Beyond consent-centric: what EHDS and governed reuse change for evidence
Governance of health data is moving from the signature on a consent form to a system of institutional guarantees. What the European Health Data Space actually changes for secondary use, and what it demands in return.
Insight · · 4 min
For most of the last decade, the legal centre of gravity for health-data research was the consent form. If you wanted to reuse data for a new question, you went back for a new signature, or you did not do the study. That model is being replaced, and the replacement is not a loosening.
Regulation (EU) 2025/327 on the European Health Data Space was adopted in February 2025 and entered into force in March 2025, with its provisions phasing in over several years and the secondary-use regime applying from 2029. It does two distinct things. Its primary-use chapter concerns patients' access to and portability of their own records. Its secondary-use chapter, the one that changes research, establishes a route for reusing electronic health data for scientific research, innovation, policymaking and regulatory activity, mediated by national Health Data Access Bodies rather than by individual consent for each purpose.
The mechanism is worth understanding because it is unfamiliar. A researcher applies to a Health Data Access Body for a data permit describing the purpose, the data categories and the intended output. If granted, the analysis runs inside a secure processing environment: the computation goes to the data, and only results leave. Raw data is not shipped to the applicant. Where results could identify individuals, they do not leave at all. This is a different architecture from the export-and-analyse model most research operations were built around, and it sits alongside, not instead of, the GDPR, whose Article 9(2)(j) research condition and national derogations continue to apply.
Calling this 'beyond consent-centric' is accurate but easily misread. Consent does not disappear; it stops being the single load-bearing safeguard. What replaces it is a stack of guarantees: a statutory basis for the reuse, an independent authority deciding whether a given purpose qualifies, a technical environment that constrains what can be done with the data, a published record of permits granted, and an opt-out mechanism for individuals that member states must provide for. Distributing the safeguard across institutions is, on balance, more protective than a signature collected years earlier for a purpose nobody could then describe. It is also considerably more work.
That work falls on the data holders, and this is the part sponsors and research organisations tend to underestimate. To be usable under this regime, data has to be described well enough for someone who did not collect it to judge whether it fits their question. EHDS requires data holders to publish dataset descriptions, and quality and utility labelling, so applicants can assess fitness for purpose before applying. In practice that means standardised metadata, documented provenance, an intelligible data dictionary, a completeness profile, and coding aligned to recognised terminologies. Data that exists but cannot be characterised will not be reusable, and a study that cannot demonstrate the provenance of its inputs will not be defensible however it was obtained.
The Data Governance Act, Regulation (EU) 2022/868, sits underneath this as the general framework for data intermediation and data altruism, and the European Health Data Space is best read as its health-sector application rather than as a standalone experiment. Together they describe a European position that has been consistent for several years: reuse is legitimate, and legitimacy is earned through infrastructure rather than asserted through paperwork.
For evidence generation, the opportunity is concrete. Questions that a fresh prospective study cannot answer, because the population is too dispersed, the follow-up too long, or the event too rare, become tractable when years of routinely collected data can be interrogated under a permit. Natural-history characterisation, external comparator construction, treatment-pathway description, safety signal follow-up and feasibility assessment all sit naturally in this space, and all of them currently consume prospective budget that need not be spent.
The corollary is a shift in what a research partner has to be good at. Under a consent-centric model, the operational skill was recruitment and site management. Under a governed-reuse model, it is metadata conformance, permit application, analysis inside a constrained environment, and the discipline of pre-specifying an analysis you cannot iterate on freely once inside. Organisations that invest in that now will find the 2029 threshold uneventful. Those still treating health data as a raw material to be exported and cleaned locally will find it abrupt.
There is one caution worth stating. A federated, permit-mediated route makes lawful reuse possible; it does not make the resulting evidence automatically fit for purpose. The methodological questions do not change. Confounding, missingness, selection and measurement error behave exactly as they did before, and a secure processing environment does nothing to address any of them. Governed access solves the legal problem. The scientific problem remains yours.
Sources. Regulation (EU) 2025/327 on the European Health Data Space, adopted February 2025, in force March 2025, secondary-use provisions applying from 2029. Regulation (EU) 2022/868 (Data Governance Act). Regulation (EU) 2016/679 (GDPR), Article 9(2)(j).
Written by the Evidilya scientific team. For interviews, references or a full publication list, use the contact page.
Talk to our team.
Bring us the evidence question you're wrestling with, we'll tell you the shortest defensible path.