Recital 28

In order to assess whether scientific research activities meet the conditions of scientific research for the purpose of Regulation (EU) 2016/679, account can be taken of elements such as the purpose of the research, the methodological approach and ethical standards applied in the specific area while conducting the research, and adherence to the principles of transparency, reliability, accountability, oversight, verifiability, and rules for research integrity. Transparency could, among other things, involve making research results publicly available with due regard to legitimate limitations to access such as protection of intellectual property and trade secrets. Scientific research activities should be conducted autonomously and independently, free from undue pressure and contribute to the growth of society's general knowledge and wellbeing. This does not exclude that the outcome of scientific research activities may also aim to further commercial or private interests.

It is important that processing for scientific research activities prevent individuals from being subjected to harm or other adverse effects due to their participation in scientific research and respect, amongst others, human autonomy and, to the extent necessary, the notion of consent to participate in research should be used as a safeguard and is to be considered distinctively from consent under Regulation (EU) 2016/679. Scientific research can, amongst others, be part of and support innovation, such as technology or medical development. The fact that scientific research activities are to be conducted autonomously and independently does not exclude that such activities can be mandated and conducted by public authorities or private entities, including small and medium sized undertakings, in academic, industry and other settings . The outcome of scientific research may be applied for public interest, private or commercial purposes.

The qualification of processing as being carried out for scientific research purposes should be assessed and substantiated by the controller on a case-by-case basis, considering the objective characteristics of the research activity, and should not undermine the obligation to apply appropriate safeguards as provided for in Article 89 of Regulation (EU ) 2016/679.