European Health Data Space Regulation Adopted: What's Next for Life Sciences Companies?

On January 21, 2025, the European Health Data Space Regulation (EHDS) was formally adopted by the Council of the European Union. This marks the near-final step in the adoption process, and will enter into force in the coming weeks. Importantly for life sciences companies (pharma, biotech, and medtech), the EHDS’ so-called secondary use provisions will become applicable in 2029, leaving companies four years to consider, adapt to, and implement these wide-ranging requirements.

The EHDS forms a part of the broader EU Data Strategy to (among other things) make European health data (EHD) more widely available for purposes of research, policymaking, innovation, and the public interest. EHD is defined broadly and includes, among others, clinical trial data, human genetic and “-omic” data, claims and reimbursement data, and automatically generated personal EHD from medical devices.

The EHDS has two primary goals: (1) improving individuals’ access to their EHD (primary use) and (2) enabling the sharing of EHD for secondary use purposes, which includes research.

The EHDS’ secondary use rules are potentially of significant relevance to life sciences companies and will represent both opportunities as well as challenges and risks.

What life sciences companies will the secondary use provisions apply to?

In short, all pharma, biotech, medtech, and other companies handling EHD may fall within the scope of the EHDS’ secondary use provisions. Any company in the EU that holds EHD and receives such a request and has either (i) the right or obligation as a controller to process the EHD or (ii) the ability to make available nonpersonal EHD through the control of the technical design of a product and related services will become a health data holder under the EHDS; this may for example include sponsors of clinical trials. Persons who request and receive access to EHD under the EHDS pursuant to a data permit will be called health data users, and this, again, can include any life sciences company.

Why are the secondary use provisions relevant to life sciences companies?

The EHDS introduces mandatory obligations for sharing of EHD for secondary use purposes such as research. Research purposes must benefit end users (for example, patients) and can include the use of EHD for training and testing of algorithms in medical devices, high-risk AI systems or digital health applications, or research and development of new products.

Health data holders must share certain EHD with health data users. Such EHD may be protected by intellectual property or constitute trade secrets, and although certain limited exemptions for the protection of sensitive/protected information exist, successful reliance on such exemptions will ultimately be determined by health data access bodies, who are the authorities designated for granting data permits subject to a request.

All data sharing must take place via a prescribed technical infrastructure, and health data holders must ensure interoperability of the systems, subject to standards to be published in the future.

Timelines

While the broader EHDS obligations will become gradually applicable, most of the secondary use provisions will apply from 2029, with those relating specifically to clinical trial and human genetic data applying from 2031.

A number of implementing acts and delegated legislation are expected to be enacted with respect of technical specifications and operational frameworks within the EHDS. In addition, the European Commission is expected to roll out a comprehensive set of trainings to health data access bodies and other stakeholders.

Strategic considerations and preparedness

The secondary use provisions open a number of opportunities for life sciences companies but also present a number of significant challenges. To benefit from the opportunities and meet the deadlines for compliance, life sciences companies should assemble the appropriate internal (and external) teams now.

Actions to consider include the following:

• Identify — Conduct a data mapping exercise to identify all in-scope EHD (such as clinical trial data, reimbursement data, data from registries, and third-party training data) — including where this EHD are hosted.
• Prepare — Set up teams, systems, and policies to handle requests for EHD and organize EHD in a way that meets the requirements for sharing. Plan your clinical trials to enable data sharing under the EHDS.
• Ensure interoperability — Build or upgrade technical infrastructure to store and manage EHD according to the EHDS standards and platforms for data interoperability and sharing.
• Check contracts — Check and (where necessary) update your contracts with third parties that involve the handling of EHD to ensure (among other things) that they comply with the EHDS technical rules and standards, when they become available.
• Protect — Develop a strategy to identify and protect sensitive and confidential EHD, and prepare to justify redactions of any requests for access to commercially confidential or patent-protected EHD that may harm your business’ interests.
• Explore — Look for opportunities to access and use EHD (as a health data user) that may, for instance, give you a commercial and/or strategic advantage.
• Monitor — Keep track of the EHDS developments and be ready to adapt to the technical specifications as these are published.

A multidisciplinary and nuanced approach will help to ensure that companies are placed in the best position to harvest valuable data, comply with complex requirements, and protect their sensitive datasets over the years to come. Sidley’s experts in Global Life Sciences are uniquely positioned to advise on the EHDS.