Privacy / Security / Platforms
Spanish and Greek data protection authorities publish joint guide on secure processing environments
The AEPD and the Hellenic DPA say providers of secure processing environments must keep real, effective control even when third parties run the infrastructure; contracts and certifications alone are not enough.
Spain’s AEPD has published a guide on secure processing environments (SPEs) from a data protection perspective, written jointly with the Hellenic Data Protection Authority. Experts from Eurostat, Spain’s digital ministry, Italy’s Garante and the UK ICO contributed. It is available in English and Spanish.
SPEs let users access and process sensitive data, such as health data, without receiving or downloading it. The AEPD notes that the European Health Data Space Regulation makes SPEs mandatory for secondary use of health data, such as research and policymaking. The guide stresses that the SPE provider must retain real and effective control over infrastructure and processing, backed by technical measures, oversight and audit capability, and recommends avoiding single-supplier dependence.
It offers a risk methodology combining the 10 LIINE4DU threat categories with the Five Safes framework, reviews privacy engineering techniques, includes a six-phase health research case study, and states that a DPIA is generally mandatory.
Why it matters
Organisations building or relying on SPEs for health or other sensitive data should check that outsourcing contracts give them genuine technical oversight and audit rights, since the authorities say certifications and contractual guarantees alone do not suffice. Teams should review supplier concentration and sovereignty risks within their risk assessment, and confirm a DPIA exists for SPE processing. Data stewards supporting research access can use the Five Safes and LIINE4DU methodology to structure access controls and output checks.
Status: Published. Joint AEPD–Hellenic DPA guide, published in English and Spanish
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Institutions
Who should care
- DPO
- CISO
- Data stewards
- Legal & compliance