Published 05.08.2026 — MEDDDICAL Editorial
The European Health Data Space Regulation (Regulation EU 2025/327) entered into force on 26 March 2025. After years of legislative development, the framework that will govern how electronic health data is accessed, shared, and reused across all EU Member States is now legally binding. For pharmaceutical and MedTech companies, this is not a distant regulatory development to monitor. It is a structural change to the European health data landscape that will affect evidence generation strategy, data procurement, and regulatory submission planning before the end of this decade.
This article explains what has happened, what it means for pharma and MedTech teams in practical terms, and what the implementation timeline requires you to understand now — before the secondary use provisions become fully operational in March 2029.
What the EHDS Is — and What It Is Not
The EHDS is a common framework and data infrastructure supporting data sharing for primary purposes — healthcare purposes — and secondary purposes, covering research, evidence-based policymaking, and regulatory decisions. It establishes, for the first time, a unified EU-wide legal, technical, and governance architecture for electronic health data that spans all 27 Member States.
What the EHDS is not is a single unified health database. It does not consolidate all European health data into one place. Instead it creates the legal framework and technical infrastructure through which data held by existing health data holders — hospitals, registries, health insurance funds, research institutions — can be accessed by approved users for approved purposes, through nationally designated bodies operating to harmonised EU standards.
It is also not immediately operational. The EHDS Regulation entered into force in March 2025, but is not fully implemented. The period from 2025 to 2027 is a secondary legislation phase during which the European Commission will draft implementing and delegating acts. From 2027 to 2029, Member States will enter a preparation phase during which EU countries will create data hubs and integrate them with EU-wide infrastructure. The practical implication: what entered into force in March 2025 is the legal architecture. What will become operationally available from March 2029 is the data access infrastructure built on top of it.
The Secondary Use Framework — What It Opens for Pharma
For life sciences companies — pharma, biotech, and medtech — the EHDS’ secondary use provisions will become applicable in 2029, leaving companies approximately four years to consider, adapt to, and implement these wide-ranging requirements.
Secondary use is the formal term for using health data for purposes other than the direct care of the patient it was collected from. The EHDS defines the permitted secondary use purposes explicitly. They include scientific research, development and innovation activities, training and testing of algorithms and AI models, regulatory purposes, and policy-making. Processing electronic health data for secondary use will only be possible for specific purposes outlined in the Regulation, based on a permit issued by a health data access body.
For pharmaceutical and MedTech companies, this creates two legally defined roles simultaneously:
As a data user, a pharmaceutical company — like all other stakeholders — can search EU data catalogues hosted by the HDABs and request a permit to conduct research on any identified datasets of interest. If a permit is granted, access to data is provided and research can be conducted, holding potential to advance discovery and development of new medicines. As a data holder, companies are required to enable access to health datasets they collect and host across a range of data types — involving data curation, cataloguing, anonymisation, and security measures in alignment with the HDABs.
The scope of data covered by the secondary use provisions is broad. It includes data from electronic health records, claims data, patient registries, genomic data, and data from clinical trials. Most of the secondary use provisions will apply from 2029, with those relating specifically to clinical trial and human genetic data applying from 2031.
Health Data Access Bodies — The New Gatekeepers
The operational centrepiece of the EHDS secondary use framework is the Health Data Access Body. Understanding what HDABs are and how they work is the most practically important thing any pharma or MedTech team can do to prepare for 2029.
Access to health data for secondary use will not be based on bilateral requests to hospitals, registries or public authorities alone. Instead, HDABs will act as gatekeepers. They will assess data access applications, issue data permits, request the relevant data from health data holders and provide access through secure processing environments. The framework is therefore designed as controlled access, not open access.
Every EU Member State is required to designate its HDAB by March 2027. At the time of publication, Ireland has not yet designated its HDAB, but has established HealthData@IE, which is Ireland’s national project focused on setting up health data access services. Similar preparatory structures are being established across other Member States — Belgium’s Health Data Agency, Germany’s FDZ Gesundheit infrastructure under the GDNG, and Finland’s Findata are among the national-level precedents that the EHDS framework is in part modelled on.
The HDAB has up to three months to either grant or refuse a data permit in response to a request. If granted, the data permit will set out the conditions for use, including the categories and format of the electronic health data and purpose limitations. A simplified four-month procedure may be available for data held by designated trusted health data holders.
For pharma teams accustomed to commercial data licensing — where access is a matter of contract negotiation rather than regulatory permission — this represents a fundamental shift in the procurement model. Data access under the EHDS is a regulated process, not a commercial transaction.
Secure Processing Environments — Bring Your Questions to the Data
The technical architecture through which approved data users will access health data under the EHDS is equally important to understand. The EHDS does not permit raw data to be downloaded or extracted by data users. Instead it operates through Secure Processing Environments.
A Secure Processing Environment is a controlled system where data users can access and analyse health data securely, without being able to download or extract raw data. SPEs ensure data protection, security, and compliance with EHDS rules. The provision of SPEs is the responsibility of the Health Data Access Bodies, which ensure that data is accessed in a controlled, secure, and privacy-compliant manner. Pharmaceutical companies do not need to have their own Secure Processing Environment.
The overarching idea is that the data is, unless necessary, not further transferred but processed within these SPEs — the concept of “bring your questions to the data instead of moving the data.”
This architecture has significant implications for how pharma teams will need to design evidence generation workflows. Analytical code and statistical programmes will need to be brought into the SPE environment rather than the data being exported into existing analytical infrastructure. Teams planning observational studies, comparative effectiveness analyses, or HEOR modelling on EHDS-sourced data will need to adapt their study design and execution workflows accordingly — and should begin that adaptation before the SPE environments become operational in 2029.
This model is not without precedent. Germany’s FDZ Gesundheit already operates a similar Analyseraum (analysis room) model for access to statutory health insurance data under the GDNG — pharma teams that have already engaged with the FDZ Gesundheit access process will recognise the architecture immediately. The EHDS effectively generalises this model across all 27 EU Member States.
The Implementation Timeline — What Happens When
Understanding precisely what is and is not yet defined under the EHDS is essential for planning. The regulation entered into force in March 2025 but most of its provisions do not yet apply. Here is the confirmed implementation sequence:
March 2025 — Regulation entered into force. The legal framework is established. The transition period has begun. No operational data access is yet available under EHDS.
June 2025 — National Digital Health Authority designation deadline. Each EU Member State must appoint a National Digital Health Authority to oversee EHDS implementation.
January 2026 — EHR system interoperability deadline. All healthcare providers and EHR vendors must certify their systems for interoperability and security compliance.
March 2027 — HDAB designation deadline and implementing acts deadline. The deadline for the Commission to adopt several key implementing acts providing detailed rules for the regulation’s operationalisation. Every Member State must have designated its HDAB by this date. The implementing acts covering technical specifications, data quality standards, the Common Application Form, and SPE technical requirements must be published by this date.
2027–2029 — Member state preparation phase. EU countries will create data hubs and integrate them with EU-wide infrastructure. This is when the HealthData@EU cross-border infrastructure — connecting national HDABs into a single pan-European data access network — will be built and tested.
March 2029 — Secondary use provisions become applicable. Key parts of the EHDS Regulation will enter into application, including rules on secondary use for most data categories such as data from electronic health records. From this date, approved data users — including pharmaceutical and MedTech companies — can submit data permit applications to HDABs and access health data through SPEs for permitted secondary use purposes.
March 2031 — Clinical trial and human genetic data. Provisions relating specifically to clinical trial and human genetic data will apply from 2031.
What Is Still Being Defined
Intellectual honesty requires acknowledging what is not yet settled. A significant portion of the EHDS’s practical operational detail will be determined through implementing acts that the European Commission has until March 2027 to publish. At the time of writing, the following remain to be defined through secondary legislation:
The technical specifications for Secure Processing Environments — including the software environments that will be available within SPEs, the code languages and analytical tools that will be supported, and the output checking procedures that will apply to research results before they are released to data users.
The data quality label specifications — the EHDS requires health data holders to document and publish data quality information, but the specific metadata standards and quality indicators have not yet been finalised through implementing acts.
The Common Application Form — the standardised data permit application format that will be used across all EU Member States. Harmonisation of this process is one of the EHDS’s most practically significant innovations compared to the current fragmented bilateral access model.
De-identification and anonymisation standards — the HDAB is responsible for ensuring that anonymisation or pseudonymisation is properly implemented before providing access to data, but the specific responsibilities will be defined in implementing acts.
The trusted health data holder designation process — which will determine which data holders qualify for the simplified four-month access procedure.
What Pharma Teams Should Do Now
Given that the EHDS will not be operationally available for secondary use access until March 2029, the question is what actions are worth taking now rather than waiting. The answer is more than most teams currently appreciate.
Map your secondary use cases against the EHDS permitted purposes. Research and innovation use, including algorithm training and evaluation, will need to be framed clearly. Companies should separate permitted scientific or regulatory use from prohibited uses such as individual decision-making, insurance or employment profiling, advertising and marketing. Understanding which of your planned evidence generation activities will be EHDS-permissible is the essential first step.
Audit your data holdings. Data inventories, metadata, data quality information, access logs, pseudonymisation workflows and secure processing arrangements should be reviewed before HDAB processes become operational. This will reduce friction when data permits, data requests and HealthData@EU workflows begin to develop. For companies that are also data holders — organisations with proprietary clinical trial data, registry data, or digital health platform data — this audit is both a compliance requirement and a strategic opportunity.
Monitor HDAB establishment in your priority markets. The designation deadline is March 2027 but several Member States are already well advanced in establishing their national structures. Germany’s FDZ Gesundheit under the GDNG provides an operational preview of what HDAB-mediated access looks like in practice. Belgium’s Health Data Agency and Ireland’s HealthData@IE are at different stages of readiness. Understanding the national landscape in your priority markets will be essential for planning evidence generation timelines.
Begin adapting analytical workflows for SPE-based access. The shift from commercial data licensing to SPE-based analytical access represents a meaningful change to how evidence generation studies are designed and executed. Teams that begin this adaptation now — including piloting SPE-based workflows through existing national-level access programmes like FDZ Gesundheit — will be substantially better positioned when EHDS access becomes available in 2029.
Engage expert advisory support for evidence strategy planning. The intersection of EHDS secondary use access, existing national frameworks like the German GDNG, and ongoing GDPR obligations creates a compliance and strategy landscape that is genuinely complex to navigate without specialist guidance. Evidence generation programmes that will span the 2025–2029 transition period need to be designed with both the current access routes and the emerging EHDS architecture in mind simultaneously. For an independent assessment of how the EHDS affects your specific evidence generation requirements, contact MEDDDICAL to discuss your programme.
The Bigger Picture
Health data represents over 30% of the world’s data assets, yet less than 3% is utilised for secondary purposes such as research, regulatory, or public health purposes — a persistent data-to-value gap. The EHDS is the EU’s most ambitious attempt to close that gap systematically rather than through the fragmented bilateral arrangements that have characterised European health data access to date.
For pharmaceutical and MedTech companies, the implications are substantial. The evidence generation landscape for European markets will look materially different in 2029 than it does today. The companies that understand the EHDS framework now — and begin positioning their evidence strategies, analytical capabilities, and data governance infrastructure accordingly — will be better placed to use the framework effectively when it becomes operational than those who wait until the implementing acts are finalised to begin preparing.
MEDDDICAL will continue to cover EHDS implementation developments as implementing acts are published, HDABs are designated, and the HealthData@EU infrastructure takes shape. Watch this section for updates.
Key Facts at a Glance
- Regulation number: EU 2025/327
- Entered into force: 26 March 2025
- Secondary use provisions apply from: March 2029
- Clinical trial and human genetic data provisions apply from: March 2031
- HDAB designation deadline: March 2027
- Implementing acts deadline: March 2027
- Cross-border infrastructure: HealthData@EU
- Data access model: Permit-based, via HDABs, within Secure Processing Environments
- Prohibited uses: Individual decision-making, insurance profiling, employment profiling, advertising, marketing
Sources and References
- European Commission. European Health Data Space Regulation (EHDS) — official documentation. https://health.ec.europa.eu
- Official Journal of the European Union (5 March 2025). Regulation (EU) 2025/327 of the European Parliament and of the Council establishing the European Health Data Space. https://eur-lex.europa.eu
- Sidley Austin LLP (January 2025). European Health Data Space Regulation Adopted: What’s Next for Life Sciences Companies? https://www.sidley.com
- Skadden (June 2025). The European Health Data Space — What EU Health Care Providers and Data Holders Need To Know. https://www.skadden.com
- Taylor Wessing (2025). EHDS implementation: preparing for health data access and reuse. https://www.taylorwessing.com
- McCann FitzGerald (January 2026). EHDS Regulation: Secondary Use of Electronic Health Data. https://www.mccannfitzgerald.com
- DIA Global Forum (April 2026). The European Health Data Space (EHDS): Breakthrough Moment in Sharing Health Data. https://globalforum.diaglobal.org
- Sidley / GoodLifeSci (April 2026). Navigating the European Health Data Space Regulation: An (Uneasy) Marriage Between EHDS and GDPR. https://goodlifesci.sidley.com
- European Health Data Space informational hub. https://www.european-health-data-space.com
- Slokenberga, S., et al. (2025). Shaping the future EHDS: recommendations for implementation of Health Data Access Bodies in the HealthData@EU infrastructure. PMC / NCBI. https://www.ncbi.nlm.nih.gov/pmc/articles/PMC12420904/
- European Medicines Agency. DARWIN EU — Data Analysis and Real-World Interrogation Network. https://www.ema.europa.eu
This news article reflects the regulatory position and available public information as of the date of publication. EHDS implementing acts are still being developed and operational details remain subject to change. MEDDDICAL will publish updates as significant developments occur. This article does not constitute legal advice.
