On September 17, 2025, the German Supervisory Authorities (Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder, DSK) published new guidelines and recommendations addressing the complex requirements for transferring personal data, particularly health data (including health data contained in biomaterials), to countries outside of the European Economic Area for scientific research purposes under the GDPR. These guidelines may be of particular relevance for pharmaceutical, medical device, and other life sciences companies that conduct clinical research.

Two-Stage Assessment for Third-Country Transfers

The guidelines state that assessing the lawfulness of such transfers involves a two-stage process. The first stage examines whether the data processing itself has a valid legal basis under Articles 6 and 9 GDPR, including any applicable exceptions for special categories of data such as health or genetic data. The second stage determines whether the transfer can rely on an authorized transfer mechanism under Chapter V, such as adequacy decisions, Standard Contractual Clauses (SCCs), or specific derogations under Article 49.

First Stage Assessment: Focus on Broad Consent (Arts. 6(1)(a) and 9(2)(a) GDPR)

The legal basis for processing under Articles 6 and 9 of the GDPR may vary, but the guidelines focus solely on broad consent. The guidelines acknowledge that, for many researchers, “broad consent” plays a vital role in legitimizing the processing of personal data when research purposes may still evolve.

According to the guidelines, broad consent cannot serve as a legal basis if transfers of personal data to third countries with a lower level of data protection are anticipated. In this regard, the guidelines mention the necessity of Transfer Impact Assessments (TIA) to evaluate whether local laws or practices in the third country might undermine data protection. For research involving sensitive health data that may be difficult to pseudonymize (e.g., genetic data), this assessment is particularly critical.

Significantly, the guidelines call for robust supplementary measures to compensate for the broader scope of consent. These include implementing consent management systems enabling ongoing updates and revocations, providing proactive information to data subjects, early involvement of ethics and data protection authorities, and conducting data protection impact assessments. These supplementary measures correspond to those outlined by the DSK in its position paper “Requirements for the secondary use of genetic data for research purposes” from May 15, 2024.

Second Stage Assessment: A Sequence of Options (Chapter V GDPR)

If a legal basis for processing has been established, the next step is to identify a transfer mechanism under Chapter V of the GDPR. This begins by checking whether the country of destination offers an adequacy decision confirming an adequate level of protection by the European Commission. The guidelines note that controllers concerned about adequacy decisions being revoked may also seek consent, provided that the relationship between the adequacy decision and consent is transparent to the data subject. However, if consent is withdrawn, controllers can no longer rely on the adequacy decision to justify the transfer. Although revoking consent pursuant to Article 49(1)(a) GDPR does not generally preclude transfer on the basis of an adequacy decision, the DSK takes the view that such a revocation also constitutes a revocation of consent in the first stage (i.e., the legal basis for that processing).

If no adequacy decision exists, controllers should consider SCCs or, for intra-group transfers, Binding Corporate Rules (BCRs). Data exporters must assess, through a TIA, whether the safeguards in these clauses can be effectively implemented in the third country concerned, given potential conflicts with local legal frameworks. This assessment is essential to determine if additional measures are required to ensure an equivalent level of protection. For transfers to the United States, the guidelines advise relying on the Commission’s EU-U.S. Privacy Framework assessment when conducting the TIA.

The guidelines also highlight pseudonymization as an important supplementary measure in research and healthcare, but emphasize the need to assess on a case-by-case basis whether data can be pseudonymized under Article 4(5) GDPR. According to the guidelines, this can be difficult for biomaterials, extensive health data, or imaging data, which often cannot be pseudonymized due to their direct link to an individual. The guidelines also clarify that SCCs and BCRs cannot be supplemented with consent as a fallback to compensate for missing supplementary measures, such as when pseudonymization is appropriate but not feasible.

Only if these transfer mechanisms are unavailable should derogations under Article 49 be considered as a last resort. Following the European Data Protection Board (EDPB) guidelines, these derogations—such as explicit consent or reliance on important public interest—must be applied restrictively and only after a thorough risk assessment. Regarding the “important public interest” derogation under Article 49(1)(d) GDPR, the guidelines note that, against the backdrop of the constitutionally protected research interest under Article 5(3) of the German Constitution (Grundgesetz, GG) and the public significance of health research, transfers to third countries may in limited cases be justified under this derogation. However, for the private sector, reliance on these derogations would be highly exceptional, as it typically requires an interest of exceptional importance aimed at protecting a particularly significant legal right or public good.

Enhanced Transparency and Information Obligations

Building on Articles 13 and 14 GDPR, the guidelines and recommendations discuss the specific information that must be provided to data subjects concerning third-country transfers. This includes stating the precise recipient country or countries, the transfer’s legal basis, and any known risks to data protection posed by each recipient jurisdiction’s legal environment.

Where transfers rely on explicit consent under Article 49(1)(a), controllers must give data subjects clear, accessible, and comprehensive information on the following: (i) the absence of equivalent data protection laws and enforceable rights; (ii) the lack of restrictions on access to personal data by public authorities; (iii) the lack of safeguards for onward data transfers; and (iv) the lack of an independent data protection authority. As indicated above, the guidelines suggest that controllers must now also perform a TIA to meet their transparency obligations for transfers under Article 49 GDPR – TIAs are generally required only for transfers under Article 46 GDPR (i.e., under SCCs or BCRs).

It is worth noting that the guidelines were adopted after the European Court of Justice’s (CJEU) decision of 4 September 2025 in the SRB case (Case C-413/23 P), and the German authorities appear to assume that the transferred data, even if pseudonymized, is always personal data for the recipient. In the SRB case, however, the CJEU confirmed that pseudonymized data can qualify as anonymous data depending on the ability of the recipient to re-identify the subject behind the data.