The Spanish Data Protection Agency (AEPD) and the Hellenic Data Protection Authority (HDPA) have published a joint guide on secure processing environments (SPE) from the perspective of data protection.

This guide, developed with the collaboration of experts from Eurostat, the Directorate-General for Data of the Spanish Ministry of Digital Transformation, the Italian authority, and the United Kingdom's Information Commissioner's Office (ICO), is intended for data controllers, data protection officers, and other stakeholders involved in the design and operation of these environments. SPEs are infrastructures that allow access to and processing of sensitive data, notably health data, without the user receiving or downloading them. They constitute a central element of the Data Governance Act and the European Health Data Space Regulation, the latter making their use mandatory for secondary uses of health data such as research or innovation.

The document emphasizes that an SPE is a set of legal, organizational, and technical measures that integrate data protection principles by design, going beyond traditional cybersecurity. It stresses the necessity for the entity providing the SPE to maintain real and effective control over the infrastructure and processing, even when using third parties, specifying that contractual guarantees alone are insufficient. Risk management must be comprehensive, covering supplier dependency and digital sovereignty, in addition to risks to intellectual property or national security. The guide proposes a risk analysis methodology, recalls that conducting a data protection impact assessment is generally mandatory, and includes a practical case in health research.