Purpose of the Template
If your organization processes personal data for scientific research under the General Data Protection Regulation (GDPR), you're in a regime with heightened transparency obligations. The European Data Protection Board (EDPB) published draft Guidelines 1/2026 on April 15, 2026, underscoring that routine reliance on the disproportionate effort exemption from Article 14 notice requirements won't withstand scrutiny.
This template provides a working Article 14 transparency notice specifically for secondary use of personal data in scientific research. It's designed to meet the EDPB's expectations for clear purpose definition, retention governance, and alternative transparency measures when direct notice isn't feasible.
Use this when processing personal data not collected directly from data subjects (e.g., registry data, clinical trial archives, administrative health records) to demonstrate compliance with transparency obligations even when individual notice requires disproportionate effort.
Prerequisites
Before customizing this template, ensure you have:
A documented disproportionate effort assessment covering the number of data subjects, age of data, safeguards in place, and potential impact on individuals. The EDPB requires case-by-case evaluation, not blanket determinations.
A legal basis analysis to determine if your further processing qualifies as scientific research under the six-factor test: methodical approach, ethical standards, verifiability, autonomy, defined objectives, and contribution to knowledge. If you can't demonstrate all six factors, justify your position with reference to nature, scope, and context.
Defined retention periods tied to specific research purposes. Open-ended "future research" justifications won't satisfy the storage limitation principle. If retaining data post-study for verification or reproducibility, document that rationale separately.
Controller role clarity in multi-party arrangements. If you're a sponsor working with pseudonymised data, you may still be a controller if you determine purposes and means. Your contractual frameworks need to reflect functional control, not just data access.
The Template
SCIENTIFIC RESEARCH TRANSPARENCY NOTICE
[Organization Name] | [Research Program/Study Title]
Publication Date: [Date] | Last Updated: [Date]
Purpose of This Notice
We process personal data for scientific research under the GDPR. This notice explains how we process data originally collected for other purposes, why we can't provide individual notice, and what safeguards we've implemented.
Research Objectives
[Describe specific, defined objectives. Example: "We are analyzing longitudinal health outcomes in patients with rare cardiovascular conditions to identify prognostic markers and inform treatment protocols. This research contributes to existing clinical knowledge by examining previously underexplored correlations between genetic markers and treatment response."]
Legal Basis for Processing
We process personal data under [select: Article 6(1)(e) public interest / Article 6(1)(f) legitimate interests / Article 9(2)(j) scientific research with appropriate safeguards]. [If legitimate interests: "Our legitimate interest is to advance scientific understanding of [specific area], which we have balanced against your rights and freedoms. We have determined that the public benefit and safeguards in place make this processing proportionate."]
Categories of Personal Data
We process the following categories of data: [list specific categories, e.g., "diagnostic codes, treatment dates, laboratory results, demographic information including age and gender"]. [If special category data: "This includes health data processed under Article 9(2)(j) with technical and organizational safeguards as required by Article 89(1)."]
Data Sources
Personal data originates from: [list sources, e.g., "hospital electronic health records, national disease registries, clinical trial databases"]. Data was originally collected for [state original purpose, e.g., "clinical care delivery and registry reporting"].
Why We Cannot Provide Individual Notice
Providing individual notice would require disproportionate effort because: [provide specific justification based on your assessment, e.g., "the dataset includes records for approximately 250,000 individuals spanning 15 years, many of whom have changed contact details or are deceased. Manual verification and contact would require resources equivalent to the entire research budget and delay findings with immediate public health relevance by an estimated three years."]
We have implemented alternative transparency measures including this public notice, [add others, e.g., "updates to our research portal, notifications to patient advocacy groups, and annual summaries distributed through participating institutions"].
Retention Period
We will retain identifiable data until [specific date or event, e.g., "completion of primary analysis in Q2 2028"]. We will retain pseudonymised data for [period] after study completion to enable verification and reproducibility of findings. We will not retain data for unspecified future research. Any subsequent research use must be reasonably foreseeable and supported by additional safeguards.
Your Rights
You have rights to access, rectification, and objection. [If research exemptions apply: "In certain circumstances, we may restrict these rights where exercising them would render impossible or seriously impair achievement of the research objectives. We will assess each request individually and provide a reasoned response."]
To exercise your rights or withdraw consent [if consent-based], contact: [email/portal].
Safeguards
We have implemented the following Article 89(1) safeguards: [list specific measures, e.g., "pseudonymisation using one-way hashing, role-based access controls limiting data access to named researchers, secure processing environment with audit logging, ethics committee oversight, and Data Minimisation protocols removing unnecessary identifiers"].
Contact and Complaints
Data Protection Officer: [contact details]
Supervisory Authority: [relevant DPA contact]
Customization Guide
Purpose and Objectives Section: Replace bracketed placeholders with your actual research questions. The EDPB expects clearly defined objectives, not vague statements about "advancing knowledge." If your research involves multiple sub-studies, list them separately with distinct purpose statements.
Legal Basis Justification: If you're using legitimate interests as a commercial entity, document your balancing test separately. The EDPB confirmed this is viable for scientific research, but you need to show why consent is impractical and how you've weighed individual rights against research benefits.
Disproportionate Effort Rationale: Customize this section carefully. Address specific factors the EDPB emphasizes: exact number of data subjects, how old the data is, what safeguards reduce risk, and what impact individuals might face. If processing health data from vulnerable populations, your bar for "disproportionate" is higher.
Retention Periods: If you can't specify exact dates, explain the methodology for determining when data will be deleted (e.g., "three years after final publication of results" or "when reproducibility verification is no longer scientifically necessary, assessed annually"). Don't use "for as long as necessary" without defining necessity.
Rights Restrictions: Only invoke research exemptions where you can demonstrate they're strictly necessary. If a data subject requests erasure and removing their record wouldn't seriously impair your study, you can't refuse on research grounds.
Validation Steps
Test Your Six-Factor Qualification: Before publishing this notice, ensure you can document a methodical approach, adherence to ethical standards, verifiability, autonomy from commercial pressure, defined objectives, and knowledge contribution. If any factor is weak, strengthen your documentation or reconsider whether you qualify for research treatment.
Verify Your Disproportionate Effort Claim: Calculate the actual resources required for individual notice. If it's genuinely disproportionate, document that calculation. If it's merely inconvenient, you don't meet the threshold. The EDPB's narrow interpretation means marginal cases won't survive regulatory challenge.
Check Your Alternative Transparency Measures: This notice alone may not suffice. Have you posted it prominently on your research portal? Have you notified relevant patient advocacy organizations? If your data subjects are concentrated in specific institutions, have you arranged for those institutions to publicize your research and this notice?
Confirm Your Retention Logic: Review your retention periods against the EDPB's prohibition on open-ended future research retention. If you're keeping data "for potential future studies," either define those studies specifically or delete the data when your current study concludes.
Audit Your Controller Determination: If you're a sponsor or funder who only receives pseudonymised data, don't assume you're a processor. If you set research questions, design protocols, or determine what analyses get conducted, you're likely a controller. Your contracts and this notice must reflect that reality.
Publish this notice before you begin processing. Update it whenever research purposes expand or retention periods change. Archive each version with timestamps. When a regulator asks how you met Article 14 obligations, you'll produce this notice, your disproportionate effort assessment, and evidence of your alternative transparency measures. That documentation package is what keeps you compliant under the EDPB's stricter governance expectations.
