GDPR
Health research in Ireland: explicit consent, and the way around it
The regulations are written around the activity, not the institution, so a commercial medtech is inside them on the same terms as a hospital.
By Oscar CobbeCurrent as at 8 minute read6 sources
What the regulations are
Their full name is the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018, S.I. No. 314 of 2018. The Minister for Health made them, and they have been in operation since 8 August 2018.
They sit under section 36(2) of the Data Protection Act 2018, which is the provision letting a Minister prescribe suitable and specific measures for processing that would otherwise be restricted. This is Irish law layered on top of the GDPR, and it is stricter than the GDPR alone.
They were amended by S.I. No. 18 of 2021. S.I. No. 188 of 2021 is a different instrument, a commencement order for anti-money-laundering law, and has nothing to do with health research.
Why it reaches private companies
Regulation 3(1) binds a controller who is processing or further processing personal data for the purposes of health research. It does not say a university, a hospital, a research institution or a public body.
The definition of health research is equally activity-based, and it expressly includes research specifically concerned with innovative strategies, devices, products or services for the diagnosis, treatment or prevention of human disease or injury.
A commercial diagnostics company validating an algorithm on patient records, a medtech running a study on device data, or a digital health company analysing outcomes is inside these regulations. Being a private company makes no difference, and never did.
Consent is one of several required measures
Regulation 3(1) sets out a list of suitable and specific measures. All of them have to be in place before the processing starts, and the explicit consent requirement in Regulation 3(1)(e) is only one.
The others include ethical approval from a research ethics committee, a data protection impact assessment where the processing is likely to result in a high risk, controls on access to the data, logging, and training for the people carrying out the research.
The impact assessment (DPIA) requirement links to the ordinary GDPR rules. Health data is special category data, and processing it at any scale sits close to Article 35(3)(b) as well as to the Data Protection Commission's own list of processing requiring an assessment. In practice, if you are in these regulations, the assessment question is already answered.
What the consent requirement asks for
The 2021 amendment rewrote Regulation 3(1)(e). The controller must now record and keep the explicit consent, and give the person a copy, in line with international best practice on the ethical conduct of health research.
Two practical consequences follow from that wording. The consent has to be a record you hold, so a yes-or-no tick stored in a database is not enough evidence of what the person agreed to. And the participant gets a copy, which means the consent process has to produce a document.
The amendment also inserted Regulations 3A and 3B, which deal with deferring consent where a person is not capable of giving it.
The pre-screening exception, added in 2021
Checking whether a person is suitable or eligible to take part in health research does not need explicit consent or ethical approval. That applies where the check is done by a health practitioner employed by the controller, by a relevant employee, or by an authorised person acting under a health practitioner's direction. It covers eligibility screening only, and does not extend to the research itself.
The consent declaration route
Regulation 5 provides the way out for research where consent cannot be obtained. A controller can apply for a declaration that the explicit consent requirement does not apply. The test is whether the public interest in carrying out the research significantly outweighs the public interest in requiring the person's explicit consent.
The body that decides is the Health Research Consent Declaration Committee, appointed by and reporting to the Minister for Health.
Two conditions come before the application: the controller has to have carried out a data protection impact assessment, and has to have obtained ethical approval. The declaration is a route around one item on the list once the others are done.
Plan for that order: do the DPIA and get ethics approval before you apply for a declaration.
Three commercial cases to check
In all three, a company treats health data as if it were ordinary customer data.
Using data collected for care, or for a product's normal operation, to validate or train something later. That is further processing for a new purpose. It is health research if it is aimed at diagnosis, treatment or prevention. It is also item 1 on the Irish DPIA list.
Assuming a research partner's ethics approval covers your processing. Regulation 3(1) binds the controller, and the party holding the data can be the controller.
Sending the dataset to an analytics supplier outside the EEA without asking the transfer question separately. Ethics approval is not a safeguard for transfers under Chapter V of the GDPR, and the transfer analysis is its own exercise.
What to do about it
Short list, in order.
- 1Decide whether what you are doing is health research under the definition. The test is whether it is aimed at diagnosis, treatment or prevention of human disease or injury. Calling it product improvement does not change that.
- 2If it is, do the DPIA and get ethical approval before designing the consent flow, because both are conditions of everything else.
- 3Build a consent flow that produces a retained record and gives the participant a copy. Not a checkbox.
- 4If consent cannot be obtained, work out whether the public interest test is arguable before building anything, and plan for the Committee's timetable.
- 5Treat the transfer, retention and processor questions as separate exercises. This regime adds requirements; it does not answer the ordinary ones.
Sources
- 1.S.I. No. 314 of 2018, Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 · Irish Statute Book, Office of the Attorney General
- 2.S.I. No. 18 of 2021, the amending regulations · Irish Statute Book, Office of the Attorney General
- 3.Health Research Consent Declaration Committee · Health Research Consent Declaration Committee
- 4.Health Research Consent Declaration Committee, background and role · Health Research Board
- 5.Data Protection Act 2018, as revised · Law Reform Commission
- 6.Data protection impact assessments, and the Article 35(4) list · Data Protection Commission
Free, and no account needed
Check whether you must do an assessment before you start
These regulations require a DPIA where the risk is high, and health data raises the bar. The free check runs through the Irish list and tells you whether the ordinary GDPR rules require one as well.
Run the free checkThe assessment, written from what the system does
We write the DPIA from the actual data flows.
DPIA and AI risk assessmentWho wrote this
Oscar Cobbe · Founder, FourWinds
Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.
More about how we work →Read next
- GDPRDo you need a DPIA? Ireland has its own list, and it is specific
- GDPRSending personal data to the US from Ireland, in 2026
- GDPRYou have had a data breach. What the first 72 hours require
Written on 31 August 2026; it describes the law as FourWinds read it on that date. This is general information about how the rules work, not legal advice on your situation. Where you need a solicitor, we say so. How we check the law.