Regulation (EU) 2025/327 on the European Health Data Space
New EU regulation establishing the European Health Data Space, amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (Cyber Resilience Act). The regulation enters into force on 25 March 2025, with phased implementation dates through 2035. It creates a framework for the secondary use of health data across the EU while establishing cybersecurity and data protection requirements for health data systems.
What changed
- Establishment of European Health Data Space framework
- New requirements for health data secondary use
- Amendments to Cyber Resilience Act (CRA) requirements for health systems
- Phased implementation schedule with multiple entry-into-force dates through 2035
Who is affected
Healthcare providers, health data processors, digital health system operators, and organizations handling electronic health records across EU member states
- Effective
- 2025-03-25
- Action
- Action required
- Language
- EN