European UnionEuropean Health Data Space Regulation, Re-identification, Anonymised and Pseudonymised Data and Secure Processing Environments (Articles 61, 66 and 73)
Regulation (EU) 2025/327, Arts. 61, 66, 73
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Security, Governance
- Audit expectation
- periodic
- Who audits it
- Self
As of .
What it requires
- If you are a health data user, do not re-identify or attempt to re-identify the natural persons to whom electronic health data obtained on the basis of a data permit, a health data request or an access approval relate (Article 61(3)).
- If you are a health data user processing electronic health data within a secure processing environment, do not provide access to the data, or make it available, to third parties not mentioned in the data permit (Article 61(2)).
- If you are a health data user, make public the results or output of secondary use within 18 months of completing the processing in the secure processing environment or of receiving the response to your health data request, a period the health data access body may extend in justified cases, and let those results or that output contain only anonymous data (Article 61(4)).
- If you are a health data access body, provide electronic health data in an anonymised format where the health data user's purpose can be achieved with such data, and provide it in pseudonymised format only where the user has sufficiently demonstrated that anonymised data cannot achieve the purpose, keeping the information needed to reverse the pseudonymisation with the access body or a trusted third party acting under national law (Article 66(2) and (3)).
- If you are a health data access body, give access to electronic health data under a data permit only through a secure processing environment that restricts access to the persons listed in the data permit, gives each user a unique identity and a confidential access mode, limits input, inspection, modification and deletion to a limited number of authorised identifiable individuals, minimises the risk of unauthorised reading, copying, modification or removal, keeps identifiable logs of access and activities for the period needed to verify and audit processing, with logs of access kept for at least one year, and monitors compliance with those measures (Article 73(1), points (a) to (f)).
- If you are a health data access body, review each download request so that health data users can download only non-personal electronic health data, including data in an anonymised statistical format, and have the secure processing environments audited on a regular basis, including by third parties, correcting the shortcomings, risks or vulnerabilities the audits identify (Article 73(2) and (3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionYes
Criminal exposure note
The Regulation sets administrative fines (Article 64) and leaves the rules on other penalties to the Member States (Article 99); it makes no breach of Article 61, 66 or 73 a criminal offence itself.
Penalty structure
Article 64(5), points (b) and (c), of Regulation (EU) 2025/327 subjects health data users extracting personal electronic health data from secure processing environments, and health data users re-identifying or attempting to re-identify the natural persons to whom the electronic health data relate (Article 61(3)), to administrative fines imposed by the health data access bodies of a maximum of EUR 20,000,000 or, for an undertaking, 4 percent of total worldwide annual turnover in the preceding financial year, whichever is higher. Article 64(4) sets a lower tier (EUR 10,000,000 or 2 percent) for infringements of the duties of a health data holder or health data user under Article 60 and Article 61(1), (5) and (6). Neither tier names the duties Articles 66 and 73 place on health data access bodies, and Article 99 leaves the penalties for infringements not subject to Articles 63 and 64 to the Member States.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The health data access bodies that Member States designate under Article 55, which monitor and supervise compliance by health data users and health data holders with the requirements of the Regulation (Article 57(1), point (a)(ii)) and take enforcement measures and impose administrative fines under Articles 63 and 64; where a finding of non-compliance concerns a possible breach of Regulation (EU) 2016/679, the health data access body informs the supervisory authorities under that Regulation (Article 63(2)).
What it makes you log
What the log must hold
Actor identity, Access record
Log retention
Article 73(1), point (e), sets one year as the minimum for logs of access and leaves the period for logs of other activities to what is necessary to verify and audit all processing operations in the environment.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 1
Logging duty
Article 73(1), point (e), requires the secure processing environment through which a health data access body provides access under a data permit to keep identifiable logs of access to and activities in the environment, for the period necessary to verify and audit all processing operations, with logs of access kept for at least one year.
- Kind
- Explicit
- As of
- Provision
- Article 73(1), point (e)
- Trigger
- personal_data_processing
What this law does
Article 61(3) provides that health data users shall not re-identify or attempt to re-identify the natural persons to whom the electronic health data obtained on the basis of a data permit, a health data request or an access approval by an authorised participant in HealthData@EU relate.
Article 61(2) provides that, when processing electronic health data within the secure processing environments referred to in Article 73, health data users shall not provide access to the electronic health data, or make those data available, to third parties not mentioned in the data permit.
Article 61(4) provides that health data users shall make public the results or output of secondary use within 18 months of the completion of the processing of the electronic health data in the secure processing environment or of having received the response to the health data request, and that the results or output of secondary use shall contain only anonymous data.
Article 66(2) provides that health data access bodies shall provide electronic health data in an anonymised format, where the purpose of processing by the health data user can be achieved with such data.
Article 66(3) provides that, where the health data user has sufficiently demonstrated that the purpose of processing cannot be achieved with anonymised data, health data access bodies shall provide access to electronic health data in pseudonymised format, and that the information necessary to reverse the pseudonymisation shall be available only to the health data access body or an entity that acts as a trusted third party in accordance with national law.
Article 73(1) provides that health data access bodies shall provide access to electronic health data pursuant to a data permit only through a secure processing environment subject to technical and organisational measures and security and interoperability requirements, including restriction of access to the authorised natural persons listed in the data permit, individual and unique user identities and confidential access modes, and identifiable logs of access to and activities in the secure processing environment, with logs of access kept for at least one year.
Article 73(2) provides that health data access bodies shall review the electronic health data included in a download request to ensure that health data users are only able to download non-personal electronic health data, including electronic health data in an anonymised statistical format, from the secure processing environment.
Article 73(3) provides that health data access bodies shall ensure that audits of the secure processing environments are carried out on a regular basis, including by third parties, and shall take corrective action for any shortcomings, risks or vulnerabilities identified by those audits.
Article 64(5), points (b) and (c), subjects health data users extracting personal electronic health data from secure processing environments, and health data users re-identifying or attempting to re-identify the natural persons to whom the electronic health data relate, to administrative fines of a maximum of EUR 20 000 000 or, in the case of an undertaking, of a maximum of 4 % of its total worldwide annual turnover in the preceding financial year, whichever is higher.
Article 64(4) subjects infringements of the duties of the health data holder or health data user pursuant to Article 60 and Article 61(1), (5) and (6) to administrative fines of a maximum of EUR 10 000 000 or, in the case of an undertaking, of a maximum of 2 % of its total worldwide annual turnover in the preceding financial year, whichever is higher.
Article 99 requires Member States to lay down the rules on penalties applicable to infringements of the Regulation, in particular for infringements which are not subject to administrative fines pursuant to Articles 63 and 64. Article 100 gives any natural or legal person that has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation in accordance with Union and national law.
Article 105 applies Chapter IV, in which Articles 61, 66 and 73 sit, from , and applies Article 73(5), which requires the Commission to lay down by implementing act the requirements for the secure processing environments by , from .
When LexLint raises it
When your app profile says your app handles health records.