By way of four deliberations dated 19 March 2026, the French data protection authority (CNIL) has updated two of its reference methodologies governing the processing of personal data carried out in the context of health research :
- MR-001, relating to processing operations carried out in the context of health research requiring the collection of consent 1 ; and
- MR-003, relating to processing operations carried out in the context of health research not requiring the collection of consent 2 .
These updates follow the needs expressed by stakeholders in the health sector during the public consultation conducted by the French data protection authority in 2024, which in turn reflect the significant developments that have taken place within the field of health research. The principal amendments made to these methodologies include, among other things, an expansion of their scope of application to cover research conducted abroad, the addition of certain categories of personal data, and
