What Changed
- CNIL specified three cumulative criteria for health research to qualify as internal research exempt from prior CNIL formalities.
- Non-internal health studies require prior compliance declarations or CNIL authorization, while internal studies must adhere to standard GDPR documentation and patient notice rules.
- Internal research results may be published or used in academic works if access to health data remains restricted to the care team or if data is genuinely anonymized under EDPB guidelines.
# Understanding Compliance Obligations for Internal Health Research in France
Healthcare establishments and medical professionals conducting internal health research projects using patient data face specific regulatory requirements under French law and European Union data protection standards. To clarify these regulatory obligations, the French Data Protection Authority (Commission Nationale de l'Informatique et des Libertés, or CNIL) has published guidance reminding healthcare professionals of the criteria, exemptions, and compliance steps governing internal research activities.
This guide explains what qualifies as an internal research project, the regulatory formalities required by CNIL, the obligations regarding patient notification and rights, and the conditions under which research results may be published or utilized for academic purposes such as dissertations or theses.
---
## 1. What Defines an "Internal Research" Project?
Under the guidance issued by CNIL, a health research project or internal study ("recherches internes" or "études internes") must strictly fulfill three cumulative conditions to receive that legal qualification:
1. **Origin of Data**: The research must be carried out using personal health data collected during the individual medical care and follow-up of the concerned patients.
2. **Personnel Involved**: The research must be conducted by the healthcare personnel who actively provide this care and follow-up. For the precise concept of a "care team" (*équipe de soins*), reference is made to Article L 1110-12 of the French Public Health Code (*Code de la santé publique*).
3. **Exclusive Use**: The research must be conducted for the exclusive use of these specific healthcare personnel.
If a project fails to satisfy any one of these three cumulative criteria, it cannot be categorized as internal research, and different procedural obligations apply.
---
## 2. Regulatory Formalities and CNIL Requirements
### Exemption from Prior Formalities
Projects that satisfy all three criteria for internal research are **not** required to undergo prior formalities or submit prior authorization requests to CNIL.
However, exemption from prior filings does not exempt organizations from general compliance obligations under the EU General Data Protection Regulation (GDPR). Healthcare entities must still satisfy general data protection mandates, which include:
- **Internal Documentation**: Recording the processing activity in the entity’s processing register (*registre des traitements*).
- **Data Protection Impact Assessment (DPIA)**: Conducting a DPIA (*analyse d'impact relative à la protection des données*) where required by law.
- **Information Obligations**: Informing patients whose data is being processed for research.
### Requirements for Non-Internal Research Projects
If a health research project does not strictly meet the three criteria for internal research, prior formalities with CNIL become mandatory. In such scenarios, the processing entity must submit either:
- A **compliance declaration** (*déclaration de conformité*) aligning with an existing standard framework (*référentiel*); or
- A **prior authorization request** (*autorisation préalable*) from CNIL, following an opinion from the relevant competent committee, if the project does not fully comply in all respects with an existing reference framework.
Importantly, a compliance commitment to a reference framework does not need to be submitted for every single research project. A single commitment covers all processing activities carried out by the same data controller that fall within the scope of that specific framework.
---
## 3. Patient Information and Participant Rights
### Information Obligations (Articles 12 to 14 GDPR)
Internal health research projects remain subject to the information principles laid down in Articles 12, 13, and 14 of the GDPR. Patients must receive information regarding the processing of their health data in a concise, transparent, understandable, and easily accessible format.
CNIL recommends implementing a **tiered information approach**:
- **First-Level Information**: Directly provided to each patient individually, for example through an information notice systematically handed to patients attending follow-up care within the establishment.
- **Second-Level Information**: Accessible via the first-level notice, such as detailed information posted on the establishment's transparency portal.
While individual notification is the required principle, an exception permits **collective information** (such as displays posted within the facility premises or announcements in the press). This exception applies strictly when individual notification would require disproportionate effort—considering factors such as the number of individuals concerned, the cost of notification relative to the organization's resources, or the accessibility of participant contact details.
### Participant Rights and the Right to Object
Participants in internal research projects retain their data protection rights under Articles 12 and following of the GDPR. Crucially, the **right to object** under Article 21 of the GDPR applies directly to internal health research processing activities. Patients must be informed of and permitted to exercise their right to object to the use of their data for such internal studies.
---
## 4. Academic Use, Publication, and Anonymization
### Publication of Research Results and Dissertations
There is no inherent incompatibility between the classification of a project as internal research and the publication of its results or its use by a researcher in an academic thesis or dissertation. However, organizations and researchers must observe two key compliance checkpoints:
1. **Restricted Data Access**: Access to participant health data must remain strictly restricted to the care team unless the data has been fully anonymized.
2. **Distinction Between Anonymization and Pseudonymization**: Pseudonymized data remains personal data subject to legal regulation. In contrast, genuinely anonymized data falls outside the scope of both the GDPR (Recital 26) and the French Data Protection Act (*loi Informatique et Libertés*). The anonymization process must ensure that the data subject is not, and can no longer be, identifiable. CNIL references the European Data Protection Board (EDPB / CEPD) Guidelines 02/2026 on anonymization, which were placed under public consultation until October 30, 2026.
While the "exclusive use" condition does not prohibit sharing research outcomes to inform the public and the scientific community, a research project's sole objective cannot be the mere transmission of its results or anonymized data to third parties.
---
## 5. Frequently Asked Questions (FAQ)
**Q1: Do internal health research projects require prior approval or submission to CNIL?**
**A:** No. Internal health research projects that meet all three cumulative criteria are exempt from prior formalities with CNIL. However, general GDPR obligations (such as maintaining a processing register and providing patient notices) still apply.
**Q2: What happens if a health study does not fulfill all criteria for internal research?**
**A:** The project must complete prior formalities before implementation. This involves either submitting a compliance declaration under an existing CNIL reference framework (*référentiel*) or obtaining prior authorization from CNIL after review by a competent committee.
**Q3: Can individual patient notification be replaced by general public notices?**
**A:** Individual notification is the general rule. Collective notification (e.g., posters or press notices) is allowed only as an exception when individual notification demands disproportionate efforts, strictly evaluated based on patient numbers, costs, and contact accessibility.
**Q4: Is it permissible to publish results from internal research in a medical thesis or journal?**
**A:** Yes. Publishing results or using them in a thesis is compatible with internal research, provided data access remains limited to the care team or the data is fully anonymized, and provided the project's sole purpose was not merely transferring data to third parties.
Who May Be Affected
Healthcare professionals, hospitals, medical research institutions, and care teams in France processing patient data for internal health studies.
Cross-Border Context
Applies within France as an EU Member State under the EU General Data Protection Regulation (GDPR) framework.
What to check next
- Verify whether internal health studies strictly meet the three cumulative criteria set by CNIL.
- Check compliance with GDPR processing register, DPIA requirements, and patient notification protocols.
- Review EDPB Guidelines 02/2026 on anonymization regarding public consultation details and anonymization vs. pseudonymization standards.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.