{"id":125313,"date":"2026-11-06T11:37:26","date_gmt":"2026-11-06T10:37:26","guid":{"rendered":"https:\/\/ceadigilaw.org\/?p=125313"},"modified":"2026-11-06T11:37:34","modified_gmt":"2026-11-06T10:37:34","slug":"spanish-greek-authorities-joint-guide-secure-processing","status":"publish","type":"post","link":"https:\/\/ceadigilaw.org\/ar\/blog\/spanish-greek-authorities-joint-guide-secure-processing\/","title":{"rendered":"Spanish and Greek authorities issue joint guide on secure processing environments"},"content":{"rendered":"<div lang=\"en\" dir=\"ltr\">\n<div class=\"cea-blog-resumen\">\n<p><strong>In brief<\/strong><\/p>\n<ul>\n<li>On 5 November 2026 the AEPD, with the Hellenic Data Protection Authority (HDPA), published a guide on secure processing environments (SPEs).<\/li>\n<li>Whoever provides the environment must keep real and effective control, even when relying on third parties; contracts and certifications are not enough.<\/li>\n<li>It includes a risk-analysis methodology, data protection engineering techniques and a six-phase health research case study.<\/li>\n<\/ul>\n<\/div>\n<p>On 5 November 2026 the Spanish data protection authority, the Agencia Espa\u00f1ola de Protecci\u00f3n de Datos (AEPD), published <a href=\"https:\/\/www.aepd.es\/en\/guides\/secure-processing-environments-en.pdf\" target=\"_blank\" rel=\"noopener\">a guide on secure processing environments from a data protection perspective<\/a>, prepared jointly with the Hellenic Data Protection Authority (HDPA). It matters because these environments will be the mandatory route for reusing health data in Europe.<\/p>\n<h2>What a secure processing environment is<\/h2>\n<p>According to the <a href=\"https:\/\/www.aepd.es\/en\/prensa-y-comunicacion\/notas-de-prensa\/la-aepd-y-la-autoridad-helenica-de-proteccion-de-datos\" target=\"_blank\" rel=\"noopener\">AEPD press release<\/a>, a secure processing environment (SPE) is an infrastructure that lets users access protected or sensitive data and process it without receiving or downloading it. SPEs are a building block of the Data Governance Act and the European Health Data Space Regulation, which requires this channel for secondary uses of health data such as research, innovation and policymaking.<\/p>\n<p>The guide stresses that an SPE is more than cybersecurity: it is a set of legal, organisational and technical measures with data protection principles built in by design. It marks a shift from &#8220;sharing&#8221; data, with the transfer that implies, to &#8220;accessing&#8221; it without transmission.<\/p>\n<h2>Real control, even with third parties<\/h2>\n<p>The central message is that the entity providing the SPE must keep real and effective control over the infrastructure and the processing, even if a third party supplies it. Contractual guarantees or certifications alone are not enough: they need technical backing, oversight and a genuine ability to audit. The guide also recommends avoiding dependence on a single provider and the concentration of technical control.<\/p>\n<h2>Risks, techniques and a case study<\/h2>\n<p>The document proposes comprehensive risk management covering vendor dependence and digital sovereignty, as well as intellectual property, trade secrets and national security. Its methodology combines the ten LIINE4DU threat categories with the Five Safes framework, and it recalls that a data protection impact assessment (DPIA) is generally mandatory for this processing. It also analyses data protection engineering techniques and includes a six-phase health research case study.<\/p>\n<p>Experts from Eurostat, the Spanish Ministry for Digital Transformation and the Civil Service (Direcci\u00f3n General del Dato), the Italian Garante per la protezione dei dati personali and the UK Information Commissioner\u2019s Office (ICO) took part. It is guidance, not a binding rule.<\/p>\n<h2>Our view at CEA Digital Law<\/h2>\n<p>For the Euro-American Committee of Digital Law &#8211; CEA Digital Law, the most valuable idea is effective control: it moves the debate from &#8220;who certifies&#8221; to &#8220;who can actually supervise and audit&#8221;. That is a useful benchmark for any jurisdiction opening health data to research, including Latin America and the Caribbean and Africa, where many projects rely on third-party cloud infrastructure and data sovereignty remains an open question.<\/p>\n<p>We suggest authorities in those regions use the risk methodology and the phased case study as a working base, adapting them to national frameworks. Open questions remain: how this guidance will fit with the implementing acts of the European Health Data Space, and how smaller bodies can comply without relying on large providers. Cooperation between authorities, as between Madrid and Athens, is a good model for answering them.<\/p>\n<h2>Sources<\/h2>\n<ul class=\"cea-blog-fuentes\">\n<li><a href=\"https:\/\/www.aepd.es\/prensa-y-comunicacion\/notas-de-prensa\/la-aepd-y-la-autoridad-helenica-de-proteccion-de-datos\" target=\"_blank\" rel=\"noopener\">AEPD: nota de prensa sobre la gu\u00eda conjunta con la HDPA<\/a><\/li>\n<li><a href=\"https:\/\/www.aepd.es\/guias\/entornos-tratamiento-seguro-es.pdf\" target=\"_blank\" rel=\"noopener\">AEPD: Entornos de tratamiento seguro (gu\u00eda, espa\u00f1ol)<\/a><\/li>\n<li><a href=\"https:\/\/www.aepd.es\/en\/guides\/secure-processing-environments-en.pdf\" target=\"_blank\" rel=\"noopener\">AEPD: Secure processing environments (guide, English)<\/a><\/li>\n<\/ul>\n<p class=\"cea-blog-firma\"><em>CEA Digital Law<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The AEPD and Greece&#8217;s HDPA have published a joint guide on secure processing environments for reusing sensitive data, key to the European Health Data Space.<\/p>\n","protected":false},"author":2,"featured_media":125314,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"wds_primary_category":0,"wds_primary_cea_women":0,"footnotes":""},"categories":[1132],"tags":[],"cea_women":[],"class_list":["post-125313","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-proteccion-de-datos-y-privacidad-ar"],"acf":[],"_links":{"self":[{"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/posts\/125313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/comments?post=125313"}],"version-history":[{"count":1,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/posts\/125313\/revisions"}],"predecessor-version":[{"id":125345,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/posts\/125313\/revisions\/125345"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/media\/125314"}],"wp:attachment":[{"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/media?parent=125313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/categories?post=125313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/tags?post=125313"},{"taxonomy":"cea_women","embeddable":true,"href":"https:\/\/ceadigilaw.org\/ar\/wp-json\/wp\/v2\/cea_women?post=125313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}