# GDPR and health data (Regulation (EU) 2016/679)

Source: https://onco.cc/terms/gdpr/  
OnCo record `gdpr` (Term). Data CC BY-NC 4.0, attribute "Data from OnCo (onco.cc)"; commercial use needs a licence.

## TL;DR

The EU's 2016 data law, applied since May 2018, that treats health and genetic data as a special category needing a specific legal basis, gives people rights over their records, and shapes how cancer registries, biobanks and trials share data, including across borders.

## Summary

European Union, regulation, also retained in UK law. The General Data Protection Regulation (EU) 2016/679 of 27 April 2016 applied from 25 May 2018, replacing Directive 95/46/EC. Primary text: EUR-Lex.

What it means for cancer research and care: health data, genetic data and biometric data are 'special categories' under Article 9 that may be processed only on a listed basis, such as explicit consent, healthcare provision or scientific research in the public interest with safeguards (Article 9(2)(j) and Article 89). Pseudonymised data remain personal data. Controllers must document purposes, run impact assessments for high-risk processing such as genomic databases, and honour access, rectification and (with research exceptions) erasure rights. Transfers outside the European Economic Area need adequacy or contractual safeguards, and the Court of Justice's Schrems II judgment of 2020 complicated the flow of trial data to US sponsors.

The arguments: the regulation gave individuals real rights and a single rulebook, but its research provisions leave much to national law, so a pan-European registry study can face 27 interpretations of consent and anonymisation, and US institutions have refused to sign EU data-transfer clauses. The European Health Data Space Regulation of 2025 is the attempt to build a common route for secondary use on top of the GDPR. The comparison with the US model, where HIPAA regulates holders rather than data, is the standard framing in the literature.

## Fields

- Kind: Term
- Last checked: 2026-09-17
- Also known as: GDPR; General Data Protection Regulation; Regulation 2016/679; special category data; Article 9 health data; Article 89 research; pseudonymisation; data protection impact assessment; Schrems II
- Tags: law; eu

## Sources

- Wikipedia: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation
- Wikipedia: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation
- EUR-Lex: Regulation (EU) 2016/679: https://eur-lex.europa.eu/eli/reg/2016/679/oj

## Connected records

- terms: [China Human Genetic Resources rules (2019, 2023)](https://onco.cc/terms/china-hgr-rules/), [Clinical Trials Regulation (EU) No 536/2014 and CTIS](https://onco.cc/terms/eu-clinical-trials-regulation/), [European Health Data Space Regulation (EU) 2025/327](https://onco.cc/terms/european-health-data-space/), [GINA (Genetic Information Nondiscrimination Act 2008)](https://onco.cc/terms/gina/), [HIPAA (Health Insurance Portability and Accountability Act)](https://onco.cc/terms/hipaa/), [IVDR (EU In Vitro Diagnostic Regulation 2017/746)](https://onco.cc/terms/ivdr/), [PIPL (China Personal Information Protection Law 2021)](https://onco.cc/terms/pipl/), [UK Data Protection Act 2018 and health data law](https://onco.cc/terms/uk-data-protection-act/)
- technologies: [Oncology EHR and real-world data platforms](https://onco.cc/technologies/oncology-real-world-data/)
- bottlenecks: [Data silos](https://onco.cc/bottlenecks/b-data-silos/), [Weak real-world evidence and registries](https://onco.cc/bottlenecks/b-real-world-evidence/)

---
JSON: https://onco.cc/api/v1/entities/gdpr.json