Latham & Watkins LLP
The Regulation 2025/327 creating the European Health Data Space, also known as the EHDS Regulation, was published in the Official Journal of the European Union on 5 March 20 The European Commission published FAQs about the European Health Data Space in March 2025. Please see our previous blog for a detailed overview of the EHDS Regulation. This includes its purpose, scope and the challenges that it is designed to address. The EHDS Regulation has as one of its main goals to facilitate the secondary use of clinical information for research. As we explained in our previous blog, the EHDS Regulation can have a huge impact on health research. However, it also poses many challenges to the pharmaceutical and medical technology In this post, we provide an update on some of those key challenges and what companies can do to prepare.
Challenges
Territorial Scope
One of the initial key uncertainties when the EHDS Regulation was first published was its territorial scope. In the FAQs published by the European Commission, it is clarified that the EHDS Regulation applies only to health data holders located within the EU. It will not be applicable to health data holders located in third countries that do not have an EU establishment. For example, sponsors from outside the EU who conduct clinical trials in the EU In such cases, the EHDS Regulation could still apply to other EU based controllers (as defined in the GDPR), involved in that particular clinical trial. For It remains to be seen how these obligations will be managed within the context of sponsor contracts with such sites. Furthermore, non-EU-based health data users will not be able to submit application for data permits and benefit from the EHDS unless their country of establishment is recognised as providing reciprocal access to EU-based applicants.
One remaining question which the FAQs unfortunately do not address is whether all in-scope data of an EU-based health data holder is subject to disclosure. If an EU-based sponsor has sites in the EU and outside of the EU, are the data from both sites subject to EHDS Regulation? In the absence of guidance to the contrary, the broadly drafted wording of the EHDS Regulation would suggest the former approach.
Protecting Valuable Intellectual Property
Since the publication of the initial draft regulation in May 2022, one of the main concerns for the pharmaceutical and med-tech industries was how to balance their obligations to disclose data with the need to protect valuable intellectual property and trade secrets.
The compromise in the final text is a weaker version of similar protections provided for in the EU Data Act, which entered into force in January 2024. The HDAB has the right to be informed by a data holder of any data that contains intellectual property or trade secrets. The HDAB will take “all specific, appropriate and proportionate” measures to protect intellectual property and trade secrets. These measures can include non-disclosure contracts with health data users. If access to the data entails a serious risk of infringement of intellectual property rights or trade secrets that cannot be addressed satisfactorily, the HDAB must refuse access to such data.
However, whereas the EU Data Act empowers the data holder to determine if the proposed measures are satisfactory and, if not, to withhold the data, the EHDS Regulation puts this decision in the hands of the HDAB, with a mere right to object on the part of the health data holder. The EHDS Regulation also offers no mechanism to compensate the health data holder for use of its valuable data or resulting benefits to the health data user, such as a reasonable license fee.
Managing Patient Opt-Outs
Another important concession introduced in EU lawmakers’ trilogue negotiations is the opt-out mechanism. The initial text didn’t include an opt out mechanism. Although some stakeholders advocated a stricter “opt in” mechanism, the final compromise was to allow patients to opt The implementation of the opt-out is left up to the Member States, which could lead divergent approaches. The only criteria that is common is that the opt out mechanism must be easy to understand, accessible, and usable. Concerns also remain over how health data holders can manage this opt out and purge such data from all datasets they hold prior to disclosure to the HDAB, as well as the resulting impact on diversity and quality of the resulting dataset.
Cataloguing Datasets
One of the first steps in the data disclosure process is for each health data holder to provide a description of all in-scope datasets to the HDAB. The HDAB will catalogue and publish all datasets. This is not an easy task, given the vast amount of health data that falls under the EHDS Regulation. The EHDS Regulation does not specify a time limit for the initial disclosure, and the format and mechanisms will need to be outlined in guidelines or implementing regulations. The EHDS Regulation also requires health data holders to verify annually that the description of their datasets in the catalogue is accurate.
Fragmentation
One of the consequences of the extended trilogue negotiations has been to defer to EU Member States on several key topics, which will inevitably lead to fragmentation and divergent approaches throughout the EU. For example, in addition to implementing the opt-out mechanism, Member States can decide on localisation requirements for data, can impose stricter measures for genetic, biobank, and wellness data, and can specify additional categories of in-scope data.
Timeline and Next Steps
The EHDS Regulation will be implemented in several phases, given the breadth of preparatory work needed to set up the legal and technical infrastructure to operationalise the EHDS:
2025-2027:
Secondary legislation phase, focusing on drafting Implementing and Delegating Acts
2027-2029:
Member State preparation phase, involving the creation of data hubs and integration with EU-wide infrastructure
- 26 March 2029: Most secondary use provisions will apply
- 26 March 2031: Provisions related to clinical trial and human genetic data will apply
- However, this timeline remains uncertain and many commentators believe it will likely change given the complexity of the technical and organisational measures that need to be implemented, both at EU and Member State level.What Companies Can Do to Prepare for the EHDS?
- While many unknowns remain and details will need to be resolved through implementing regulations and guidance, companies should act now to prepare for the above deadlines.Companies holding health data should start mapping and cataloguing their datasets to understand what data will be subject to the EHDS Regulation, where such data is held, in what format, and any restrictions it is subject to. Companies should map their data to determine if any datasets are valuable intellectual property or trade secrets. Companies should also consider the technical capabilities they have and any additional measures or systems that will be required to scan and label the data, anonymise the data, and purge the As companies collect and obtain new datasets they will need to analyse, label, and anonymise them in preparation for possible disclosure. This exercise will require a wide range of stakeholders, including legal, privacy and intellectual property experts.
