If a company is receiving anonymized x-ray images (for research purposes) from outside the EU (e.g. US), does the company have to treat the data as if it came from inside the EU?

In particular, does the company have to follow the strict requirements of Article 28 GDPR (requiring from th eprocessors a DPA, TOMs, data protection officer, and certification) when sending this data back to a processor in the US?

1 Answer 1


GDPR only applies to processing of personal data. Anonymized data no longer is personal data. A more important question is whether the data was anonymized in the sense of the GDPR. It would still be personal data if it was merely pseudonymized. The difference is whether a key exists that allows the data subjects to be reidentified.

If the medical data is personal data, it might fall under special categories of data where processing is restricted. Possibly, processing for the purpose of research would require consent. This is the kind of stuff where a company might want to ask their in-house counsel for advice, and may have to confer with their supervision authority.

GDPR does not consider the location or origin of personal data, except for controller → non-EU country data transfers. Receiving/collecting data from outside the EU has no additional restrictions and the same considerations apply as if the data was collected within the EU.

If the controller's processing is subject to the GDPR (e.g. because the controller is established in the EU and dealing with personal data) then yes, international transfers do require extra care.

  • Interesting to consider if an x-ray is itself personal data if it can be tied to an individual e.g. dental x-rays
    – Dale M
    Commented May 10, 2019 at 8:59
  • @Dale: Yes, I think this is one of the key questions. Some say yes, some say no. An "official" statement regarding this would be very helpful. Also x-rays range from full head CT to intra oral image that show only 1-3 teeth.
    – Stiefel
    Commented May 15, 2019 at 6:56
  • @Amon: "GDPR only applies to processing of personal data. Anonymized data no longer is personal data." - there is an ongoing discussion if x-rays data can be anonymized - since an expert could in theory use an x-ray of the teeth (only if the expert has access to another database already containing this patient). Right now the decision seems to be very subjectiv and changes from company to company.
    – Stiefel
    Commented May 15, 2019 at 6:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .