European Biotech Act: understanding the latest regulatory developments

The opinion supports the overall goals of the proposal but calls for stronger safeguards in areas involving sensitive personal data and growing technological complexity.

A focus on special‑category data and legal bases

The authorities note that biotechnology activities frequently involve health and genetic data, triggering heightened obligations under the GDPR. They approve the call for greater clarity on the legal bases available for processing this data, including tighter conditions for consent, stronger transparency requirements and firmer purpose‑limitation principles. They also highlight the risks associated with large‑scale datasets used for research, including secondary use and data repurposing, and emphasise the need for appropriate safeguards where these activities are contemplated.

Key features of the proposed Act

The opinion outlines several important elements of the current proposal:

A new lawful basis for clinical trials

The Act would introduce a legal obligation as the lawful basis for processing data required to carry out a trial. While participants would still need to consent to join the study, this change would reduce reliance on consent for data sharing and will require updates to informed consent forms and clinical trial agreements.

Clearer definitions of roles

The joint opinion supports designating sponsors as controllers. This reflects general practice but may require changes in jurisdictions where sponsors are treated differently. Investigators are also identified as separate controllers, meaning controller‑controller agreements will be necessary to reflect these roles.

Retention expectations

The Act clarifies that only the master file should be kept for 25 years, with other personal data requiring shorter, separate retention periods. For many sponsors this may not require significant change, as best practice already limits the processing of identifiable information.

Restrictions on secondary use

The EDPB and EDPS consider the current wording on secondary use too broad. They request stronger safeguards, including pseudonymisation by default, enhanced transparency to participants, the right to object and restricted erasure, and robust governance and confidentiality controls.

Use of the European Digital Wallet

The European Digital Wallet, once available, will be permitted for providing informed consent. However, its use must be optional and cannot be made a condition of trial participation.

What this means for organisations

The proposed European Biotech Act represents a significant development for companies operating in the life‑sciences sector. While the framework aims to bring consistency and reduce uncertainty, it will also require organisations to revisit their documentation, contractual arrangements and governance processes, particularly in relation to clinical trials and secondary use of data.

Sponsors, CROs, research institutions and technology providers should monitor ongoing legislative progress and begin preparing for updates to informed consent forms, clinical trial agreements and data‑processing or data‑sharing arrangements. Strengthened governance and clear role definitions will be central to meeting expectations as the regulatory landscape evolves.