The Spanish Data Protection Agency (AEPD) and the Hellenic Data Protection Authority have jointly published a guide on Secure Processing Environments: infrastructures that allow protected or sensitive data, such as health data, to be accessed and processed without users receiving or downloading the data themselves.

The authorities emphasise that the organisation providing this type of environment must retain real and effective control over both the data processing activities and the infrastructure, even when the latter is provided by a third party.

The guide includes a risk assessment methodology with a catalogue of measures, an analysis of data protection engineering techniques, and a practical healthcare research case study developed in several stages.