Which route to the data will you take?

The draft, based on Article 70 of the EHDS Regulation, introduces three templates:

  • Annex I – Health data access application (Article 67): for access to anonymised or pseudonymised data in a secure processing environment. The same form is used to request an amendment to an existing permit.
  • Annex II – Data permit (Article 68): issued by the health data access body. It defines the users, data, purpose, duration and conditions of access.
  • Annex III – Health data request (Article 69): gives only an anonymised statistical response, with no access to the underlying data.

Why should a device manufacturer read a data access form?

Among the purposes listed in the templates, point (e) explicitly covers the training, testing and evaluation of algorithms, including in medical devices, in vitro diagnostic devices and AI systems. Point (a) covers activities that ensure the quality and safety of medical devices.

For R&D and clinical teams, this creates a regulated source of real-world data that could support clinical evaluation, performance evaluation or algorithm validation. The application must describe the planned development activities in detail, including any iterative steps. This matters because the permit authorises only what it states, and its scope may be narrower than the request.

An access application is published soon after it is received. Trade secrets, intellectual property, regulatory data protection or security-sensitive details can be flagged under point 7.2, but the health data access body decides what is withheld.

The permit conditions are strict:

  • A permit lasts no longer than 10 years, and an extension may add no more than 10 years.
  • Data is deleted from the secure processing environment within six months of expiry.
  • An output can leave that environment only after review confirms it contains non-personal data.
  • The health data user must publish anonymous results within 18 months of completing the processing.

A manufacturer will therefore need to plan its confidentiality strategy before submitting the application, not after receiving the permit.

What can you prepare before 2029?

  1. Check whether an anonymised statistical response under Annex III would meet your needs.
  2. If you need pseudonymised data, prepare a justification for why anonymised data would not be enough (point 5.2).
  3. Identify your GDPR legal basis and, where relevant, document the legitimate interest test and DPIA.
  4. Check national requirements for an ethics assessment.
  5. Decide which development information is a trade secret before it goes into a public form.
  6. Identify any funder or partner that influences the data use (point 2.15).

The document remains a draft. The European Data Protection Supervisor’s opinion has not yet been delivered, and the wording may change. The level of detail the Commission expects is already clear, however, and teams that align their data governance early will avoid a rushed first application.