European Biotech Act I: Navigating the EDPB/EDPS Vision for the Future of Clinical Trials

On 12 March 2026, the European Data Protection Board (“EDPB”) and the European Data Protection Supervisor (“EDPS”) issued a Joint Opinion (the “Joint Opinion”) on the proposed European Biotech Act I (the “Biotech Act”). The Joint Opinion broadly supports the EU’s ambition to strengthen its biotechnology sector. However, it emphasises that data protection safeguards must be tightened, particularly where health data is involved. The recommendations signal forthcoming scrutiny during the legislative process and highlight key compliance considerations for organisations involved in clinical trials.

Background

On 19 December 2025, the European Commission published its proposal for a Biotech

Act I (see our previous article here for a summary of the key provisions). Its objective is to foster innovation within the EU and incentivise the (re)location of manufacturing activities to Europe.

The proposed Biotech Act does not directly amend the EU General Data Protection Regulation (“GDPR”), which is currently under consideration for targeted amendments under the Digital Omnibus Proposal (see our previous article here). However, as currently worded, the proposed Biotech Act will have significant indirect effects on the processing of personal data in clinical trials.

Use of Artificial Intelligence (“AI”) in Clinical Trials

The proposed Biotech Act would introduce specific requirements where AI is used in clinical trials. Sponsors would be required to assess risks to patient safety and data integrity and describe the purpose and implementation of AI in the clinical trial protocol. In the Joint Opinion, the EDPB and EDPS emphasise that these obligations would apply in addition to those under the EU AI Act (where relevant), and any guidance developed by the European Medicines Agency should be prepared in consultation with the EDPB and EDPS to ensure consistency with the GDPR.

Additional Key Recommendations Identified in the Joint Opinion

The Joint Opinion supports the proposed Biotech Act’s general objective to harmonise personal data processing in clinical trials. However, it emphasises that this must not come at the expense of the high level of protection required for health data under the GDPR. The Joint Opinion provides several targeted recommendations, and we have summarised the key recommendations below.

1. Legal Basis for Processing: The proposed Biotech Act would clarify the legal bases available to sponsors and investigators when processing personal data in clinical trials. It frames such processing as a legal obligation (under Article 6(1)(c) GDPR) carried out in the public interest in accordance with appropriate safeguards (in support of Article 9(2)(i) and (j) GDPR). If adopted, the proposed Biotech Act could thus reduce the current divergence across Member States with respect to the lawful basis for processing personal data in clinical trials, where different legal bases are often used. The EDPB and EDPS support this approach but recommend (amongst other things): (a) explicitly limiting processing to what is necessary, and (b) introducing additional safeguards to protect the rights of trial participants.
2. Role of Clinical Trial Actors: The proposed Biotech Act would confirm that sponsors and investigators are controllers under the GDPR for clinical trial-related processing activities. This confirmation would help resolve existing inconsistencies across Member States, which currently impact the drafting of clinical trial agreements and informed consent forms. However, the Joint Opinion calls for further clarification in the proposed Biotech Act on (amongst other things): (a) whether sponsors and investigators act as independent or joint controllers, and (b) whether the controller should in fact be the trial site as opposed to the investigator.
3. Sharing of Data With Competent Authorities: Under the proposed Biotech Act, sponsors and investigators would be required to make personal data available to Member State competent authorities for inspection and other oversight purposes. The Joint Opinion recommends – in line with the data minimisation principle – that the proposed Biotech Act clarify that such data sharing must be limited to what is necessary (illustrated by examples) and, where sharing is necessary, that personal data be pseudonymised (unless directly identifiable data is required).
4. Retention Periods: The proposed Biotech Act provides that personal data shall be retained for at least 25 years. The EDPB and EDPS raise concerns that this provision lacks the legal certainty to mitigate the risk of excessive data retention. The Joint Opinion recommends that the provision be narrowed to apply only to personal data contained in the Clinical Trial Master File, i.e., not all personal data processed in the context of the clinical trial.
5. Further Processing and Scientific Research: The proposed Biotech Act would permit personal data collected in a clinical trial to be further processed by the same controller for “other clinical trials conducted under [the CTR], or for scientific research with the aim of protecting public health, improving standard of care, and fostering the innovation capacity of European medical research.” Whilst the EDPB and EDPS acknowledge the intention of the proposed Biotech Act to establish a legal basis for such processing, i.e., under Article 6(1)(e) GDPR, they recommend (amongst other things): (a) making this legal basis explicit in the text, (b) defining the processing purposes more precisely and restrictively, and (c) clearly setting out the safeguards that should apply to the processing.
6. Technical and Organisational Measures (“TOMs”): The proposed Biotech Act would require the implementation of TOMs to protect individuals’ privacy rights. However, the Joint Opinion recommends strengthening the proposed measures by: (a) requiring pseudonymisation by default where direct identification is not necessary, and (b) explicitly referencing additional safeguards, such as data integrity controls, confidentiality measures, and encryption.

Next Steps

The proposed Biotech Act is currently under review by the European Parliament and the Council of the European Union, with final adoption not expected before the third quarter of 2026. It remains to be seen the extent to which the EDPB and EDPS recommendations will influence the proposed Biotech Act, if at all.

Trainee solicitor Jennifer Petch also contributed to this blog post.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.