Brussels, 12 March 2026 – The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a Joint Opinion on the European Commission’s Proposal for a European Biotech Act. The Proposal aims to strengthen Europe’s biotechnology and biomanufacturing sectors, particularly in the area of health, by streamlining the regulatory framework and updating the rules for clinical trials.
The EDPB and the EDPS support the Proposal’s objective of fostering the EU’s competitiveness and addressing existing fragmentation in the application of the Clinical Trials Regulation (CTR). In particular, they welcome the aim to establish a single legal basis for the processing of personal data by sponsors and investigators, which will significantly improve legal clarity across Europe.
At the same time, the EDPB and the EDPS underline that the sensitivity of health and genetic data processed in the context of clinical trials requires a high standard of protection. The Joint Opinion provides several recommendations to ensure that the proposed simplifications do not lower the level of protection for clinical trial participants.
Key recommendations include:
- Clarifying controller roles: The Proposal should specify whether the actors involved in funding and conducting clinical trials act as sole or joint data controllers, to ensure a clear allocation of responsibilities.
- Limiting data retention: The mandatory 25-year minimum retention period should expressly apply only to the clinical trial master file, rather than to all personal data processed during a trial.
- Further processing for other clinical trials or for scientific research: As the Proposal aims to provide a legal basis under Union law for the further processing of trial data by the same controller, the Biotech Act should clearly define the purposes, as well as specific safeguards for such processing.
- Coherence with the AI Act: While promoting the use of AI in biotechnology, the Biotech Act should ensure that obligations for sponsors complement the existing requirements under the AI Act to ensure a consistent regulatory environment.
- Appropriate technical and organisational measures: The CTR should explicitly require the use of pseudonymisation whenever it is not necessary to process directly identifiable personal data.
- Regulatory sandboxes: If needed, the Commission's implementing acts regarding sandboxes in the specific context of clinical trials should provide for the legal basis for the processing of personal data, as well as for the derogation under Art. 9(2) for the processing of sensitive data; regarding other sandboxes, the processing of personal data should always be based on a legal basis under the GDPR.
“Europe’s ambition to lead in medical innovation must go hand in hand with trust. Our opinion makes recommendations to the co-legislators aiming to ensure that the pursuit of new treatments respects the fundamental rights of individuals. This will help build a framework that protects clinical trial participants and will ensure further legal certainty for researchers.”
EDPB Chair, Anu Talus
“A competitive biotechnology sector in Europe requires a predictable and harmonised legal environment. We welcome the Proposal’s move towards a single legal basis for clinical trials, which will facilitate GDPR compliance and strengthen consistency across the Union. However, this harmonisation must be accompanied by strong safeguards, including a clear definition of the roles and responsibilities of all actors involved to ensure trust and accountability in scientific research.”
European Data Protection Supervisor, Wojciech Wiewiórowski