Regulation · directly applicable · CELEX 32025R0327

EHDS

Q: What does the EHDS do?

Objective: Common rules, standards, infrastructures and a governance framework for access to electronic health data, both for the provision of healthcare and for secondary use, specifying the GDPR's rights for personal electronic health data and setting common rules for EHR systems.

Q: Who does the EHDS apply to?

Who it binds: Member State · Manufacturer · Health data holder · Health data user.

Q: What does the EHDS require?

Core obligations: EHDS Art. 3 · EHDS Art. 26 · EHDS Art. 60.

Q: When does the EHDS apply?

Key dates: Entry into force 25 March 2025 · Application date 26 March 2027 · Application date 26 March 2029 · Application date 26 March 2031.

Q: How is the EHDS enforced?

Sanction ceiling: 4% of global turnover / EUR 20m. Two tiers for fines imposed by health data access bodies: up to EUR 10 000 000 or 2 % of total worldwide annual turnover (Art. 64(4)) and up to EUR 20 000 000 or 4 % (Art. 64(5)), whichever is higher; the figure recorded is the upper tier. The GDPR's supervisory authorities enforce Arts 3 and 5–10 with fines up to Art. 83(5) GDPR (Art. 22); other penalties are left to Member States (Art. 99).

Regulation (EU) 2025/327 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847

Official text: Regulation (EU) 2025/327 of 11 February 2025 on the European Health Data Space (OJ L 2025/327, 5.3.2025)Tier 1 · primary law

Status: In force as of 28 October 2026
Key dates: 4 dated events
Competent authority: not established in this dataset
Sanction ceiling: 4% of global turnover / EUR 20m

In force since 25 March 2025, the twentieth day after publication (Art. 105; OJ L 2025/327, 5.3.2025). It applies from 26 March 2027, with later dates in 2029, 2031 and 2035 for the rights and services tied to priority categories of personal electronic health data, for EHR systems and for parts of the rules on secondary use (Art. 105). It also amends Directive 2011/24/EU (Art. 103) and the Cyber Resilience Act (Art. 104). Read on 28 Oct 2026 in the Official Journal text retrieved from the Publications Office's Cellar; the Publications Office's metadata records it in force from that date.

In short: what you need to know

Objective: Common rules, standards, infrastructures and a governance framework for access to electronic health data, both for the provision of healthcare and for secondary use, specifying the GDPR's rights for personal electronic health data and setting common rules for EHR systems.
Who it binds: Member State · Manufacturer · Health data holder · Health data user
Who it protects: not established
Core obligations: EHDS Art. 3 · EHDS Art. 26 · EHDS Art. 60 key provisions →
Key dates: Entry into force 25 March 2025 · Application date 26 March 2027 · Application date 26 March 2029 · Application date 26 March 2031 the timeline →
Sanction ceiling: 4% of global turnover / EUR 20mTwo tiers for fines imposed by health data access bodies: up to EUR 10 000 000 or 2 % of total worldwide annual turnover (Art. 64(4)) and up to EUR 20 000 000 or 4 % (Art. 64(5)), whichever is higher; the figure recorded is the upper tier. The GDPR's supervisory authorities enforce Arts 3 and 5–10 with fines up to Art. 83(5) GDPR (Art. 22); other penalties are left to Member States (Art. 99). enforcement →

What does the EHDS do?

Common rules, standards, infrastructures and a governance framework for access to electronic health data, both for the provision of healthcare and for secondary use, specifying the GDPR's rights for personal electronic health data and setting common rules for EHR systems.

Regulated actor: Member State · Manufacturer · Health data holder · Health data user
Protected party: not established
Territorial reach: not established
Implementation model: Directly applicable
Enforcement mechanism: not established

When does the EHDS apply? Key dates

Entry into force, application and transposition are different events and are kept apart. A date at month precision is shown as a month rather than invented as a day.

25 March 2025Entry into forceEntry into force
26 March 2027Application dateThe Regulation applies (Art. 105, second paragraph), except the provisions that Art. 105 phases in on later dates.
26 March 2029Application dateArticles 3 to 15, Article 23(2) to (6) and Articles 25, 26, 27, 47, 48 and 49 apply to the priority categories of personal electronic health data in Article 14(1), points (a) to (c) — patient summaries, electronic prescriptions and electronic dispensations — and to EHR systems intended to process them (Art. 105, third paragraph, point (a)). Chapter IV, on secondary use, applies, except the paragraphs Art. 105 dates otherwise (fifth paragraph).
26 March 2031Application dateThe same provisions apply to the priority categories in Article 14(1), points (d) to (f) — medical imaging studies and related imaging reports, medical test results and discharge reports — and to EHR systems intended to process them (Art. 105, third paragraph, point (b)). Chapter III applies to EHR systems put into service in the Union referred to in Article 26(2) (fourth paragraph), and Article 51(1), points (b), (f), (g), (m) and (p), apply (fifth paragraph).

The whole compliance calendar, filterable →

Who does the EHDS apply to?

No rules recorded

The applicability engine holds no rule for this instrument yet. Absence of a rule is absence of knowledge, not evidence that the instrument does not reach you.

Answer three questions instead →

What does the EHDS require? Key provisions

4 provisions recorded. This is what the dataset holds, not the whole instrument — an article that is not here has not been entered, which is a different statement from its not existing.

Article	Heading	Binds	Applies
Art. 3 load-bearing	Right of natural persons to access their personal electronic health dataNatural persons have the right to access at least their personal electronic health data in the priority categories of Article 14 that are processed for the provision of healthcare, through the electronic health data access services of Article 4, immediately after the data are registered in an EHR system, free of charge and in an easily readable, consolidated and accessible format (3(1)), and to download an electronic copy in the European electronic health record exchange format (3(2)). Member States must establish those access services (Art. 4(1)) and may restrict the rights in accordance with Article 23 of the GDPR (3(3)).	Member State	Applies from 26 March 2029 then from 26 March 2031: application date
Art. 26 load-bearing	Placing on the market and putting into serviceEHR systems may be placed on the market or put into service only if they comply with Chapter III (26(1)). EHR systems manufactured and used within health institutions established in the Union, and EHR systems offered as a service to a natural or legal person established in the Union, are considered put into service (26(2)). Member States may not prohibit or restrict the placing on the market of compliant EHR systems on account of the harmonised software components (26(3)). The obligations of manufacturers are set out in Article 30.	Manufacturer	Applies from 26 March 2029 then from 26 March 2031: application date
Art. 60 load-bearing	Duties of health data holdersHealth data holders make the electronic health data referred to in Article 51 available upon request to the health data access body, in accordance with a data permit or an approved health data request (60(1)), within a reasonable time and no later than three months from the receipt of the request by the body, which may extend that period by up to three months in justified cases (60(2)). They describe the datasets they hold for the dataset catalogue and check that description at least annually (60(3)).	Health data holder	Applies from 26 March 2029
Art. 64	General conditions for the imposition of administrative fines by health data access bodiesHealth data access bodies may impose administrative fines in addition to, or instead of, the enforcement measures of Article 63(3) and (4), having regard to the circumstances listed (64(2)). Infringements of the duties of health data holders and health data users under Article 60 and Article 61(1), (5) and (6) carry fines of up to EUR 10 000 000 or, for an undertaking, up to 2 % of its total worldwide annual turnover in the preceding financial year, whichever is higher (64(4)). Processing for prohibited uses, extracting personal electronic health data from secure processing environments, re-identification and non-compliance with enforcement measures carry fines of up to EUR 20 000 000 or 4 % (64(5)). Member States may decide whether fines may be imposed on public authorities and public sector bodies (64(6)).	not recorded	Applies from 26 March 2029

How is the EHDS enforced?

No enforcement recorded

This dataset holds no enforcement action under this instrument. That is what the record says; it is not a finding that none has been taken.

The whole enforcement observatory →

What is this page based on? Evidence and sources

Every statement this site makes about EHDS, graded by what actually carries it. The grade is derived from the claim type and its sources, never stored, so it cannot drift from what it describes.

The instrument record itself was last verified on 28 October 2026; every claim below carries its own date.

1 Primary law

Primary law law

The European Health Data Space Regulation, Regulation (EU) 2025/327, entered into force on 25 March 2025 and applies from 26 March 2027, with provisions on priority categories of health data and EHR systems phased in from 2029 and 2031.

Tier 1 · primary law states this

Regulation (EU) 2025/327 of 11 February 2025 on the European Health Data Space (OJ L 2025/327, 5.3.2025) — Publications Office of the European Union (Cellar) 5 March 2025 Art. 105; OJ L 2025/327 of 5.3.2025

Read it in the brief → Last verified 28 October 2026

The full bibliography and the evidence method →

How does the EHDS interact with other EU laws?

5 recorded interactions with other instruments — each with a direction, the provisions that carry it and its own sources. Direction is preserved as recorded: an instrument that amends another is not the same as one amended by it.

EHDS Amends CRA

The EHDS amends the Cyber Resilience Act: manufacturers of products with digital elements that are EHR systems demonstrate conformity with the CRA's essential requirements through the EHDS's own conformity assessment procedure (new Art. 32(5a) CRA), and Arts 13(4) and 31(3) CRA extend to those products.

Sources

Publications Office of the European Union (Cellar)Tier 1 · primary lawArt. 104, points (1)–(3)