European Health Data Space: What Irish Healthcare Organisations Should Know

The European Health Data Space (EHDS) is an EU framework for how electronic health data is used and shared, and it will matter to Irish healthcare organisations over the coming years. It is Regulation (EU) 2025/327, published in March 2025. According to the Commission, key implementing acts are due by March 2027 and the main primary and secondary use rules start in March 2029 and March 2031. This guide sets out, in plain terms and only from official pages, what the Regulation is, what the published timeline says, what Ireland has said about implementation, and how a hospital, nursing home, disability service or GP practice can start preparing. Because health data is special category data, the work sits alongside what you already do under the GDPR; our guide to GDPR and special category health data covers that base layer.

What the EHDS is

According to the European Commission's EHDS page (it shows no last-updated date; the newest item listed is dated 8 July 2026), the EHDS is the first sector-specific common EU data space. It sets a common framework for using and exchanging electronic health data across the EU. The Commission describes three aims: giving individuals more access to and control over their health data, allowing certain data to be reused for public interest, policy and research purposes, and creating a harmonised framework for electronic health record (EHR) systems.

The Commission's publication page for the Regulation shows a publication date of 5 March 2025. Ireland's Department of Health press release of the same date (last updated 10 March 2025) says the Regulation enters into force on 26 March 2025 and takes direct effect in all Member States.

Primary use and secondary use

The EHDS separates two kinds of use, and it helps to keep them apart when you plan.

• Primary use is using and sharing health data to deliver healthcare, including across borders when a person travels. The Commission says patients can restrict health professionals' access to all or parts of their data.
• Secondary use is reusing health data for research, innovation, policy-making and regulatory activities. The Commission says this requires a permit from a health data access body, that individuals can opt out in a simple, reversible way, and that using data for decisions that are detrimental to people, or for marketing, is prohibited. Its page on reuse of health data also refers to controlled, high-security processing environments.

Primary use concerns the delivery of care and the records staff create and read. Secondary use concerns reuse of data, and the Commission's FAQ says providers that are controllers of personal electronic health data are health data holders (see below).

The timeline as published

The Commission's EHDS page gives the following milestones. We repeat them as read; the Regulation and its implementing acts are still being developed, so check the current position before you plan around any date.

The Department of Health press release adds that Member States must appoint three authorities by the first quarter of 2027: a Digital Health Authority, a Health Data Access Body and a Market Surveillance Authority.

What the Commission says about healthcare providers

The Commission has published a Frequently Asked Questions document (version 1.1, last updated 26 March 2026). It states that it contains the Commission's preliminary views, not an official position, and that only the Court of Justice of the EU can interpret EU law authoritatively. With that caveat, the FAQ says:

• Member States must ensure providers are connected to the required primary-use infrastructure.
• Providers must be able to export and import data in the European electronic health record exchange format. How they achieve this is up to them: existing systems may be upgraded, or a translation tool may be used.
• Providers are not required to digitise paper documents.
• Health professionals should access only the data strictly necessary and justified for a given health service.
• Providers that are controllers of personal electronic health data are health data holders for secondary use, while entities acting only as processors are not. A micro-enterprise is generally excluded from the duty to make data available, unless national law extends it.

The FAQ also describes patient rights: free access to priority categories through a health data access service, the ability to add information (clearly distinguished from professional entries), to request rectification, to receive data in the exchange format, and to restrict who sees data, with a "breaking the glass" mechanism for emergencies. Opting out of secondary use is available to all individuals and applies to future permits and requests, not retroactively.

EHR systems and logging

The FAQ says EHR systems must include two harmonised components: an interoperability component and a logging component that supports transparency about who accessed data. The FAQ says systems must pass tests in the European digital testing environment, bear the CE marking and be registered in a publicly accessible database. For a provider this makes procurement questions worth asking early: is your current or planned record system on a path to meet these requirements, and who at the supplier can tell you?

What Ireland has said

The government's HealthData@IE page describes a national project, running 2023 to 2027 and funded through the EU4Health programme, to set up health data access services in Ireland; the page says each Member State will be required to establish a Health Data Access Body. It is delivered by the Department of Health, HIQA and the Health Research Board. The page says the Health Information Bill is the first of several planned Irish laws to implement the EHDS. It shows no last-updated date; the most recent item listed is dated 1 December 2025. The Department's press release links implementation to the Digital for Care framework and mentions the HSE Health App and the procurement of a Shared Care Record, and the national AI for Care strategy page also refers to preparing for the EHDS. Neither page tells providers what they must do in practice yet, and we have not seen a published Irish compliance checklist for individual services.

How the EHDS sits with the GDPR

The Commission's FAQ says the EHDS gives patients rights in addition to the GDPR; for example, its data portability right applies whatever the legal basis for processing and covers provided, observed and inferred data. The Data Protection Commission describes health data as special category data under Article 9 of the GDPR, which is generally prohibited to process except in limited circumstances. Nothing we read suggests your existing data protection duties fall away. Staff who handle records will need to understand both layers, which is a reason to keep your GDPR training for healthcare staff current.

A practical approach to preparing

The following steps are our suggestions, not requirements from any of the sources above.

• Map your systems. List where electronic patient or service-user data is created and stored, and who supplies each system.
• Ask suppliers early. Ask how and when each EHR supplier expects to meet the interoperability and logging requirements, and what they will tell you about CE marking and registration.
• Review access. The FAQ expects access to be limited to what is strictly necessary. Check that role-based access and audit trails already work.
• Prepare to explain patient rights. Decide who in your service will handle questions about access, restriction and opt-out once national arrangements are published.
• Protect the systems. More connected records raise the value of strong security; see our guide to cyber security awareness training for healthcare staff.
• Watch official sources. Check the Commission's EHDS page and the Department of Health for updates on implementing acts and Irish legislation.

What we could not confirm

We could not open the full text of the Regulation on EUR-Lex, so this guide does not quote articles or recitals. We have not seen a published Irish timetable for the Health Information Bill, and we do not state one. Treat the dates above as the Commission's published milestones, not as Irish deadlines for your service.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is the EHDS already in force in Ireland?

The Regulation entered into force on 26 March 2025 and applies directly in all Member States, according to the Department of Health. Most obligations apply later, on the staged dates published by the Commission.

Does the EHDS mean we must digitise paper records?

The Commission's FAQ says providers are not required to digitise paper documents. It does expect providers to be able to export and import data in the European exchange format.

Does it replace the GDPR?

No. The Commission's FAQ says the EHDS gives patients additional rights beyond the GDPR. DPC guidance on special category data continues to apply; check with your data protection officer.

Who decides how Ireland implements it?

Member States must appoint national authorities and legislate where needed. The Department of Health says a Health Information Bill is planned, and the HealthData@IE project is setting up health data access services in Ireland. Check gov.ie for the current position.

What should a small practice do now?

Keep your records and access controls in good order, ask your software supplier about its plans, and follow official updates. Smaller services should also check the FAQ's point on micro-enterprises and whether national law changes it.

The EHDS is a long-running programme, not a single deadline. Organisations that understand their data, their systems and their suppliers now will find each later milestone easier to meet.