The EHDS in clinical research: what changes for CROs and sponsors (and how to prepare)

The European Health Data Space (EHDS) will transform the way health data are identified, requested, and used in clinical research, pharmacovigilance, health technology assessment, and regulatory activities.

For organizations dedicated to clinical research, this change opens a regulated and transparent channel for accessing electronic health data for scientific purposes, but it also introduces new compliance, quality, and data protection obligations.

From “hard-to-obtain data” to a regulated access process

The EHDS establishes a uniform procedure: data users (e.g., a CRO, a sponsor, or an academic group) submit an access request to the national health data access body (HDAB); if the case falls within the permitted purposes (scientific research, innovation, algorithm training, public health, or regulatory activities), the HDAB issues a permit and enables access in a secure environment. By default, access will be to anonymized data; if the objective cannot be achieved with anonymized data, pseudonymized data may be authorized, with additional controls and an appropriate legal basis under the GDPR.

For clinical trial managers, this means:

Traceability and data governance from origin (hospital/registry) to analysis.

More visible data catalogues and documented quality criteria.

Safeguards for IP and trade secrets, relevant when the data holder is a company.

Citizen opt-out for secondary use, which must be considered in methodological design.

Does it include clinical trial data?

The scope of the EHDS covers electronic health data from a wide range of sources (EHRs, registries, devices, interoperable apps, genetic data, etc.). Regarding clinical trials, the recitals of the final text indicate coverage for data from trials that have concluded, with nuances regarding the timing of first publication of results and potential national limitations (e.g., genomics or biobanks). This will require careful reading of implementing acts and national guidance to understand what will be accessible, when, and how.

Key timelines affecting research

Publication in the OJEU (05/03/2025) and entry into force (26/03/2025): start of the transitional period.

2025–2027: development of implementing and delegated acts (e.g., anonymization/pseudonymization specifications, data formats, security, quality KPIs, permit processes). Your Regulatory/Legal team will need to closely follow these technical rules.

From 2029: most secondary-use obligations for core data categories will apply; this is the critical point for having internal access, analysis, and reporting processes ready.

2031: obligations for advanced categories (e.g., genomics) and the second wave of primary-use data (imaging, discharge summaries, lab results) will take effect, useful for observational and real-world evidence studies.

Practical impact on the study lifecycle

Feasibility and design
With more accessible catalogues, it will be possible to assess the availability and quality of key variables (diagnoses, medication, laboratory results, PROs if integrated) before finalizing the protocol. This reduces uncertainty and improves expected statistical power. Attention is needed to national restrictions on sensitive categories (e.g., genomics), which may influence dataset eligibility.

Contracting and agreements
The EHDS incorporates cost-compensation mechanisms for data holders and protection of trade secrets. Contracts will need to align with HDAB permits and the secure environment architecture: analysis will take place in situ without extracting personal data; only anonymized datasets may be downloaded.

Operations and compliance
The access authority (HDAB) will audit whether use is proportionate and in line with the permit. Technical controls must be implemented (security, logging, project segregation), together with opt-out management and anonymization/pseudonymization plans following the criteria the Commission will publish.

Regulation and transparency
The EHDS promotes transparency: citizens will be able to see who accessed data and for what purpose. This requires access logs and clear ethical communication, also useful for patients and committees in advanced therapies.