Skip to main content
Regulation

European Health Data Space (EHDS)

The European Health Data Space Regulation is Regulation (EU) 2025/327. It applies from 26 March 2027, with patients' rights and EHR system rules from 26 March 2029 and 2031. The Netherlands plans a new Gezondheidsdata-autoriteit through the draft Wet GIS.

6 min read

When does the EHDS apply, and what has to be ready by 26 March 2027?

The European Health Data Space Regulation, Regulation (EU) 2025/327, has been in force since 25 March 2025 and applies from 26 March 2027. That first date mostly binds governments. By then each Member State must tell the Commission which digital health authority and which health data access body it has designated, and which penalties apply. The rules that reach hospitals, software makers and researchers come later: patients' rights and the core rules for EHR systems start on 26 March 2029 for patient summaries, electronic prescriptions and dispensations, and on 26 March 2031 for medical images, test results and discharge reports. The secondary-use rules in Chapter IV apply from 26 March 2029.

The Netherlands has no implementing act yet. As at 13 October 2026 the Wet op het gezondheidsinformatiestelsel (Wet GIS) is a draft bill. Its consultation closed on 8 July 2026, and it creates a new independent body, the Gezondheidsdata-autoriteit, to carry the EHDS authority roles. The government expects to send it to the Tweede Kamer in the first quarter of 2027.

Last updated: 13 October 2026. Checked against the Official Journal texts of Regulation (EU) 2025/327 and Implementing Regulations (EU) 2026/2083 and 2026/2098, the Dutch consultation page and the government's letters to both chambers.

At a glance

Official title

Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847

CELEX

32025R0327 · no amending act listed on EUR-Lex as at 13 October 2026

OJ

OJ L, 2025/327, 5.3.2025

In force

25 March 2025, the twentieth day after publication (Article 105)

Applies

From 26 March 2027, with later dates in 2029, 2031 and 2035 for named articles (Article 105)

Type

A regulation, so there is nothing to transpose. Member States still designate the authorities and set the penalties.

Who it reaches

Patients, healthcare providers, manufacturers, importers and distributors of EHR systems, makers of wellness applications that claim interoperability, health data holders and health data users

Implementing acts found as at 13 October 2026

Implementing Regulation (EU) 2026/2083 on MyHealth@EU and Implementing Regulation (EU) 2026/2098 on dataset metadata, both in force since 11 October 2026

Supervisor (NL)

The draft Wet GIS gives the EHDS authority roles to a new Gezondheidsdata-autoriteit, market surveillance of EHR systems to the IGJ and the privacy aspects to the Autoriteit Persoonsgegevens

Dutch implementing act

Draft Wet op het gezondheidsinformatiestelsel (Wet GIS). Consultation ran from 27 May to 8 July 2026; submission to the Tweede Kamer is expected in the first quarter of 2027

Who is in scope of the EHDS?

The EHDS reaches anyone who records, builds systems for, holds or reuses electronic health data in the EU. It sorts them by role, and one organisation can hold several roles at once.

  • Patients get rights over their own electronic health data in Articles 3 to 10, starting with free and immediate access.
  • Healthcare providers register the priority categories of data in an EHR system (Article 13) and give health professionals access through the services in Articles 11 and 12.
  • Manufacturers, importers and distributors of EHR systems carry the product duties in Chapter III (Articles 30 to 33). Article 26(2) also catches EHR systems built and used inside a health institution and EHR systems offered as a service.
  • Makers of wellness applications that claim interoperability with an EHR system must label them (Article 47).
  • Health data holders make their data available for secondary use. Article 2(2), point (t), defines them broadly: bodies in the healthcare or care sectors including reimbursement services where necessary, developers of products or services for those sectors, wellness app makers, researchers and mortality registries. Individuals and microenterprises are exempt under Article 50(1) unless national law brings them back in (Article 50(2)).
  • Health data users are those who hold a data permit or an approved data request from a health data access body (Articles 68 and 69).

Financial firms meet the EHDS from two sides. A health insurer that processes health data to reimburse care can fall within the definition of health data holder through the words "including reimbursement services where necessary". And any firm that obtains EHDS data as a health data user may not use it to exclude people from an insurance or credit contract, or to change their premiums or loan conditions (Article 54, point (b)). Whether a Dutch zorgverzekeraar counts as a holder depends on how the Netherlands reads "where necessary", and we have not seen a Dutch position on that.

What does the EHDS require?

The duties differ by role. Each card names the article it comes from.

  • Articles 3 to 10

    Patients' rights

    Patients can see their priority data free of charge, immediately after it is registered in an EHR system (Article 3(1)). They can add information, ask for corrections, move their data, restrict access and see who accessed it. Member States may let patients opt out of primary use (Article 10).

  • Articles 13 to 15

    Priority data in a common format

    Six priority categories (patient summaries, electronic prescriptions, electronic dispensations, medical images, test results and discharge reports) are exchanged in the European electronic health record exchange format. The Commission lays down its technical specifications by implementing act by 26 March 2027 (Article 15(1)).

  • Chapter III

    EHR systems

    An EHR system carries two mandatory harmonised software components, one for interoperability and one for logging (Article 1(2), point (b)). The manufacturer declares conformity itself, affixes the CE marking and registers the system in the EU database (Articles 39, 41 and 49).

  • Articles 50, 51 and 60

    Data holders share for secondary use

    Holders make the categories in Article 51(1) available, from EHR data to genetic data, wellness app data and clinical trial data. They hand requested data to the health data access body within three months of its request; the body may extend that by up to three months (Article 60(2)).

  • Articles 53 and 54

    Permitted and prohibited reuse

    Access is granted only for the purposes in Article 53(1), such as public health, research and statistics. Article 54 bars detrimental decisions about individuals, insurance and credit decisions, advertising and marketing, and products that harm health.

  • Articles 63 and 64

    Fines by health data access bodies

    Breaches of the holder and user duties in Articles 60 and 61 carry fines up to EUR 10 million or 2 % of worldwide annual turnover (Article 64(4)). Prohibited uses and extracting personal data from a secure processing environment carry up to EUR 20 million or 4 % (Article 64(5)).

The dates

Every date below comes from the Official Journal or from the Dutch government's own publications. The dates in the regulation are set by law; the Dutch dates are the government's planning and can move.

2025

  1. 11 February 2025 · Set by law

    Regulation (EU) 2025/327 signed by the European Parliament and the Council

  2. 5 March 2025 · Set by law

    Regulation (EU) 2025/327 published in the Official Journal

  3. 25 March 2025 · Calculated

    The EHDS enters into force

    Article 105: the twentieth day after publication.

2026

  1. 24 April 2026 · Set by the Dutch government

    The government tells the Tweede Kamer the first EHDS bill will go to consultation in the first half of 2026 (Kamerstuk 36 825, nr. 7)

  2. 18 May 2026 · Set by the Dutch government

    Progress letter to the Eerste Kamer names the new body the Gezondheidsdata-autoriteit

  3. 27 May 2026 · Set by the Ministry of VWS

    Consultation on the draft Wet GIS opens

  4. 8 July 2026 · Set by the Ministry of VWS

    Consultation on the draft Wet GIS closes

  5. 21 September 2026 · Set by law

    Implementing Regulations (EU) 2026/2083 (MyHealth@EU) and 2026/2098 (dataset metadata) published in the Official Journal

  6. 11 October 2026 · Calculated

    Implementing Regulations (EU) 2026/2083 and 2026/2098 enter into force

    The twentieth day after publication.

2027

  1. First quarter of 2027 · Indicative: Dutch government, 24 April 2026

    The draft Wet GIS is sent to the Tweede Kamer

  2. 26 March 2027 · Set by law

    General date of application of the EHDS (Article 105)

  3. 26 March 2027 · Set by law

    Member States inform the Commission of their digital health authorities (Article 19) and health data access bodies (Article 55), and notify their penalty rules (Article 99)

  4. 26 March 2027 · Set by law

    Commission implementing acts due on data quality (Article 13(4)), the exchange format (Article 15(1)), MyHealth@EU (Article 23), common specifications for EHR systems (Article 36(1)) and the secondary-use infrastructure (Articles 70, 73, 75, 77 and 78)

  5. 26 March 2027 · Set by law

    Articles 55(6), 70, 73(5), 75(1) and (12), 77(4) and 78(6) apply, and Implementing Regulation (EU) 2026/2083 on MyHealth@EU applies

2028

  1. Early 2028 · Indicative: Minister for Long-term Care, Youth and Sport, 18 May 2026

    The Wet GIS enters into force

    The minister's letter gives "planning begin 2028".

2029

  1. 26 March 2029 · Set by law

    Patients' rights (Articles 3 to 15), MyHealth@EU (Article 23(2) to (6)) and the rules for EHR systems and wellness applications (Articles 25 to 27 and 47 to 49) apply to patient summaries, electronic prescriptions and electronic dispensations, and to EHR systems meant to process them

  2. 26 March 2029 · Set by law

    Chapter IV on secondary use applies, with the implementing acts under Articles 70, 73(5), 75(12), 77(4) and 78(6), and Implementing Regulation (EU) 2026/2098 on dataset metadata

  3. 26 March 2029 · Set by law

    Member States notify any national law that extends data holder duties or assigns them to intermediation entities (Article 50(4))

2031

  1. 26 March 2031 · Set by law

    The same primary-use rules apply to medical images, test results and discharge reports, and to EHR systems meant to process them

  2. 26 March 2031 · Set by law

    Chapter III applies to EHR systems put into service under Article 26(2): systems built in-house by health institutions and systems offered as a service

  3. 26 March 2031 · Set by law

    Secondary use extends to the categories in Article 51(1), points (b), (f), (g), (m) and (p), including genetic and other omics data, clinical trial data and research cohorts

    Article 14 of Directive 2011/24/EU is deleted on the same date (Article 103).

2032

  1. 26 March 2032 · Set by law

    Commission guidelines on enforcement by health data access bodies (Article 63(8))

2033

  1. 26 March 2033 · Set by law

    Commission targeted evaluation of the EHDS (Article 102(1))

2035

  1. 26 March 2035 · Set by law

    Article 75(5) applies, and the Commission completes its overall evaluation (Article 102(2))

Without an official date

  1. No fixed date · Calculated

    Amended characteristics of the priority categories apply one year after each delegated act under Article 14(2) that amends Annex I (Article 105, point (c))

  2. No official date · Proposed (draft Wet GIS)

    The Gezondheidsdata-autoriteit is established in law

Who supervises the EHDS in the Netherlands?

As at 13 October 2026 nothing is designated in law. The table shows what the draft Wet GIS proposes, as the Ministry of VWS described it when the consultation opened.

Role under the EHDSArticleNetherlands, draft Wet GIS

Digital health authority

Article 19

Gezondheidsdata-autoriteit (new independent body)

Health data access body

Article 55

Gezondheidsdata-autoriteit

National contact point for secondary use

Article 75

Gezondheidsdata-autoriteit

Market surveillance of EHR systems

Article 43

IGJ

Data protection supervision of citizens' rights and privacy aspects

Articles 22 and 65

Autoriteit Persoonsgegevens

What has changed recently?

11 October 2026. Implementing Regulation (EU) 2026/2083 on MyHealth@EU and Implementing Regulation (EU) 2026/2098 on dataset metadata entered into force. They apply from 26 March 2027 and 26 March 2029 respectively.

21 September 2026. Both implementing regulations, adopted on 18 September 2026, were published in the Official Journal. 2026/2098 fixes the minimum metadata a health data holder gives when describing a dataset, under Article 77(4).

8 July 2026. The consultation on the draft Wet GIS closed. As at 13 October 2026 the consultation page shows 41 public responses.

18 May 2026. The minister's progress letter to the Eerste Kamer named the new body the Gezondheidsdata-autoriteit and planned the Wet GIS for early 2028.

24 April 2026. In Kamerstuk 36 825, nr. 7 the government said the Tweede Kamer should receive the first EHDS bill in the first quarter of 2027.

Map the EHDS dates onto your organisation

Book a working session and we will go through Articles 2, 50 and 105 with you role by role, naming the article and the source for each conclusion.

Book a working session

Questions and answers

When does the EHDS apply?

The EHDS, Regulation (EU) 2025/327, applies from 26 March 2027. Patients' rights and the rules for EHR systems apply from 26 March 2029 for patient summaries, electronic prescriptions and electronic dispensations, and from 26 March 2031 for medical images, test results and discharge reports. The secondary-use rules in Chapter IV apply from 26 March 2029, with some data categories following on 26 March 2031.

Does the EHDS need to be transposed into Dutch law?

No. The EHDS is a regulation and applies directly. The Netherlands still needs a law to designate its authorities, set penalties and make choices the regulation leaves to Member States. As at 13 October 2026 that law, the Wet op het gezondheidsinformatiestelsel, is a draft bill.

Who will supervise the EHDS in the Netherlands?

The draft Wet GIS creates a new independent body, the Gezondheidsdata-autoriteit, to act as digital health authority, health data access body and national contact point for secondary use. It gives market surveillance of EHR systems to the Inspectie Gezondheidszorg en Jeugd and the privacy aspects to the Autoriteit Persoonsgegevens. None of this is law as at 13 October 2026.

Can an insurer or a bank use health data obtained under the EHDS?

Not to decide on insurance or credit. Article 54, point (b), of the EHDS prohibits using data obtained through a data permit or an approved data request to exclude people from an insurance or credit contract, or to change their premiums, contributions or loan conditions. Advertising and marketing are prohibited too.

Can patients opt out of the EHDS?

Patients can opt out of the secondary use of their data at any time and without giving a reason, and can reverse that choice (Article 71(1) of the EHDS). An opt-out from primary use, meaning access by health professionals, exists only where national law provides for it (Article 10). As at 13 October 2026 we have not seen the Dutch choice on primary use.

Do small organisations have to share health data for secondary use?

Under Article 50(1) of the EHDS, individuals, including individual researchers, and microenterprises are exempt from the duties of health data holders. A Member State may still extend those duties to them by national law and must notify such a law to the Commission by 26 March 2029.

What are the fines under the EHDS?

Health data access bodies can fine a holder or user that breaches Article 60 or Article 61(1), (5) or (6) up to EUR 10 million or 2 % of worldwide annual turnover, whichever is higher. Prohibited uses, extracting personal data from a secure processing environment and similar breaches carry up to EUR 20 million or 4 % (Article 64). Member States set the other penalties and notify them by 26 March 2027 (Article 99).

How does the EHDS relate to the Wegiz?

The Dutch Wegiz requires third-party certification of EHR systems. The EHDS relies on the manufacturer's self-assessment, so the draft Wet GIS prepares a switch from certification to self-assessment before the EHDS rules for EHR systems start on 26 March 2029.