The first session of the INDICATE Training Programme on Legal Framework kicked off! These sessions are running in parallel with and complementing the ongoing Data Models sessions.

This training programme provides participants a comprehensive understanding of the INDICATE legal framework, covering General Data Protection Regulation (GDPR) and European Health Data Space (EHDS) principles. The sessions focus on data protection and privacy-enhancing technologies, governance and rulebook structures, and practical skills to navigate data access processes, requirements, and organizational challenges within INDICATE. 

The first session, led by Ricard Martínez Martínez (Universitat de Valencia), explored how law, technology, and organisation together shape the use of health data in research. A key message was that rules are important, but it is not enough on its own. Trust and responsibility are just as important.

Several important topics were discussed:

• Trust and reputation matter in research. It is not only about following the law. Organisations must also show clearly that they handle data in a responsible way. Without trust, collaboration and research can be at risk.
• Clear governance and roles are essential. In complex data systems, it must be clear who is responsible for what. Researchers, project managers, data protection officers, and platform teams all have different roles. Without clear responsibilities, risks increase.
• Anonymisation is more complex than it seems. Making data truly anonymous is not easy. It requires continuous risk assessment, technical measures, and careful monitoring to reduce the risk of re-identification.
• Balancing innovation and privacy. In healthcare research, there is a need to learn from data while protecting patient privacy. Data minimisation does not mean using as little data as possible, but using the right data for a clear purpose.
• Privacy-enhancing technologies are becoming essential. New technical solutions allow researchers to analyse data without directly accessing raw data. This helps protect privacy while still enabling valuable research.

The session also highlighted that European developments, including the European Health Data Space and emerging AI regulations, will strongly shape how health data research is organised in the coming years. Active engagement from the research community is therefore essential.

A key takeaway from the session is that legal rules and regulations, technical design, security, and ethics are deeply connected. Real progress in health data research happens when all of these elements work together, supported by a strong culture of responsibility and trust.

The INDICATE project receives funding from the European Union’s Digital Europe Programme under Grant Agreement number 101167778.