Legal basis for research under GDPR: consent, public task and Article 89 safeguards

Choosing the legal basis is the first data protection decision in any research project, and the one most often confused with research ethics. This guide explains how GDPR consent differs from ethical informed consent, when universities use public task (Article 6(1)(e)), how Article 9(2)(j) and Article 89 work for special category data, how national laws in eight European countries fill the gaps, and what this means for secondary use, social media data, recordings and AI tools. It ends with a decision table and a checklist.

Published 9 October 2026 · Sources checked 9 October 2026

Also available in: Svenska · Nederlands · Norsk · Suomi · Dansk · Français · Español · Português

1. Why does the legal basis matter so much in research?

The legal basis decides which rights participants have, what happens when someone withdraws, whether data can be reused in later projects, and what the privacy notice must say. It must be chosen before processing starts and cannot simply be swapped later. In research, the choice is complicated by ethics rules that also use the word "consent" for something different.

Article 6(1) GDPR lists six legal bases; four matter for research: consent (a), legal obligation (c), public task (e) and legitimate interests (f). Special category data also needs an Article 9(2) condition. Both choices sit inside the GDPR's research rules: Article 5(1)(b) on further processing, Article 5(1)(e) on storage and Article 89 on safeguards and derogations.

Recital 159 says scientific research "should be interpreted in a broad manner". The EDPB is more careful. In its consent guidelines it says the notion "may not be stretched beyond its common meaning" and refers to research set up under sector-related methodological and ethical standards (Guidelines 05/2020, para. 153). The 2026 draft research guidelines add six indicative factors, starting with a "methodical and systematic approach" and "adherence to ethical standards".

2. What is the difference between GDPR consent and ethical informed consent?

Ethical informed consent protects a person's dignity and integrity: nobody should be included in research without knowing and agreeing. GDPR consent is one of six legal grounds for processing personal data, with strict conditions: freely given, specific, informed, unambiguous and withdrawable. A study can require the first without relying on the second as its legal basis.

The European bodies have been consistent on this point:

• EDPB Opinion 3/2019 on clinical trials: informed consent under the Clinical Trials Regulation "must not be confused with the notion of consent as a legal ground" under the GDPR (para. 15). A clear imbalance of power means consent is not freely given.
• EDPB Guidelines 05/2020 on consent: consent for the use of personal data "should be distinguished from other consent requirements that serve as an ethical standard or procedural obligation" (para. 154). Ethical consent "could be considered as an additional safeguard".
• EDPB response to the Commission on health research (2 February 2021): informed consent for participation "can and must be distinguished from explicit consent" as a basis for processing (para. 5).
• EDPS Preliminary Opinion on scientific research (2020): GDPR consent "differs conceptually and operationally from 'informed consent' of human participants in research" (executive summary).
• EDPB draft Guidelines 1/2026: ethical consent "is not required by the GDPR, but may be considered as an additional safeguard according to Article 89 GDPR" (para. 53). If both are asked at the same time, the GDPR request must be clearly distinguishable (para. 55).

National authorities say the same. The French CNIL advises that, where GDPR consent is used, the form should have two separate boxes, "l'une pour recueillir le consentement RGPD, l'autre pour participer à la recherche" (one for GDPR consent, the other for participation), and notes that research based on public interest may still need participants' agreement to take part (CNIL). The UK Health Research Authority puts it in one sentence: "Consent to participation in research is not the same as consent as the legal basis for processing under data protection legislation" (HRA).

One source leans the other way. The Commission's "Ethics and data protection" note for Horizon Europe (5 July 2021) asks for a consent procedure that meets GDPR standards when data is collected directly. It was written by an expert panel and says it "does not constitute official EU guidance" (Commission).

Validemic's analysis Ethics committees and DPOs often talk past each other because both say "consent". A simple fix is to use different words in templates: "agreement to take part" for the ethical requirement, and "consent to data processing" only where Article 6(1)(a) is really the basis.

3. Which Article 6 legal bases can research use?

Research can rely on consent, public task, legitimate interests and, for narrow parts, legal obligation. The choice depends mainly on who the controller is. In the guidance we read, public universities mostly use public task; private bodies without a research mandate in law use legitimate interests or consent.

The draft 1/2026 guidelines also note that public task "is not limited to public entities": private bodies can use it "if the legal act covers their activities" (para. 58). Whether a given university is a "public authority" also depends on national law, which matters for private universities in some countries.

4. How does national law support public task research? Eight country examples

Article 6(3) requires the public task to be laid down in Union or member state law. That law does not need to describe each project. The EDPB draft says it may authorise research "without necessarily specifying how the research is to be undertaken" (para. 57). In practice universities point to their higher education act, and several countries have research provisions in their GDPR implementing laws. The table summarises the provisions we read on 9 October 2026.

Two neighbours outside the table: in Ireland, Trinity College Dublin tells researchers that "explicit consent is required for any health research in Ireland", reflecting national health research rules. In the United Kingdom, the UK GDPR has the same structure, and the HRA says public authorities carrying out research "will use 'task in the public interest' as their legal basis".

These summaries are selective. National laws have further conditions and sector rules (health, registers, biobanks), and some change often: Finland's act was amended in May 2026 (380/2026). Read the full provision and ask your DPO before relying on it.

5. What legal basis do European universities actually use?

Most university guidance we read makes public task the default for research and keeps consent as the ethical requirement. Details differ by country, mainly for special category data. In their own words:

Edinburgh's participant privacy notice also makes the split visible to participants: consent to use personal information "(which we rarely request) is separate from your ethical consent to participate" (Edinburgh).

Validemic's analysis The pattern is clear in the Nordics, Belgium, Ireland and the UK. The Netherlands is the main exception for special category data, because UAVG article 24 makes explicit consent the starting point. Spanish and Danish universities often list both bases and let the project decide. What all of them share is the instruction to decide per project and to tell participants.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

6. Which Article 9 condition applies to special category data in research?

Special category data needs an Article 9(2) condition in addition to the Article 6 basis. For research, the realistic options are explicit consent (9(2)(a)), the research condition (9(2)(j)), data manifestly made public by the person (9(2)(e)), and substantial public interest or public health conditions (9(2)(g) and (i)) where national or EU law provides them.

Article 9(2)(j) covers processing "necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law". That law must be proportionate, respect the essence of data protection and "provide for suitable and specific measures". The EDPB draft adds that controllers should be able to show that the law applies to their processing and that they meet its conditions (para. 74). It lists, among others, Danish s. 10, Finnish s. 6(1)(7), French art. 44(6), German BDSG s. 27(1) and the Swedish ethical review act as examples, while noting that "The EDPB has not reviewed nor analysed the laws referred to".

Article 9(4) allows member states to add conditions for genetic, biometric and health data, so a multi-country study may need explicit consent in one country and none in another. For clinical trials, EDPB Opinion 3/2019 names public task with Article 9(2)(i) or (j), or legitimate interests with Article 9(2)(j), as alternatives to consent.

7. What safeguards does Article 89(1) require?

Article 89(1) requires appropriate safeguards for research processing, with technical and organisational measures "in particular in order to ensure respect for the principle of data minimisation". It names pseudonymisation as one possible measure. Where research can be done with data that no longer identifies people, "those purposes shall be fulfilled in that manner".

The EDPB consent guidelines say "Anonymisation is the preferred solution as soon as the purpose of the research can be achieved without the processing of personal data" (para. 160). The 2026 draft adds a list of further safeguards: independent or ethical oversight, secure processing environments, privacy-enhancing technologies, protective measures for publication and conditions for further use. The 2021 EDPB response also links the two: the presumption of compatibility for further research "can only be used" if Article 89(1) safeguards are respected (para. 20).

In practice, the safeguards that DPOs and ethics committees look for are:

1. A data management plan that justifies each data item.
2. Pseudonymisation at the earliest practical point, with the key held separately and access limited.
3. Anonymisation for sharing and publication where possible.
4. Secure storage on approved university services; see our guide on research data in cloud storage.
5. An Article 28 agreement with every vendor and, outside the EEA, a transfer tool. Our data sharing agreement and joint controller agreement guides cover partners.
6. A DPIA where the risk is high (Norway's DPA requires one for non-consent-based research on special category data, according to the University of Bergen). Our DPIA screening tool and DPIA template help.
7. Retention rules that state how long identifiable data is kept; see our retention schedule guide.

8. Which data subject rights can be limited for research?

The GDPR itself limits some rights for research, and Article 89(2) lets EU or national law add derogations from the rights of access, rectification, restriction and objection (Arts. 15, 16, 18 and 21), but only where the rights would "render impossible or seriously impair" the research and the derogation is necessary.

• Erasure: Article 17(3)(d) excludes the right to erasure where it would make research impossible or seriously impair it, with Article 89(1) safeguards.
• Objection: Article 21(6) gives a right to object to research processing, "unless the processing is necessary for the performance of a task carried out for reasons of public interest".
• Information: where data is not collected from the person, Article 14(5)(b) allows an exception for impossible or disproportionate effort, but the controller must protect their interests, "including making the information publicly available". Aarhus University, for example, publishes a list of research projects that use this exemption. There is no equivalent exception in Article 13 for data collected directly.
• National derogations: see the country table in section 4.
• Consent withdrawal: none of these exceptions applies. If consent is withdrawn, the EDPB says the controller "must in principle delete the personal data straight away" if it wants to continue the research (05/2020, para. 163).

Our guide to data subject access requests at universities covers how to handle requests in practice.

9. Can research data be reused? Further processing and secondary use

Yes, often. Article 5(1)(b) says further processing for scientific research "shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes". Recital 50 says such processing "should be considered to be compatible lawful processing operations". But compatibility is not the whole answer: the controller still needs a lawful basis and, for special category data, an Article 9 condition.

The EDPB draft 1/2026 says the Article 6(4) compatibility test is not needed for further research (para. 19), but the lawfulness check remains, and relying on the original basis is not always possible, in particular if it was consent (paras. 21 and 22). The 2021 EDPB response adds that a hospital relying on Article 9(2)(h) for treatment may need a different Article 9 condition to use the records for research.

Common secondary use situations at universities:

• Reusing your own earlier project data. Check what participants were told and whether the original basis, especially consent, covers the new use. Trinity College Dublin tells researchers that secondary use is presumed compatible "if the research is in the public interest", with Article 89(1) safeguards.
• Using another researcher's or archive's dataset. You become a new controller or a joint controller. You need your own basis, a data sharing agreement, and usually Article 14 information.
• Registry and administrative data. National register laws and permit authorities often set the terms. Denmark requires Datatilsynet's permission for some disclosures (s. 10(3)).
• Student and staff data from university systems. Research on the university's own students needs care with power imbalance; see our learning analytics guide.

From 2029, the European Health Data Space Regulation (EU) 2025/327 will add a separate route for secondary use of electronic health data through health data access bodies. Its Chapter IV on secondary use applies from 26 March 2029 (EHDS Regulation).

10. Is broad consent allowed under the GDPR?

Yes, within limits. Recital 33 says people "should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards". The EDPB reads this narrowly: it "does not disapply the obligations with regard to the requirement of specific consent", and the GDPR "cannot be interpreted to allow for a controller to navigate around the key principle of specifying purposes" (05/2020, paras. 156 and 158). For special category data the flexibility gets "a high degree of scrutiny" (para. 157).

The 2026 draft describes two models. Broad consent covers future projects within a defined area of research, and "it is not sufficient to only state that personal data will be used for scientific research purposes" (para. 44). Dynamic consent asks people again as each project becomes known, which the EDPB calls "often the appropriate way" in long-term studies with regular contact (para. 52). Safeguards it suggests for broad consent include an independent data trustee, time-limited consent and independent oversight (paras. 48 and 49).

Spain (for health research) and Portugal have written broad consent into national law. Validemic's analysis Where national law allows it, combining agreement to take part with public task as the GDPR basis avoids the withdrawal and specificity problems of broad consent.

11. Social media data, recordings, transcripts and AI tools

Data from social media

Public posts are still personal data. A university needs a legal basis (usually public task for a public university), and special category content in posts is only covered by Article 9(2)(e) if the person "manifestly made public" the data. The EDPB draft says controllers should check that content was posted "following an active choice by the data subject" and look at the platform settings (para. 70). A photo posted by a friend does not count (para. 71). Its worked example pseudonymises the collected posts and informs users under Article 14.

The Commission's ethics note adds that "It is not enough that the data be accessible" and asks researchers to check the platform's terms. Sikt names internet studies as a typical case for public interest.

Interview recordings and transcripts

A voice or video recording identifies the speaker, and interview content often includes special category data (health, religion, political views) about the participant or third parties. The legal basis is the same as for the study, but the Commission's ethics note asks for a specific consent process for "intrusive methods such as behavioural profiling, audio/video recording or geo-location tracking". Sikt notes that consent can be documented "on a sound recording".

Validemic's analysis Practical points:

• Delete or pseudonymise recordings once the transcript is checked, unless there is a documented reason to keep them.
• Remove names and identifying details of third parties from transcripts.
• Treat any transcription service as a processor that needs a DPA and transfer review. Compare Otter.ai, Amberscript, Trint and the option of local transcription with Whisper.
• Use approved tools for qualitative analysis; see our fact sheets for NVivo and ATLAS.ti.

AI tools in research

Uploading interview data to a generative AI tool is processing. It needs the study's legal basis, must fit what participants were told, and the provider becomes a processor (or a controller, if it uses the data for its own purposes). Check training use, processing location and whether the institutional plan has a DPA. Our guide on GDPR and AI tools in research covers this in detail, and AI tools approved at European universities shows what other institutions allow.

12. What should the privacy notice say about the legal basis?

Articles 13(1)(c) and 14(1)(c) require the notice to state the purposes and the legal basis. For research that means naming the Article 6 basis, the Article 9 condition for special category data, and the national law it rests on. Trinity College Dublin's instruction is short: inform participants of the legal basis "In advance of any data collection".

• State the basis plainly, for example: "We process your data because research is a task in the public interest (GDPR Article 6(1)(e), based on [national higher education law]). Your agreement to take part is an ethical requirement and is not the legal basis."
• If consent is the basis, explain how to withdraw and what happens to data already collected.
• If public task is the basis, explain the right to object and its research limits.
• Mention any national derogations from rights that you rely on.
• If data may be reused for later research, say so and describe the safeguards.

Our research participant privacy notice guide has a free Word template with this wording, and a Finnish version is available as tietosuojaseloste-malli.

13. Decision table: which legal basis for which situation?

Validemic's analysis The table shows typical choices at a public university in the EU/EEA. It is a starting point for a conversation with the DPO, not a rule. National law and the specific project can change the answer.

14. What is changing? Pending EU and national developments

• EDPB Guidelines 1/2026 on scientific research. Adopted on 15 April 2026 for public consultation, which ran until 25 June 2026 (consultation page, news release). On 9 October 2026 we found no final version on the EDPB website, and the 17 September 2026 plenary agenda did not include it. The draft may change.
• Digital Omnibus proposal. The Commission's proposal of 19 November 2025 would add a definition of scientific research to the GDPR and rewrite Article 5(1)(b). The European Parliament's file shows it awaiting committee decision (procedure 2025/0360(COD)). It is not law.
• European Health Data Space. Regulation (EU) 2025/327 applies from 26 March 2027, with the secondary use chapter from 26 March 2029.
• Sweden. An amendment to the Ethical Review Act (SFS 2026:1229), shown on riksdagen.se as entering into force on 1 July 2027, adds a section 6 a that lets some research on sensitive data proceed without ethical review, for example with the consent of an adult participant.

15. Checklist: choosing and documenting the legal basis

For the wider picture of GDPR across teaching, research and administration, see our GDPR in higher education guide and the GDPR explained page.

Sources

All sources retrieved 9 October 2026.

1. Regulation (EU) 2016/679 (GDPR), Official Journal text, Articles 5, 6, 9, 13, 14, 17, 21 and 89 and Recitals 33, 50, 156, 157 and 159 (read via the EU Publications Office).
2. European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1, section 7.2, paras. 153 to 165.
3. European Data Protection Board, Guidelines 1/2026 on processing of personal data for scientific research purposes, adopted 15 April 2026, version for public consultation, and the consultation page.
4. European Data Protection Board, Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research, 2 February 2021.
5. European Data Protection Board, Opinion 3/2019 on the interplay between the Clinical Trials Regulation and the GDPR, 23 January 2019.
6. European Data Protection Board, News list (checked for final adoption of Guidelines 1/2026) and plenary agenda of 17 September 2026.
7. European Data Protection Supervisor, A Preliminary Opinion on data protection and scientific research, 6 January 2020.
8. European Commission (expert panel), Ethics and data protection, 5 July 2021.
9. European Parliament Legislative Observatory, Procedure 2025/0360(COD), Digital Omnibus.
10. Regulation (EU) 2025/327 on the European Health Data Space, final provisions on application dates.
11. Sweden: Högskolelag (1992:1434), Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning and Lag (2003:460) om etikprövning av forskning som avser människor, riksdagen.se.
12. Norway: Personopplysningsloven (LOV-2018-06-15-38), sections 8 to 10, lovdata.no.
13. Finland: Tietosuojalaki (1050/2018), consolidated version including amendment 380/2026, finlex.fi.
14. Denmark: Databeskyttelsesloven, LBK nr. 289 af 08/03/2024, retsinformation.dk.
15. Netherlands: Uitvoeringswet Algemene verordening gegevensbescherming, articles 24 and 44, wetten.overheid.nl.
16. France: CNIL, Recherche scientifique (hors santé) : quelle base légale pour un traitement de recherche ? (6 January 2022) and Traitements de données à des fins de recherche scientifique (hors santé) : quand saisir la CNIL ? (4 February 2026).
17. Spain: Ley Orgánica 3/2018 (LOPDGDD), disposición adicional decimoséptima, boe.es.
18. Portugal: Lei n.º 58/2019, de 8 de agosto, article 31, consolidated text on pgdlisboa.pt.
19. UK Health Research Authority, Legal basis for processing data.
20. Sikt, Legal bases for personal data processing in research.
21. University of Bergen, General principles for processing personal data in research.
22. Stockholm University, Personuppgiftsbehandling vid Stockholms universitet.
23. Lund University, Template B: information on processing of personal data in research (Word, April 2026).
24. University of Helsinki, RDM Advanced webinar series FAQ and Emplacing Heritage data protection notice.
25. Aarhus University, Personal data in research at Aarhus University when we are the data controller and Research projects exempt from the duty to inform.
26. Utrecht University, Faculty of Social and Behavioural Sciences, Dealing with Consent in Scientific Research, 3 February 2025.
27. KU Leuven / UZ Leuven, Onderzoek met minderjarigen: enkele cases.
28. Trinity College Dublin, Legal Basis for Research.
29. University of Edinburgh, Research and Data Protection Legislation (guidance for researchers) and Privacy notice for research participants.
30. University of Essex, Data Protection and research activity.
31. Universidad de Granada, Secretaría General, Producción investigadora (record of processing activity).

About this page

Sources checked on 9 October 2026. We read the GDPR in the Official Journal version, the EDPB, EDPS and Commission documents listed above, the national laws on their official or consolidated publication sites, and each university page we quote. Quotations are short and copied from the pages as published on the check date. Where we give our own interpretation, it is labelled as Validemic's analysis. The EDPB research guidelines are a consultation draft and the Digital Omnibus is a proposal; we will update this page when either changes. This page is general information, not legal advice. National law, sector rules and your institution's own policies may add requirements, so confirm the legal basis for each project with your data protection officer. If you spot an error or an outdated point, please contact us and we will correct it.