What is the GDPR and how it treats health data

GDPRGeneral Data Protection Regulation

In short

The GDPR is the European Union regulation that governs the processing of personal data; it has applied since 25 May 2018. It classifies data concerning health as a special category: processing is prohibited except in the cases it lists, such as explicit consent, health care or public health. It also reaches organizations outside the EU that offer goods or services to people in the Union.

Explanation

What it is

Regulation (EU) 2016/679, whose official short title is the "General Data Protection Regulation", was adopted on 27 April 2016, published in the Official Journal (OJ L 119) on 4 May 2016 and has applied since 25 May 2018. It repealed Directive 95/46/EC. As a regulation, it applies directly in every Member State, without transposition.

Who it applies to

Controllers and processors established in the EU, even if the processing takes place outside it (Art. 3(1)).
Those not established in the EU when they offer goods or services to people in the Union or monitor their behaviour there (Art. 3(2)).

Health data

Article 4(15) defines "data concerning health" as personal data related to a person's physical or mental health, including the provision of health care services, which reveal information about their health status. Article 9(1) prohibits processing them, together with genetic and biometric data, except in the cases of Article 9(2):

Point	Case
a	Explicit consent for specified purposes
c	Vital interests, where the person cannot consent
h	Preventive or occupational medicine, diagnosis, care or management of health systems, under professional secrecy (Art. 9(3))
i	Public interest in public health
j	Scientific research, archiving or statistics

Article 9(4) allows each Member State to maintain or introduce further conditions for genetic, biometric or health data, so the specific rules vary between countries.

Supervision and fines

Each Member State has an independent supervisory authority; the European Data Protection Board ensures consistent application. Infringements of the principles and of Articles 6, 7 and 9 can lead to fines of up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (Art. 83(5)). Personal data breaches are notified to the authority, as a rule, within 72 hours (Art. 33).

Status as of October 2026

According to EUR-Lex, the text has only received corrigenda; there is no consolidated version later than the original. Two Commission proposals from 2025 would amend it, COM(2025) 501 and COM(2025) 837 (the "Digital Omnibus"). Neither has been adopted.

Common misconceptions

Believing health care requires consent. Article 9(2) offers other bases, such as point (h).
Believing it only affects European companies. Article 3(2) reaches organizations on other continents.
Confusing it with the EHDS. Regulation (EU) 2025/327 specifies and complements GDPR rights for electronic health data; it does not replace it.

Usage examples

A hospital in a Member State can process health data for diagnosis and care on the basis of Article 9(2)(h), always under the responsibility of a professional subject to professional secrecy (Art. 9(3)).

Article 9(4) allows each Member State to set further conditions for genetic, biometric or health data.

The European Commission has an adequacy decision for Brazil dated 26 January 2026; Argentina and Uruguay are also among the countries recognized as adequate.

Regulation (EU) 2025/327 on the European Health Data Space specifies and complements GDPR rights for the primary and secondary use of electronic health data.

Proposal COM(2025) 837, known as the "Digital Omnibus", would amend the GDPR; as of October 2026 it has not been adopted.

Interoperability assessment

Architecture definition

Data modeling

Implementation Guides

FHIR layer

HIE Integration

Cloud Repositories

Kivú RIS

Kivú PACS

Kivú FHIR

Kivú Terminology

Kivú Conquest

Kivú eSignature