Regulationsby GlyphEuropean Health Data Space (EHDS)
Enacted European Union · In force Mar 25, 2025 · next deadline Mar 26, 2027 (in 5 months)
Deadlines
Coming up
EHDS general application dateThe regulation applies generally from 26 Mar 2027, subject to the phased exceptions below (final article).
Primary use for first data categories; secondary use framework appliesPatient rights and EHR rules apply to patient summaries, ePrescriptions and eDispensations (Art 14(1)(a)-(c)). Chapter IV secondary-use rules (data permits, Health Data Access Bodies) apply.
Primary use for second data categories; EHR systems in service; extra secondary-use categoriesPrimary-use rules extend to medical images, lab results and discharge reports (Art 14(1)(d)-(f)). Chapter III applies to EHR systems put into service under Art 26(2). Additional secondary-use categories in Art 51(1)(b),(f),(g),(m),(p) apply.
Third-country participation in secondary useArt 75(5) applies from 26 Mar 2035.
Already passed
EHDS enters into forceRegulation (EU) 2025/327, published 5 Mar 2025, enters into force on the twentieth day following publication.
Summaries for reference, not legal advice. Check the official text.
What it does
Gives individuals electronic access to, and control over, their health data across the EU (primary use), with a cross-border MyHealth@EU infrastructure and mandatory requirements for electronic health record (EHR) systems. It also creates a permit-based framework for secondary use of health data (research, innovation, policy) through national Health Data Access Bodies, with data holders required to make data available.
- Who it applies to
- Health data holders (healthcare providers, researchers, companies holding electronic health data; micro-enterprises largely exempt as data holders), manufacturers and distributors of EHR systems and wellness apps claiming interoperability, health data users seeking secondary use, and Member State digital health authorities.
- Penalties
- Secondary-use infringements by data holders/users: up to EUR 10M or 2% of worldwide annual turnover, and up to EUR 20M or 4% for the most serious infringements, e.g. unlawful re-identification or use outside a data permit (Art 64). Member States set other penalties.
- Enforced by
- National digital health authorities, Health Data Access Bodies, market surveillance authorities (EHR systems), data protection authorities; EHDS Board and European Commission
- Official name
- Regulation (EU) 2025/327 on the European Health Data Space
- Citation
- OJ L, 2025/327, 5.3.2025
- Topics
- Health data, Privacy, Data access and sharing
Verified 2026-09-22
Research notes
Some provisions (e.g. Art 55(6), 70, 73(5), 75(1),(12), 77(4), 78(6)) apply from 26 Mar 2027. Many details depend on implementing acts still being adopted. The effective date is computed as the twentieth day after the 5 Mar 2025 OJ publication.
Related
Cyber Resilience ActSets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU: secure by design, vulnerability handling, security updates for the support period, SBOMs, and CE marking after conformity assessment. Manufacturers must report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA from 11 Sep 2026.Next: Dec 11, 2027 CRA fully applies · in 13 monthsDORAHarmonised ICT risk-management, major ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing) and ICT third-party risk rules for EU financial entities. Financial entities must keep a register of all ICT third-party contracts. Critical ICT third-party providers (cloud, data centres and similar) come under direct EU oversight.In effect since Jan 16, 2023Data Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setDigital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 monthsEU AI ActA risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.Next: Dec 2 New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends · in 36 daysEU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 months
Questions about European Health Data Space (EHDS)
- What are the European Health Data Space (EHDS) compliance deadlines?
- Mar 25, 2025: EHDS enters into force. Mar 26, 2027: EHDS general application date. Mar 26, 2029: Primary use for first data categories; secondary use framework applies. Mar 26, 2031: Primary use for second data categories; EHR systems in service; extra secondary-use categories. Mar 26, 2035: Third-country participation in secondary use.
- When does European Health Data Space (EHDS) take effect?
- European Health Data Space (EHDS) took effect on Mar 25, 2025. The next milestone is Mar 26, 2027: EHDS general application date.
- Who does European Health Data Space (EHDS) apply to?
- Health data holders (healthcare providers, researchers, companies holding electronic health data; micro-enterprises largely exempt as data holders), manufacturers and distributors of EHR systems and wellness apps claiming interoperability, health data users seeking secondary use, and Member State digital health authorities.
- What are the penalties under European Health Data Space (EHDS)?
- Secondary-use infringements by data holders/users: up to EUR 10M or 2% of worldwide annual turnover, and up to EUR 20M or 4% for the most serious infringements, e.g. unlawful re-identification or use outside a data permit (Art 64). Member States set other penalties.