AEPD and the Hellenic authority publish a joint guide on secure processing environments for reusing sensitive data
Joint AEPD-HDPA guide on secure processing environments (SPE): keys for controllers, DPOs and advisers on reuse of sensitive and health data.
The Spanish Data Protection Agency (AEPD) and the Hellenic Data Protection Authority (HDPA) have published a joint guide on secure processing environments (SPE), the infrastructures that allow access to protected or sensitive data —in particular health data— and process them without the user receiving or downloading them. The guide, released on 5 November 2026, was produced with the collaboration of experts from Eurostat, the Directorate-General for Data of the Ministry for Digital Transformation and the Civil Service, the Italian Garante and the United Kingdom's Information Commissioner's Office (ICO).
A key piece of the European Health Data Space
SPEs are not a technical eccentricity: they are a key piece of the Data Governance Regulation and the European Health Data Space Regulation. The latter establishes that access to health data for secondary uses —research, innovation or policy-making— must obligatorily take place through a secure processing environment. For citizens, these environments are the guarantee that their health data can be reused while protecting their rights and freedoms.
The guide is available in English and Spanish, and its joint elaboration —two signing authorities, with contributions from Eurostat, the Directorate-General for Data, the Italian Garante and the ICO— places it as a European and not merely national reference.
From sharing data to accessing data
The guide is addressed to data controllers, data protection officers, advisers and third parties participating in the design, deployment and operation of these environments. One of its central ideas is that an SPE is a set of legal, organisational and technical measures that goes beyond conventional cybersecurity, and must incorporate data protection principles from the design stage.
The document also explains the conceptual leap these environments represent: they make it possible to move from the traditional model of sharing data —with the transfer that entails— to the model of accessing data, in which the user works on them without needing to transmit them. The difference is not terminological: in an SPE, the researcher consults and processes inside the controlled environment and takes away no copy.
A coordinated approach between authorities
The guide is the fruit of joint work by two data protection authorities —the Spanish and the Hellenic—, a cooperation with practical value: the processing environments offered by the large technology providers are the same for companies in all Member States, and convergent criteria between authorities reduce the interpretative fragmentation that so complicates compliance in multinational groups. The initiative follows the line of sectoral and technical guidance production that the AEPD has been maintaining, complementary to the European guidelines of the European Data Protection Board. It is, moreover, an example of AEPD Abierta, the initiative included in the Agency's 2025-2030 Strategic Plan, which seeks to turn dialogue and knowledge exchange with other institutions into resources useful to controllers, professionals and citizens.
Real and effective control by the environment provider
One of the points both authorities highlight is that the entity providing the SPE must maintain real and effective control over the infrastructure and the processing, also when it resorts to third parties to provide it. Contractual guarantees or certifications, on their own, are not enough: they must be backed by technical measures, supervision and real audit capacity. Along the same lines, the guide recommends avoiding dependence on a single provider and the concentration of technical control.
The requirement connects with the criterion the AEPD itself has just applied in its analysis on biometric data processing: documentation and objective justification of the controller's decisions are the axis of accountability, not a formal procedure.
Comprehensive risk management: beyond cybersecurity
The guide addresses comprehensive risk management, including provider dependence and digital sovereignty, with an approach that goes beyond the conventional risks of cybersecurity and data protection: it also contemplates risks related to intellectual property, trade secrets or national security. To that end it proposes an analysis methodology combining the ten threat categories of LIINE4DU with the Five Safes framework.
The document recalls, likewise, that the data protection impact assessment (DPIA) is, as a general rule, mandatory in these processing operations, and analyses data protection engineering techniques. It incorporates, finally, a practical case study in health research developed in six phases, conceived as an applicable path for organisations deploying an SPE.
The chain of responsibilities in the cloud
The underlying problem the guide addresses is known to any data protection adviser: in cloud services and collaborative environments, the boundary between controller, processor and joint controller blurs. The environment provider offers default configurations, sharing functionalities, analytics and logs that can turn it into something more than a mere processor if it decides partial means and purposes of the processing. The GDPR requires that delimitation to be documented —the Article 28 processing contract, the Article 26 joint controllership agreement— and the guide provides criteria to examine whether the control the client believes it has over the environment is real and effective or merely declaratory.
Why it matters for legal advice
For lawyers advising health entities, research centres, insurers or technology companies, the guide arrives at a decisive moment: the European Health Data Space will make the use of SPEs mandatory for secondary uses of health data, so the procurement of these environments will cease to be a technical option and become a regulatory requirement. The questions the guide puts on the table —who really controls the infrastructure, what happens with the provider's certifications, how the risk analysis is documented, when the DPIA is mandatory— are exactly those that contracts and compliance files must capture.
The publication is also an example of AEPD Abierta, the initiative included in the Agency's 2025-2030 Strategic Plan, and shows how cooperation between European authorities —two data protection authorities signing jointly, with contributions from other institutions— materialises into practical resources. For the firm, its immediate usefulness is double: as a checklist of requirements for clients operating or procuring an SPE, and as a reference for the criteria the Agency will apply when supervising these processing operations, in the same preventive line that guides advice on AI and data contracts and AI governance in the company.
Frequently asked questions
What is a secure processing environment (SPE)?
An infrastructure that allows access to protected or sensitive data —such as health data— and their processing within a controlled environment, without the user receiving or downloading them.
Who signs the guide?
The AEPD and the Hellenic Data Protection Authority, with collaboration from experts at Eurostat, the Directorate-General for Data, the Italian Garante and the British ICO.
When will SPEs be mandatory?
The European Health Data Space Regulation requires that access to health data for secondary uses —research, innovation, public policies— take place through an SPE.
Are the environment provider's certifications enough?
No. According to the guide, they must be backed by technical measures, supervision and real audit capacity on the part of the entity providing the environment.
Is the impact assessment mandatory in these processing operations?
The guide recalls that the DPIA is, as a general rule, mandatory for processing carried out in secure processing environments.
Sources
Fuentes
- Source. Accessed 9 November 2026.
The specific data in this article come from the official sources cited.
