The European Health Data Space is moving from legal text to practical reality, and researchers across the Union need to understand how access will work. Regulation (EU) 2025/327, adopted by Parliament and Council on 11 February 2025 and in force since 25 March 2025, creates the first common framework for using health data across borders. Its phased application runs from 2027 to 2034, so 2026 is the year when national authorities and research teams must prepare.
What the European Health Data Space does
The European Health Data Space rests on two pillars. The first covers primary use: patients and clinicians can reach electronic health records across member states, including in emergencies and for continuing care. A uniform framework for electronic health record systems underpins that exchange, so that software sold in one country meets the same requirements everywhere.
The second pillar covers secondary use, meaning research, innovation, policy-making and regulatory work. This is where the regulation is most ambitious and most contested, because it opens sensitive records to people who are not treating the patient.
How researchers will request data access
Access to data under the European Health Data Space does not come automatically. Researchers, companies and institutions must apply to a national health data access body, which grants permission only for specified purposes. The data arrive in anonymised or pseudonymised form and are analysed inside secure processing environments rather than downloaded to personal machines.
Cross-border projects will run through HealthData@EU, the platform that links national bodies. In practice, a team studying a rare disease could submit one request and combine datasets from several countries. That removes the patchwork of national permissions that has slowed multi-country studies for years.
Which uses the regulation forbids
The European Health Data Space sets firm limits. Secondary use is barred for advertising, for assessing insurance applications, for setting loan conditions and for employment decisions. These bans matter for public trust. Citizens accept data sharing for medical progress more readily when they know insurers and employers cannot reach it.
Enforcement will rest on the access bodies, which must show they can refuse or withdraw permission. A body that approves requests too readily would damage the entire European Health Data Space, so their independence and resources deserve scrutiny.
Readiness gaps across member states
Health systems start from very different positions. Some countries already run national record platforms, while others still rely on fragmented hospital systems. The long phase-in until 2034 acknowledges this gap, yet it also risks uneven access: a researcher in a digitally advanced country may reach data years before a colleague elsewhere.
Costs add pressure on the European Health Data Space rollout. Access bodies need staff, secure computing capacity and legal expertise. Vendors of electronic record systems must adapt their products, and smaller suppliers may struggle to bear conformity costs.
What happens next
Member states are designating their health data access bodies and preparing the technical specifications that the Commission will adopt through implementing acts. Research funders should expect the first practical access procedures to take shape before the earliest application dates in 2027.
For hospitals, universities and life-sciences companies, the advice is to audit data quality now. Records that follow common formats will be easier to share, and good governance will win the trust the European Health Data Space depends on. If the access bodies work as designed, Europe could finally turn its large health datasets into a research asset that rivals the United States, without giving up patient rights.
