What actually counts as 'scientific research'? Here's the EDPB's six-point answer

On 15 April 2026, the European Data Protection Board adopted Guidelines 1/2026 on the processing of personal data for scientific research purposes. The 66-page document is now out for public consultation.

In this episode, Robert Bateman breaks down what the guidelines mean for pharma companies, AI developers, universities, and anyone relying on the GDPR's scientific research provisions.

The GDPR gives scientific research significant special treatment — a presumption of compatibility for further processing, extended storage, broad consent, carve-outs from the right to erasure, and a narrower right to object. But to access those provisions, you first need to qualify as "scientific research" in the first place.

In this episode:

• The EDPB's six-factor test for determining whether processing qualifies as scientific research
• Why a for-profit AI start-up can qualify — but retail analytics can't
• What "broad consent" actually means, and how it differs from "dynamic consent"
• The high threshold for the "manifestly made public" exception after Schrems (October 2024)
• When "covert research" is permitted under Article 14(5)(b)
• How the guidelines sit alongside the Digital Omnibus and the European Biotech Act

Useful references:

• EDPB Guidelines 1/2026 (public consultation draft)
• CJEU Case C-446/21 — Schrems v Meta Platforms Ireland (4 October 2024)
• Articles 5(1)(b), 9(2)(e), 14(5)(b), 17(3)(d), 21(6), and 89 GDPR

Consultation: open now on the EDPB website.

Host: Robert Bateman, Senior Partner at Privacy Partnership

Get in touch if your organisation needs support with GDPR compliance for research activities.