- Article 9 GDPR prohibits processing health data by default; research becomes lawful only through an exception, chiefly explicit consent or the research provision.
- Article 9(2)(a) explicit consent is near-uniform across the EU (rare national carve-outs exist) and revocable; Article 9(2)(j) depends on member-state law and gives the individual no equivalent lever.
- Article 89(1) safeguards — data minimization and pseudonymization among them — apply to research processing regardless of the path chosen.
- Pseudonymized data is still personal data under Recital 26; the GDPR's anonymization bar is far higher than removing names.
On this page
Article 9 of the GDPR opens with a ban. Before the regulation grants anything, names any safeguard, or lists any right, it tells you what may not happen at all:
Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
Health research in Europe lives entirely in the exceptions to that sentence. There are ten of them, lettered (a) through (j) in Article 9(2), and for research two matter most: explicit consent and the research provision. Which door a project walks through shapes everything downstream — who decides, what patients know, and how far the data can travel.
Health data is forbidden by default
Under the GDPR, data concerning health is special-category data: processing it is prohibited unless an Article 9(2) exception applies — and an ordinary Article 6 legal basis is still required on top.
The definition is wide. It covers diagnoses and lab results, but also anything that reveals health status: appointment histories, prescription records, the bare fact of attending a particular clinic. Wearables and health apps generate it constantly. And the two-layer structure has teeth in practice: clearing Article 9 does not excuse a controller from the rest of the regulation. Lawfulness, transparency, minimization, storage limits, and the full set of data-subject rights all continue to apply.
Door one: explicit consent — Article 9(2)(a)
The first exception lifts the prohibition when the data subject has given explicit consent to the processing for one or more specified purposes.
Every word is load-bearing. Consent under the GDPR must already be freely given, specific, informed, and unambiguous; for special-category data it must be explicit on top — a clear affirmative statement, not a pre-ticked box or a clause folded into terms of service. The purposes must be specified, which is why a signature covering "research" in the abstract sits on thin ice; Recital 33 offers limited flexibility for consent to certain areas of scientific research, but European regulators have read that flexibility narrowly. And consent is revocable: withdrawal must be as easy as the grant, and it stops future processing without unwinding the lawfulness of what came before. The engineering it takes to honor that quickly is a subject of its own — see what revocable consent really means.
Door two: the research provision — Article 9(2)(j)
The second path permits processing for scientific research purposes without consent — but only on the basis of Union or member-state law, and only with the safeguards Article 89(1) demands.
This is the door most secondary-use research walks through, and it is both sturdier and stranger than it looks. Sturdy, because it recognizes that some research — fifty years of cancer registries, population-scale epidemiology — cannot practicably run on individual signatures. Strange, because it is not self-service: a controller cannot simply declare its work "research" and proceed. The processing must rest on an actual law, and those laws differ across all 27 member states; what a university hospital may do in one country is not what a cohort study may do in the next. Article 89(1) then layers safeguards on regardless: data minimization, pseudonymization wherever the purpose can still be fulfilled, and technical and organizational measures proportionate to the risk. Guidance from the European Data Protection Board and from national authorities such as the UK's ICO — which administers the parallel UK GDPR — fills in the local texture.
The two doors, side by side
| Explicit consent — 9(2)(a) | Research provision — 9(2)(j) | |
|---|---|---|
| Who decides | The patient | The controller, under national law |
| Legal texture | Uniform across the EU | Different in every member state |
| Individual control | Withdraw at any time | No equivalent lever |
| Patient awareness | Inherent — consent is the event | Transparency duties only |
| Cross-border research | Reads the same everywhere | Re-analysis at each border |
The table understates one asymmetry. Under 9(2)(j), the patient is a subject of the processing; under 9(2)(a), the patient is a party to it. Both are lawful. They are not the same relationship.
What both doors still require
Neither path suspends the rest of the regulation — and neither turns personal data into anonymous data.
Purpose limitation still binds: Article 5(1)(b) presumes that further processing for scientific research is compatible with the original purpose, but only with Article 89 safeguards traveling alongside. Minimization still binds: collect what the question needs, not what the pipeline can hold. And the anonymization threshold stays high. Under Recital 26, pseudonymized data — key-coded, tokenized, "de-identified" in the American sense — remains personal data so long as anyone, by means reasonably likely to be used, could re-identify it. The three regimes hiding behind those words are untangled in de-identified, anonymized, pseudonymized.
Why consent travels best
For research that spans borders, explicit consent is the Article 9 basis that reads most nearly the same across member states (a few restrict consent for narrow categories) — which makes it the cleanest cross-border story available.
A project built on 9(2)(j) re-litigates its legality at each frontier, because the underlying national law changes; a project built on 9(2)(a) carries its basis with it. Architecture can finish the job the legal basis starts: keep records in the region where they were created, send the query to the data, and return only aggregates — the pattern behind why health data can't just cross borders. And the ground is shifting constructively: the European Health Data Space is building a dedicated framework for secondary use on top of the GDPR's foundations.
Mithras Health chose the consent door and built the machinery to deserve it. Every study on the platform runs on explicit, scope-limited consent — one decision, two documents, a plain-language summary and a formal authorization, revocable at any time — rather than on a patchwork of national research provisions. And because the cleanest transfer is the one that never happens, records stay in-region: federated queries run where the data lives and return aggregates only, with every event recorded on an append-only audit trail. The platform is designed against GDPR, UK GDPR, and the arriving EHDS together.
Article 9 is sometimes read as Europe's suspicion of science. Read again, it is closer to a design brief: prohibited, except — and the exceptions describe relationships, not loopholes. A law that opens with a ban is telling builders exactly where the doors are. The mistake is treating the hinges as obstacles.
Appendix · questions
Questions, answered
Can health data be used for research under GDPR?
Does GDPR require consent for medical research?
What is the difference between Article 9(2)(a) and 9(2)(j)?
Is pseudonymized health data still personal data under GDPR?
The patient-mediated research-data platform for chronic disease — 28 conditions, worldwide consented sources, one auditable spine. Join the launch list.
The sun is rising on chronic-disease research.
One email when we launch — and nothing else. Patients, researchers, sponsors, and programs all start here.