regimes. Entities operating in the Dubai International Financial Centre (DIFC) or the Abu Dhabi Global Market (ADGM) sit outside the PDPL and are instead governed by their own data protection regimes. The DIFC Data Protection Law ( 5 of 2020) is closely modelled on the GDPR and would offer a more familiar landscape for research activities, including a broader basis for processing and greater flexibility on purpose limitation.
Practical Implications for Cross-Border Research
- Cross-border studies between the EU and the UAE require a dual-track approach, especially in clinical trials, genomics, and AI-driven diagnostics. EU-origin data must satisfy the GDPR, while UAE-origin data must satisfy the PDPL or the relevant free zone law. This evolving regulatory landscape is also closely monitored by a technology law firm in UAE advising organisations involved in digital health, research, and data-driven innovation projects.
- The EDPB framework is more predictable because it provides a six-factor test, a compatibility presumption, and a broad consent model. These tools reduce compliance friction while giving hospitals and sponsors clearer guardrails. The UAE framework is narrower and less developed, making it harder to support emerging research models, especially those involving large datasets or AI analysis.
- Organisations should consider whether UAE research can be structured through DIFC or ADGM entities where possible. Where that is not feasible, legal bases and consent documents should be designed with the PDPL’s stricter requirements in mind. In practice, many organisations draft to GDPR standards across the board to reduce risk and simplify governance.
- The EDPB guidelines remain in public consultation and may change. Organisations involved in EU research, including hospitals, academic medical centres, and pharmaceutical sponsors, can still comment before the 25 June deadline. The wider message is that the gap between the EU and UAE frameworks is real, and cross-border healthcare research should be designed with that gap in mind from the start.
Authors: Shantanu Mukherjee, Varun Alase
