The EHDS Regulation sets new EU rules for how health data is accessed by patients and reused for research. Most of it applies in stages up to 2031. This guide explains the structure, the dates to watch and how to prepare your trial data now. Not legal advice.
Free sandbox · No credit card · 21 CFR Part 11 aligned
year
Regulation (EU) 2025/327
Phased for different obligations
Access bodies, HealthData@EU
Check exact date
The EHDS in one page
The basics
The European Health Data Space, or EHDS, is the EU framework for health data. It was adopted as Regulation (EU) 2025/327 and published in the Official Journal in March 2025. Its stated aims are to give individuals better control over their electronic health data across borders and to create a consistent, secure route for reusing health data for research, innovation, policy making and regulatory activity.
For a clinical researcher the practical question is not whether the law is interesting but where it touches your work. There are three touch points. First, if your study uses data from hospital or care records, the way those records are made available is changing. Second, if you want to run a study using a large pooled dataset, there will be a formal route to apply for it. Third, the data your own trial produces may eventually become something others can apply to reuse, which is why record quality and documentation matter now.
The EHDS sits on top of the General Data Protection Regulation, not instead of it. Our comparison of HIPAA and GDPR for clinical trial data covers the privacy basics, and GDPR-compliant clinical trial software covers what to look for in the system you use. This page is about the new layer.
The primary-use side concerns patient access to their own electronic health data and the exchange of core records, such as patient summaries and prescriptions, between providers in different member states. It also sets requirements for electronic health record systems. It is mainly a care-delivery matter. Researchers meet it indirectly: cleaner, more interoperable source records make source data verification and data transfer easier over time.
The secondary-use side is where research sits. Each member state designates one or more health data access bodies. A researcher or organisation that wants to use health data held by data holders submits an application to the access body, explains the purpose, and receives a data permit if the request is lawful and proportionate. The data is generally analysed inside a secure processing environment rather than downloaded. A cross-border infrastructure, HealthData@EU, is meant to connect national bodies so one request can cover several countries.
Timeline
These dates come from law-firm and industry summaries of the Regulation. They are consistent across the sources we checked, with one source giving 25 rather than 26 March 2031, so read the Official Journal text before you rely on any of them.
| Date | What happens | Why a trial team cares |
|---|---|---|
| 26 March 2025 | The Regulation enters into force. | Planning can start. Little is enforceable yet. |
| 26 March 2027 | Most provisions begin to apply, with different start dates for particular obligations. | Care systems start to change how records are exposed and exchanged. |
| 26 March 2029 | The secondary-use framework, including health data access bodies and HealthData@EU, is expected to be operational. | A formal route to apply for health data for research begins to exist. |
| March 2031 | Further categories, including data from clinical trials, clinical investigations and performance studies, enter the secondary-use regime. | Trial data you hold may become subject to access requests. Documentation and exports matter. |
Orientation only. Application dates are phased and can differ by obligation.
Whatever the EHDS finally asks of trial data, structured forms, a data dictionary and a full audit trail make reuse and review easier. Build your study in the free sandbox and see the exports.
Impact
Three things do not change. Your trial is still authorised under the EU Clinical Trials Regulation and run to good clinical practice. Participants still consent to take part, and your lawful basis and safeguards under GDPR still apply. And the sponsor is still accountable for the integrity of the data it collects.
Three things are worth planning for. The first is reuse: because clinical trial data is scheduled to come into the secondary-use regime later than other categories, you have time to prepare the practices that make a dataset safe to share, such as pseudonymisation, clear documentation and controlled access. See our guide to data pseudonymisation in EDC. The second is consent wording: participant information that explains future research use clearly is easier to defend than vague text, and our eConsent regulations guide helps with that. The third is archiving: how long you keep trial records, and in what format, interacts with any later request. See clinical trial data archiving and retention.
If you plan to use routine care data for real-world evidence, the secondary-use route will eventually be the formal way in for many sources. Our pages on EDC for real-world data studies and real-world evidence studies cover how to structure that work today.
Much of the detail will come through implementing acts, national designation of access bodies and guidance. Fees, application formats, the treatment of commercial purposes and the interaction with trial transparency rules are all areas to follow. This page will not guess; it points to the Regulation and to your national access body once it is named.
Checklist
None of these is a legal requirement because of the EHDS today. They are good practice that make later compliance cheaper.
Use coded fields, units and a data dictionary so a reviewer can interpret the dataset without you.
Keep a field-level audit trail showing who changed what, when and why, and be able to export it.
Separate direct identifiers from coded study data and limit who sees identifiers.
State plainly whether and how coded data may be reused for future research.
Record where data is stored. Capture can host in the EU (Frankfurt) or the USA (N. Virginia).
Export datasets with a data dictionary, and SDTM datasets with Define-XML where your analysis plan needs them.
In Capture
Capture records every data change in a field-level audit trail with timestamp, user, old value, new value and reason for change. Role-based access separates identifiable participant details, which site coordinators see, from the coded IDs researchers see. Exports come with an automatic data dictionary, and SDTM datasets can be exported as SAS XPT with Define-XML.
Site coordinator
Jane Peterson
DOB: 04-Mar-1978
Subject 01-004
Sees direct identifiersResearcher
Subject 01-004
DOB: withheld
Coded ID only
Sees coded ID onlySame record, two roles. Row-level security enforces the split.
Read next
How trials are authorised and run in the EU.
Read more PrivacyTwo privacy regimes compared.
Read more TemplateAssess risk before you collect data.
Read more EUThe other major EU digital rule to watch.
Read moreIt is the EU framework created by Regulation (EU) 2025/327 to give individuals more control over their electronic health data and to create a common route for reusing health data for research, innovation, policy and regulation.
Reporting on the Regulation indicates most provisions apply from 26 March 2027, the secondary-use framework from 26 March 2029, and data from clinical trials enters the secondary-use regime in March 2031. Check the Official Journal for the exact dates.
A national body each member state designates to receive applications for secondary use of health data, decide whether they are lawful and issue data permits. Analysis generally takes place in a secure processing environment.
No. GDPR still applies to personal data, and the Clinical Trials Regulation still governs authorisation and conduct of trials. The EHDS adds a framework for access to and reuse of health data.
Not today on the dates reported. Clinical trial data is scheduled to enter the secondary-use regime later, so use the time to document and structure your data. Confirm your obligations as implementing rules appear.
No such certification exists to claim, and we do not claim it. Capture provides an audit trail, role-based access, data dictionary exports and EU hosting that support good data practice. Your obligations depend on how you run your study.
Under the EHDS secondary use is permit-based through access bodies. Consent in your own trial remains governed by the Clinical Trials Regulation and GDPR. Ask your data protection officer how the two interact for your design.
No. It is a plain-language orientation. Read the Regulation and consult your legal and data protection advisers before acting.
Keep exploring
EU Clinical Trials Regulation
Trial authorisation in the EU.
HIPAA vs GDPR for trial data
Privacy regimes compared.
GDPR-compliant clinical trial software
What to check in an EDC.
Data pseudonymisation in EDC
Separating identifiers.
Security overview
How Capture protects data.
EDC for researchers
Study build and data capture.
Free sandbox with every feature. No credit card, and you pay only when you go live with real participants.