European Union: EDPB-EDPS adopted joint opinion on European Biotech Act Proposal

On 10 March 2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted a joint opinion on the proposal for a Regulation on establishing a framework of measures for strengthening the Union's biotechnology and biomanufacturing sectors, particularly in the area of health (European Biotech Act). The EDPB and the EDPS support the Proposal's objective to harmonise how sponsors and investigators process personal data in clinical trials under Regulation (EU) No 536/2014 (Clinical Trials Regulation) (CTR) by establishing a single legal basis for such processing. The opinion provides recommendations to enhance clarity, including specifying that the 25-year minimum retention period applies only to personal data in the clinical trial master file, requiring pseudonymisation where direct identification is unnecessary, and clarifying that proposed Article 93(6) CTR would provide a legal basis for further processing under Article 6(1)(e) of the General Data Protection Regulation (GDPR). The EDPB and the EDPS also recommend that the European Medicines Agency (EMA) cooperate with the EDPB when developing guidance on AI use in medicinal product development. Regarding regulatory sandboxes established under Articles 40, 56, and 61 of the Proposal, the EDPB and the EDPS note that these provisions do not provide a legal basis for processing personal data, which would require a valid basis under the GDPR.