As the European Union moves to operationalise the European Health Data Space (EHDS), a framework with the potential to transform cross-border health research, the pathway for participation by third countries such as the UK remains notably unclear. In our recent response to the public consultation on the draft guidelines for international and third-country access to the EHDS, we highlighted critical gaps and structural ambiguities that must be resolved to ensure researchers and institutions in the UK can be a part of the new framework and to avoid a prolonged freeze in cross-border collaboration.
With the European Health Data Space, the EU has built one of the most ambitious health data governance systems anywhere in the world. The EHDS is designed to make it dramatically easier for researchers, health authorities and companies to access and share health data safely across all 27 member states. At the centre of this vision is HealthData@EU. This shared infrastructure provides a single searchable catalogue of datasets and a common application portal for accessing data held across participating countries, while leaving access decisions in the hands of national Health Data Access Bodies (HDABs).
As the EU works through the practical questions needed to bring that system to life within its own member states, it’s also starting to look at how countries outside the EU – like the UK – might eventually take part too. For third country researchers and institutions specifically, the appeal is obvious: bigger, richer datasets, and the ability to run research across borders and enter into new collaborations. The problem is that, as things stand, the route in remains largely unclear.
The dual pathways to access
The draft guidelines set out two possible pathways for a non-EU country to plug into HealthData@EU:
- Authorised participation — a country-wide application-based route, assessed case by case.
- Reciprocity — access granted on the basis that the UK offers EU researchers equivalent access to UK data in return.
The authorised participation route is reasonably well specified. Recognition happens at country level first, and the UK as a whole would need to be recognised by the European Commission. Only then can a UK organisation become eligible to apply. Once that happens, individual universities, NHS bodies and research groups would apply through the same process as any EU institution. The catch is timing: this route will not actually be available to any third country until 2035, while member states would be eligible to apply as of 2029.
The alternative route is reciprocity, which is far less developed. The draft guidelines currently offer no defined criteria for qualifying, and no timeline for how it would work. In essence, the idea behind ‘reciprocity’ is that access should be a two way street: the UK gets to use EU health data, and in exchange, EU researchers get comparable access to UK health data.
Critically, the route also features a more subtle problem buried in the fee rules. The draft guidelines allow for “differentiated fee structures”, essentially suggesting that where equivalent access arrangements do not exist, higher fees may be justified.
This provision aims to recognise that processing applications from countries without reciprocal access arrangements may require additional time, scrutiny and administrative effort. For example, the Health Data Access Bodies may need to undertake more extensive legal assessments, navigate enforcement challenges, or manage the risks created when equivalent access rights are not available in return.
Recovering those additional costs through fees is understandable. But it could create a worrying loophole. If countries that fail to provide equivalent access to their own health data can still gain access to EHDS data by paying higher fees, reciprocity ceases to be a condition of participation and becomes merely a pricing adjustment.
This approach risks creating an asymmetrical system in which certain countries gain access to European datasets without offering comparable opportunities in return, weakening the principle of fairness that reciprocity was designed to uphold. While such an outcome is unlikely to have been intended by policymakers, it exposes a potential loophole that warrants much clearer safeguards in the final guidance. Greater clarity is therefore needed on whether reciprocity is a prerequisite for participation or simply one factor taken into account when determining access fees.
A structural mismatch
The EHDS is designed around a tidy assumption: each participating country nominates a national health data access body, as the gatekeeper and point of contact for that country’s health data. For example, recently, Findata, Finland’s social and health data permit authority confirmed it would serve as the coordinating Health Data Access Body and the national contact point for the EHDS in the country.
The situation in the UK is rather more complicated. As it stands, instead of one central body, the UK has a patchwork of well-established but separate data infrastructures, such as HDR UK, the SAIL Databank in Wales, DataLoch in Scotland, and others, with each running its own Trusted Research Environment (TRE). These are broadly the UK equivalent of what the EHDS calls a Secure Processing Environment (SPE).
On top of that, the four nations of the UK have different regulatory and governance approaches to the reuse of health data.
For example, with regards to consent, Scotland doesn’t use the national data opt-out system used in England. Instead, access to NHS data is approved through Caldicott Guardians and a specific privacy panel. That inconsistency is more significant than may initially appear. The guidelines identify the existence of an appropriate opt-out mechanism as one of the criteria for assessing a third country’s eligibility for authorised participation. In the absence of a single, UK-wide opt-out framework, the UK could face challenges in demonstrating compliance with this requirement, among others. Without a consistent UK wide approach to consent, the country’s participation in the EHDS could be complicated on both fronts.
The emerging Health Data Research Service (HDRS) is the obvious candidate to become the UK’s single point of contact for the EHDS. But its current remit is narrower than the job would require: the EHDS covers data use for policymaking and regulation as well as research, so HDRS would need a broader mandate to genuinely represent the whole of the UK’s health data ecosystem to Brussels. The narrower scope is understandable, citizen trust tends to be higher for health data reused in research than for policymaking or innovation purposes, as earlier health data sharing initiatives collapsed partly over such concerns. Still, expanding the remit should be possible and is worth pursuing. Extending HDRS’s mandate now, while the institution is still being shaped, would allow the trust safeguards for uses extending beyond research to be designed deliberately rather than retrofitted later.
GDPR friction, adequacy, and the threat of localisation
The draft guidance points to the fact that UK stakeholders will also need to navigate unresolved conflicts between the EHDS and existing data protection rules. For instance, while the draft guidelines confirm that accessing data via secure processing environments constitutes data processing, they remain silent on whether remote access by a third-country user legally qualifies as an international transfer under GDPR Chapter V. That uncertainty matters because if it does count as a transfer, additional legal safeguards would apply alongside the requirements of the EHDS. It is currently unclear whether that is the case.
These uncertainties are compounded by the unresolved question of the UK’s future adequacy relationship with the EU. The UK currently benefits from an EU adequacy decision, the EU’s official judgment that UK data protection law is trustworthy enough to allow data to flow freely. That decision is set to expire in December 2031. The draft guidelines do not clarify how access would be affected if adequacy were withdrawn or not renewed, or whether a fallback such as Standard Contractual Clauses, could support continued access in the meantime. Institutions investing now in aligning with the EHDS are, in effect, building on a foundation that is not guaranteed to still be there a few years from now. There is no clear contingency plan if the 2031 deadline arrives without a renewal in place.
Beyond the operational questions around access, there is a more immediate legal risk embedded in the GDPR itself. Under Article 9(4), member states retain the right to impose additional conditions or limitations on international access to, and transfers of, personal health data. Given the heightened sensitivity of health information, some countries could choose to require that data be accessed exclusively through secure processing environments located within the EU. If adopted, such requirements could effectively prevent UK researchers from using domestic trusted research environments and create a significant barrier to participation.
Nevertheless, there is some encouragement in the draft’s recognition that secure environments do not need to mirror the EU’s own secure processing environments model exactly to be considered acceptable. Instead, the draft guidelines emphasise the principle of “functional equivalence”, suggesting that non-EU environments may qualify where they can demonstrate the same level of protection through different technical or organisational approaches.
While welcome, clarification of this principle would give third-country researchers and institutions greater confidence about how equivalence will be assessed in practice.
Re-establishing UK representation in Brussels
Technical preparedness alone will not secure UK participation in the EHDS. The UK also needs a credible organisation with the authority, expertise and resources to engage directly with the European Commission, member states and EHDS governance bodies as the framework evolves.
During TEHDAS1, an EU funded project which developed joint European principles for the secondary use of health data, the NHS Confederation (now the NHS Alliance) played a notable role as a project partner contributing to developing the programme’s citizen engagement activities. But as the EHDS moves from design to implementation, it is far less clear which UK organisation is responsible for maintaining an ongoing dialogue with the Commission and EHDS governance bodies.
Without an organisation capable of translating the needs of the UK’s research, health and life sciences communities into policy engagement at the European level, the UK risks becoming a passive observer of decisions that will ultimately determine its access to and participation in the EHDS.
Tellingly, the NHS Confederation’s own 2025 report on UK–EU health cooperation calls on the government to negotiate a formal Health Protection Agreement that would include the extension of the UK’s “association participation in the European Health Data Space… to full membership.”, a sign that the UK’s own health leadership already sees this as a serious foreign policy priority, not a niche technical issue.
What this should mean for policymakers
For government and its data infrastructure partners, the task is proactive positioning rather than passive waiting. That means:
- Expand HDRS’ mandate. Its potential role as a UK-wide contact point for the EHDS is an opportunity worth shaping now, including broadening its mandate beyond research access to match the fuller range of secondary uses the EHDS anticipates.
- Future-proofing TREs. UK data holders should build enough flexibility into domestic TREs now to align with forthcoming EHDS standards on access controls, audit logging and export restrictions, and be ready to demonstrate, not simply assert, that their safeguards offer equivalent protection.
- Resolving domestic fragmentation, or at least presenting a coherent interface, so that devolved differences in legal basis and approval pathways don’t become a barrier to a unified UK application to HealthData@EU.
- Reestablish clear Brussels representation, so the UK has a standing voice in EHDS governance discussions rather than reacting after the fact.
The bottom line
The UK has some of the richest health datasets and most advanced secure research infrastructure in the world. On paper, it should be a natural partner for the EHDS. But none of that translates into access automatically, and waiting for Brussels to resolve every outstanding question is not a viable strategy. As we’ve explained, there is much that policymakers can start addressing now, well before the EU’s own timeline forces the issue. Treating this as a governance and diplomacy priority today, not a technical problem to pick up later, is what will determine whether the UK is ready when the door finally opens.
