The AEPD and the Hellenic Data Protection Authority publish a joint guide on secure processing environments
- These environments are a guarantee for the re-use of sensitive data, in particular health data, since the data are processed without leaving a controlled environment
- Both authorities stress that the entity providing the environment must retain real and effective control, including where it relies on third parties
- The guide includes a risk analysis methodology together with a catalogue of measures, an analysis of data protection engineering techniques and a case study on health research developed in phases
- Access the guide in English and in Spanish
(5 November 2026). The Spanish Data Protection Agency (AEPD) has published the guide Secure Processing Environments from the Data Protection Perspective , jointly prepared with the Hellenic Data Protection Authority (HDPA). The document has benefited from the collaboration of experts from Eurostat, the General Directorate of Data of the Ministry for Digital Transformation and Public Service, the Italian Data Protection Authority (Garante per la protezione dei dati personali) and the United Kingdom’s Information Commissioner’s Office (ICO). The fact that it has been drawn up by two data protection authorities, together with the collaboration of national and international experts, reinforces the international dimension of the guide.
Secure processing environments (SPEs) are infrastructures that allow protected or sensitive data, such as health data, to be accessed and processed without the user receiving or downloading them. They are a key component of the Data Governance Act and the European Health Data Space Regulation. The latter provides that access to health data for secondary use, for purposes such as research, innovation or policy-making, must necessarily take place through an SPE. For citizens, these environments are the guarantee that their health data can be re-used while protecting their rights and freedoms.
The guide offers guidance to controllers, data protection officers, advisers and third parties involved in the design, deployment and operation of these environments. The document stresses that an SPE relies on a set of legal, organisational and technical measures that goes beyond conventional cybersecurity, and that data protection principles must be built into it by design. It also explains that these environments make it possible to move from the traditional concept of sharing data, with the transfer of data that this entails, to that of accessing data, in which the user accesses the data without the need to transmit them.
One of the aspects highlighted by both authorities is that the entity providing the SPE must have real and effective control over the infrastructure and the processing operations, even where the infrastructure is provided by a third party. Contractual guarantees or certifications are not sufficient on their own: they must be backed by technical measures, oversight and a genuine capacity to audit. In this regard, the guide recommends avoiding dependence on a single provider and the concentration of technical control.
The guide also addresses comprehensive risk management, including dependence on providers and digital sovereignty. Such management must go beyond conventional cybersecurity and data protection risks, adopting an approach that also covers risks related to intellectual property, trade secrets or national security, among others. To this end, it puts forward a risk analysis methodology that combines the ten LIINE4DU threat categories with the Five Safes framework. The document also reminds readers that the data protection impact assessment (DPIA) is, as a general rule, mandatory for such processing operations.
Furthermore, the guide analyses data protection engineering techniques and includes a case study on health research developed in six steps.
This guide is an example of AEPD Abierta (“Open AEPD”), the initiative set out in its Strategic Plan 2025–2030. The collaboration with the Hellenic authority, together with the contributions of other national and international institutions, shows how dialogue and knowledge exchange translate into useful resources for controllers, professionals and citizens.