TL;DR: On 15 April 2026, the European Data Protection Board (EDPB) published draft Guidelines 1/2026 on the processing of personal data for scientific research purposes — its most substantive document to date on how GDPR Article 89 and the research-specific provisions scattered across the regulation should actually be applied. Public consultation closed 25 June 2026. As of this writing the guidelines remain in draft form; the EDPB has not announced final adoption. Research offices, DPOs, and ethics committees should treat the draft as a strong signal of coming supervisory-authority practice, not yet as binding text.
Why this document matters
GDPR has always contained research-specific accommodations — the purpose-limitation carve-out in Article 5(1)(b), the Article 9(2)(j) derogation for special-category data, the Article 89(1) safeguards regime, and the broad-consent language in Recital 33 — but the regulation never defined “scientific research” itself, and eight years of divergent national supervisory-authority guidance had left research controllers without a single, EU-wide reference point. Guidelines 1/2026 is the EDPB’s attempt to close that gap in one document: 171 paragraphs across eight sections, covering academic, public-sector, and commercial research, including research that relies on AI and large-scale data reuse.
A six-factor test for what counts as “scientific research”
The draft sets out six factors the EDPB says point to genuine scientific research: a methodical and systematic approach; adherence to recognised ethical standards; verifiability and transparency of methods; the researcher’s autonomy and independence; an objective of contributing to knowledge or societal wellbeing; and a bona fide aim of advancing scientific knowledge. Where all six are present, the EDPB treats the activity as presumptively research-qualifying; where factors are missing, the burden shifts to the controller to justify the classification. Notably, the draft is explicit that qualification does not depend on whether the researcher is academic, non-profit, or commercial — industry-funded and for-profit research can qualify on the same terms if the substantive criteria are met.
Legal bases: broad consent, public interest, and legitimate interest
On lawful basis, the draft guidelines address three routes research controllers commonly rely on:
- Broad consent. Consistent with Recital 33, the draft confirms controllers can seek consent to an identifiable research area (its example: “medical research in oncology”) when the precise future purposes cannot yet be specified — but a generic reference to “scientific research” with no defined area is, in the EDPB’s reading, too vague to be valid consent. Where broad consent is used, the draft expects compensating safeguards: independent ethical oversight, time-limited validity, and clear transparency mechanisms for participants.
- Public interest, Article 6(1)(e). Available in principle to private-sector controllers too, provided the specific research task is grounded in Union or Member State law — it is not a basis private research bodies can self-declare without that underlying legal mandate.
- Legitimate interest, Article 6(1)(f). The draft explicitly confirms this basis is available for scientific research, but conditions it on a documented, structured balancing assessment that accounts for data subjects’ reasonable expectations and demonstrates the Article 89(1) safeguards actually in place — not a boilerplate legitimate-interest note.
Article 89(1) safeguards, spelled out
On the safeguards research controllers must apply once a lawful basis and, where relevant, a special-category condition are established, the draft points to a familiar but now more explicitly enumerated set: independent ethics-committee oversight, contractual limitations on downstream use, privacy-enhancing technologies, pseudonymisation, secure processing environments, researcher training obligations, and confidentiality commitments. None of this is new in substance — CASRAI’s existing GDPR and Data Protection Compliance in Research guide already walks through the Article 89(1) safeguards regime and the Article 9 special-category conditions in detail — but the draft is the first EU-level document to lay the full safeguards checklist out against the six-factor research test in one place, which is what makes it a genuinely new reference point rather than a restatement.
A restrictive line on data-subject-right derogations
The draft is notably cautious on derogations from data subject rights under Article 9(2), signalling that supervisory authorities should read them narrowly and case by case rather than as a general research exemption. One concrete example already drawing attention from data-protection practitioners: the draft interprets the “manifestly made public” condition restrictively, requiring a data subject’s clear affirmative act of publication — not merely data left accessible under a platform’s default privacy settings. Guidance of this kind bears directly on special-category data processing built on scraped or reused social-media and public-web datasets, a growing category as AI-assisted and large-scale reuse research expands.
Where this leaves research offices now
Because the guidelines are still in draft form, nothing in them is directly enforceable yet, and the EDPB may revise substantive positions before final adoption based on consultation feedback from academic institutions, companies, DPOs, NGOs, and government authorities who responded during the comment period. Research administrators and DPOs should treat the current text as the clearest available preview of where EU/EEA supervisory-authority practice on research data is heading: review current broad-consent language against the “identifiable research area” standard, confirm Article 6(1)(e) reliance is actually anchored in a specific legal mandate rather than assumed, and audit whether Article 89(1) safeguards documentation would hold up against the newly enumerated checklist. CASRAI will update this page and its companion GDPR guide once the EDPB adopts a final version.
