CNIL outlines obligations for health professionals conducting internal research

What happened

The CNIL clarifies that internal research using patient data does not require prior formalities with the authority, but remains subject to general GDPR obligations. Health establishments must document the processing, possibly conduct a DPIA, and inform data subjects transparently. Rights such as the right of opposition apply, and data must stay within the care team unless anonymised.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The guidance informs health actors how to comply with GDPR when re‑using patient data for internal research, reducing regulatory uncertainty.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Confirm access, correction, deletion and opt-out requests are handled within the required time.
3. Revisit retention schedules and data minimisation for the data involved.
4. Map the security requirements to existing controls and close gaps.
5. Confirm handling of sensitive data categories meets the stricter rules.