The European Health Data Space opens EU health data for research from 2029. How secondary use works, who it affects, and what it signals for data teams in Asia.
Health systems generate enormous amounts of data, yet only a small share of it is ever reused to improve care, speed up research or inform policy. Europe has decided to change that through law. The European Health Data Space (EHDS) creates the first EU-wide legal framework for both the primary and secondary use of electronic health data, and over the next few years it will become the largest regulated system for reusing health data anywhere in the world.
It is a European law, but it matters in Asia for three reasons. Many Asian pharmaceutical companies, contract research organisations, research platforms and health systems work with European partners, and those partnerships will increasingly be shaped by EHDS rules. Asian organisations also compete with European ones in the same research, real-world evidence and AI markets. And policymakers across the region are thinking carefully about how their own health data can be reused safely, so Europe's model will be studied closely, both for what it gets right and for what proves difficult.
This guide explains what the EHDS is, how secondary use will work, who it applies to, and what it signals about the quality of data that research and innovation will expect.
The EHDS has two halves. The first, primary use, is about care. It gives people in the EU stronger rights to access their own health records and aims to make key records, such as patient summaries, prescriptions, laboratory results and discharge reports, available to clinicians across borders.
The second half, secondary use, is about reusing health data for purposes beyond an individual's care, such as research, innovation, public health and policy-making. This is where the EHDS is most novel. It requires organisations that hold health data to make it available, under strict conditions, to approved users for approved purposes. It also gives people the right to opt out of their data being used in this way.
The EHDS entered into force on 26 March 2025, with a general date of application of 26 March 2027 and further major milestones following in 2029, 2031 and 2035. The practical milestones for secondary use are these.
By 26 March 2027, each member state must designate a Health Data Access Body to supervise access to health data for secondary use. The first major operational milestone is 26 March 2029, when most of the secondary use rules begin to apply, along with cross-border exchange of patient summaries and ePrescriptions. From March 2031, the remaining data categories for secondary use, including genomic data, follow, as does cross-border exchange of medical images, laboratory results and hospital discharge reports.
The process is built around a central idea: data should be made available for legitimate purposes without being handed over freely.
A researcher, company or public body first identifies relevant datasets through national catalogues. Irrespective of whether anyone requests their data, data holders must provide a description of the datasets they hold to their Health Data Access Body, and these descriptions feed the catalogues. The user then applies for a data permit, setting out the purpose and the data needed. The regulation lists permitted purposes, such as scientific research, innovation and public health, and it also prohibits certain uses, such as making decisions that are detrimental to individuals or setting insurance premiums.
If a permit is granted, the data holder provides the data, which is pseudonymised or anonymised as the permit requires. Analysis happens inside a secure processing environment, where no personal data can be downloaded and users cannot identify individuals. Only non-personal results leave the environment.
This model will feel familiar to anyone who has worked with trusted research environments. What is new is the scale, the legal obligation on data holders, and the common rules across 27 countries.
Three groups carry most of the obligations: health data holders, health data users, and the manufacturers of electronic health record systems.
For organisations in Asia, the reach of the regulation is more limited than headlines sometimes suggest. The European Commission has confirmed that EHDS obligations do not apply to health data holders established outside the EU unless they have an established presence there. An Asian hospital group or laboratory network with no EU operations is therefore not required to make its data available under the EHDS.
Access in the other direction is also bounded. Researchers and other data users can access health data for secondary use only if they are established in the EU or in a country with reciprocal access arrangements. Third countries and international organisations will be able to apply to join HealthData@EU, the cross-border infrastructure, from March 2034. In the meantime, Asian organisations that want to work with EHDS data will generally do so through European entities or partners. Personal data transfers outside the EU remain governed by the GDPR in any case.
Manufacturers are the third group. Health technology companies in Asia that sell electronic health record systems into Europe will need to meet the EHDS interoperability and security requirements before entering the EU market.
For all its focus on access, the EHDS is quietly one of the most important developments in health data quality. It makes data quality visible.
The obligation on data holders to describe their datasets, whether or not anyone asks for them, means every holder will need to know what it has, where it came from and what condition it is in. Alongside this, an EU project called QUANTUM is developing criteria for a data quality and utility label, so that users can compare datasets before they apply. Once datasets can be compared openly, quality stops being an internal concern and becomes a question of reputation and value.
In the clinical data we work with across the region, the gap between data that exists and data that is ready for reuse is usually wide. Laboratory results for the same test arrive under different names, units and reference ranges. Medications are recorded under brand names, generic names and local codes. Diagnoses sit in free text, and much of the context of a patient's care lives in discharge summaries, imaging reports and clinical notes. Records arrive as structured messages, PDFs and scanned pages, often in more than one language, and many institutions maintain their own internal code sets. None of this reflects poor practice; it reflects how clinical data is created. But before such data can be described honestly, compared with other datasets or trusted by a researcher, it needs to be made consistent, reviewed, mapped to medical coding standards and appropriately protected, with each step documented.
Protection deserves particular care. The EHDS relies on the distinction between pseudonymised and anonymised data, and under EU law, pseudonymised data remains personal data. Choosing the right approach for each purpose is essential, and we explain the distinctions in De-identification, Pseudonymisation and Anonymisation: What the Difference Means for Your Health Data.
There is also a clear link to AI. Much of the demand for secondary use data will come from teams building and validating AI models, and the EU AI Act asks that the data behind high-risk systems be relevant, representative and as free of errors as possible. We cover that in The EU AI Act Delay: What It Means for Healthcare AI Teams in Asia.
Every market will choose its own path, and the EHDS is not a template to copy wholesale. It does, however, offer useful lessons in both directions.
Some parts of the design are worth studying closely. Clear permits tied to defined purposes give both data holders and patients confidence about how data will be used. Secure processing environments allow valuable analysis without releasing personal data. Public dataset descriptions and quality labels create an incentive to improve data, because quality becomes visible.
Other parts show what remains hard. Member states are starting from very different levels of digital maturity, and building access bodies, catalogues and secure environments takes years. There is also a gap that no infrastructure closes on its own: exchanging data is not the same as the data being clinically usable. A record shared across a border, or a dataset made available to a researcher, is only as valuable as its structure, consistency and completeness. Singapore's new health data law reflects the same reality, with data quality requirements sitting alongside the obligation to contribute, as we explored in Singapore's Health Information Act: What Healthcare Providers Need Ready by 2027.
For health systems and data holders in Asia, the larger lesson is about opportunity. Many organisations already understand that their data has value. The harder question is how to turn it into an asset that works on every front: for better care, for research and partnerships, for AI, and, where the right permissions are in place, as an asset that can be shared or traded responsibly. We explore that journey in When Health Data Becomes an Asset: What Readiness Actually Requires.
Most of the secondary use rules apply from 26 March 2029, with remaining data categories, such as genomic data, following from March 2031. Health Data Access Bodies must be designated by 26 March 2027.
Generally, data users must be established in the EU or in a country with reciprocal access arrangements. Third countries and international organisations may apply to join HealthData@EU from March 2034. Until then, organisations outside the EU will usually work through European entities or partners.
Not directly. The European Commission has confirmed that EHDS obligations do not apply to health data holders established outside the EU unless they have an established presence in the EU.
It is the national body in each EU member state that assesses applications, issues data permits and oversees secondary use of health data, including the secure processing environments in which data is analysed.
Yes. The EHDS gives people the right to opt out of their electronic health data being used for secondary purposes, subject to limited exceptions set by member states.
