Sector
Data protection in research projects
Consent is rarely the most durable basis in a research project, because it can be withdrawn. The research privilege in Art. 5(1)(b) GDPR declares further processing not incompatible, but it does not supply a legal basis. And whether pseudonymised data are personal at the receiving partner depends, under the Court of Justice, on that partner's means and not on the pseudonymisation as such.
Funded, the legal basis open
The grant is awarded, the consortium is in place, and the ethics committee asks about the legal basis. The application says the participants will consent. Existing data from an earlier collection are to be used alongside, and a partner in another country is to take over the analysis.
Consent is the basis that can be withdrawn
What the processing can rest on is answered almost identically in every application, and that answer is the most fragile. Consent can be withdrawn at any time under Art. 7(3) GDPR, and in a longitudinal study the withdrawal lands in the middle of the analysis.
Two bases and what they mean for the project
| Consent | Merkmal | Public task |
|---|---|---|
| Art. 6(1)(a) GDPRFor special categories additionally Art. 9(2)(a) GDPR, and there expressly. | Provision | Art. 6(1)(e) GDPRTogether with the university or state data protection act. For special categories Art. 9(2)(j) GDPR with section 27 BDSG or state law. |
| At any timeWith effect for the future, but the data cannot be used afterwards. | Withdrawal | No withdrawalInstead an objection under Art. 21 GDPR, which triggers a balancing exercise and does not automatically prevail. |
| NarrowRecital 33 allows areas of research but does not replace specificity. | Specificity of purpose | WiderThe purpose follows from the task and from the statute assigning it. |
| Freely givenWhere participants depend on the treating or teaching staff, this is hard to establish. | Practical hurdle | Public bodies onlyPrivate sector research is left with Art. 6(1)(f) GDPR and the balancing exercise. |
The assignment of a public task does not put participants in a weaker position but in a different one. The objection takes the place of the withdrawal, and the information under Art. 13 GDPR takes the place of the form.
The research privilege answers compatibility, not permissibility
What the research privilege delivers is frequently overestimated. The second half-sentence of Art. 5(1)(b) GDPR declares further processing for research purposes not incompatible with the original purposes. That is a statement about purpose limitation and none about the legal basis.
Three assessments for existing data
Legal basis
The further processing needs a basis of its own under Art. 6 GDPR and, for special categories, another under Art. 9(2) GDPR.
Compatibility
Here the privilege bites. An assessment under Art. 6(4) GDPR becomes unnecessary where the safeguards in Art. 89(1) GDPR are met.
Safeguards
Art. 89(1), fourth sentence, GDPR requires the purpose to be fulfilled without identification wherever that is possible. That is an obligation and not a recommendation.
3 von 3
The third step is passed over most often, and it carries the sharpest wording. Where the research purpose can be achieved without identification, it is to be achieved without identification.
Pseudonymised data are not personal for every body
When pseudonymised data cease to be personal was decided by the Court of Justice on 4 September 2025 in Case C-413/23 P. The judgment was given on the data protection law of the Union institutions, whose definitions are identical in wording to those of the Regulation, and the answer comes out differently for two bodies.
In practice this calls for an assessment that cannot be carried out on the dataset alone. What has to be determined is which means the receiving body has, and its own data holdings are among them. An institute that knows the same cohort from another collection can make the link where a data centre outside the field cannot.
In a consortium the role decides which document is needed
How a transfer inside a consortium is to be classified rarely appears in consortium agreements, because those govern results and exploitation. In data protection terms a consortium breaks down into several processing operations, each with its own attribution, and the attribution decides which document is needed.
Four constellations and the document each calls for
Joint determination of purposes and means
Art. 26(1) GDPR calls for an arrangement determining who fulfils which obligation. Its essence has to be made available to the data subjects under paragraph 2, that is, taken up in the participant information.
Analysis on the instructions of the lead partner
Then there is processing on behalf, and Art. 28(3) GDPR applies. The partner may not use the data for publications of its own, and that is precisely the sensitive point in consortia.
Transfer to a partner with a purpose of its own
A transfer to a controller in its own right. It needs a legal basis at the sending end and one at the receiving end, and the two are determined separately.
Transfer outside the European Economic Area
Chapter V of the Regulation applies. Pseudonymisation does not by itself remove that character, because what matters is whether the receiving body could establish the link by means reasonably likely to be used.
How we support you with your research project
The four questions belong in the application rather than in delivery, because there is still room to shape them at that stage. What is needed is a table with one row per data flow, setting out origin, legal basis, the recipient’s role and the degree of pseudonymisation. Participant information, the arrangement and the answer to the ethics committee all follow from it. It is best drawn up while the consortium agreement is still being negotiated.
Frequently asked questions
May consent be framed broadly for future research?
Within limits, yes. Recital 33 recognises that the purpose of a scientific study often cannot be fully specified at the time of collection, and it allows consent to certain areas of research. The specificity required by Art. 4(11) GDPR does not fall away, and the broader the framing, the more convincing another basis becomes.
Do data subject rights apply without restriction in a research project?
Not necessarily. Art. 89(2) GDPR permits the Union and member state legislatures to derogate from Arts. 15, 16, 18 and 21 GDPR in so far as those rights would render the purposes impossible or seriously impair them. Whether such a derogation exists follows from the law of the state concerned and should be settled before any undertaking is given to the ethics committee.
When is an impact assessment required?
Regularly where special categories are processed on a large scale under Art. 35(3)(b) GDPR, which covers many medical and social science projects. It has to be carried out before the processing and therefore belongs in the application phase rather than in delivery.
What applies to partners outside the European Economic Area?
Chapter V of the Regulation applies, starting with Art. 44 GDPR. That the data are transferred in pseudonymised form does not by itself remove that character. Under the Court of Justice what matters is whether the receiving body could establish the link by means reasonably likely to be used.
Get in touch!
Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!
Contact usAlternatively you can request a call back.