The National Commission on Informatics and Liberty (CNIL) has clarified the legal framework applicable to internal research conducted by healthcare professionals.

An internal research project is defined by three cumulative conditions: it is carried out using data collected within the framework of individual patient monitoring, by the care team providing this monitoring, and for the exclusive use of the latter. These researches are exempt from prior formalities with the CNIL but remain subject to the general obligations of the GDPR, notably the maintenance of a processing register and the information of data subjects. If a project does not meet these criteria, it must be subject either to a declaration of compliance with a reference framework or to an authorization request with the CNIL.

Participant information must comply with Articles 12 to 14 of the GDPR. Individual information is the principle, but collective information may be considered as an exception if the individual approach requires disproportionate efforts, this exception needing to be documented. Participants retain their rights, notably the right to object provided for in Article 21 of the GDPR. The publication of results is possible, provided that access to non-anonymized health data remains restricted to the care team and that the exploitation of results is not carried out by a third party for commercial purposes.