AEPD and Greek Data Protection Authority publish joint guidance on Secure Treatment Environments

What happened

The Spanish and Greek data protection authorities released a bilingual guide on Secure Treatment Environments (ETS) for processing sensitive data, especially health data, without data leaving the controlled environment. The guide provides risk‑analysis methodology, technical measures, and stresses the need for real, effective control by the ETS provider even when third‑party services are used.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The guidance helps data controllers and DPOs comply with the EU Data Governance and Health Data Space regulations by outlining secure, privacy‑by‑design environments for health data reuse.
• Takes effect November 5, 2026.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Revisit retention schedules and data minimisation for the data involved.
3. Review the transfer mechanisms relied on for affected data flows.
4. Map the security requirements to existing controls and close gaps.
5. Confirm handling of sensitive data categories meets the stricter rules.