An earlier analysis in this series closed on an unresolved point: whether informed consent under the Swiss HFG satisfies the DSG for the processing of sensitive health data.1Humanforschungsgesetz (HFG), SR 810.30, Art. 16 (informed consent), 17 and 32-34 (further use); Humanforschungsverordnung (HFV), SR 810.301, Art. 28-32 (general-consent requirements). That question was left open at the time because Switzerland's revised data-protection statute had entered into force just over two years earlier and its interaction with sector-specific research law was not yet settled.2Datenschutzgesetz (DSG), SR 235.1, in force 1 September 2023. The intervening period has closed the settling-in window without closing the question. A Swiss site obtains one signed consent form; that form is asked to carry the weight of two Swiss regimes at once, and a third for any European site. For a US sponsor designing a multi-site protocol, the assumption that a single consent form clears both the HFG and the DSG is precisely the assumption that does not hold.
1. What the Settling-In Period Settled, and What It Did Not
The DSG has been in force since 1 September 2023. Enough time has passed that its architecture is stable: the transitional questions about grandfathered processing, controller registration, and the reach of the new sensitive-data definitions have largely resolved in practice. What has not resolved is the specific interface that the clinical-trial sponsor cares about, namely whether the consent obtained under the research-law framework does double duty as a data-protection basis.
The conceptual difficulty predates the Swiss statute and is not unique to it. The European Data Protection Board addressed it directly in Opinion 3/2019, stating that the clinical-trials framework's informed-consent provisions "respond primarily to core ethical requirements" and that the consent obligation "is not conceived as an instrument for data protection compliance."3EDPB, Opinion 3/2019 (23 January 2019) para 16. Ethical consent answers whether a person may take part in research. Data-protection consent, where it is used, answers whether personal data may be processed, and under the GDPR it is only one of several possible legal bases, hedged by conditions for health data and frequently discouraged for trials altogether.4Regulation (EU) 2016/679 (GDPR), Art. 6, 9, 89(1), Recital 33. The two consents share a signature line but not a legal function.
The settling-in period settled the shape of Swiss data-protection law; it did not settle whether a research-law consent form, drafted for an ethics committee, also discharges the data-protection obligations that attach to the same health data.
On the European side, the question has since moved. On the Swiss side, it has not. That asymmetry, more than any single provision, is what a sponsor operating across Switzerland and the EU must manage: two authorities, at two different stages of articulating the same problem, governing one dataset.
2. Why a Single Consent Form Does Not Clear Both Regimes
The instinct to treat one consent as sufficient comes from a reasonable premise: Swiss law has long treated the HFG informed consent as a lex specialis that also authorizes the associated data processing. The premise is not wrong, but it obscures a structural feature of the DSG that separates it from the GDPR. For the private controllers it governs, the DSG does not require a legal basis for processing at all. Unlike Art. 6 GDPR, which insists on a lawful ground for every processing operation, the DSG permits a private person to process personal data, including sensitive health data, provided the general principles are observed: lawfulness, good faith, proportionality, purpose limitation, and recognizability of the processing. The proposition carries two limits worth naming. Federal bodies do need a statutory basis under Art. 34 DSG, and Art. 2 DSG confines the statute to private persons and federal bodies, so a Swiss site that is a cantonal public hospital answers to cantonal data-protection law rather than to the federal statute this analysis describes.
That difference cuts two ways. It means a Swiss sponsor does not need consent to process trial data lawfully, so the absence of a perfect data-protection consent is not fatal. But it also means that consent, when it is obtained, is not the thing that makes the processing lawful, and so a consent form drafted to the HFG standard does not automatically satisfy the discrete requirements the DSG does impose. Those requirements attach independently of consent. The processing must respect the personality of the data subject; where it would infringe that personality, Art. 30 and Art. 31 DSG require a justification, of which consent is one, an overriding interest another, and statutory authorization a third. Where the sponsor does rely on consent for sensitive data, it must be express. And the transparency duties under Art. 19-21 DSG, together with the assessment obligation under Art. 22 DSG for high-risk processing, apply whether or not a form was signed.
The gap, then, is not that the DSG forbids what the HFG permits. It is that the two regimes ask different questions of the same document. The HFG form is engineered to satisfy an ethics committee that the participant understood the research and agreed to it. Whether that same form specifies the processing purposes with the precision the DSG expects, carries the express-consent formalities the DSG requires when consent is the chosen ground, and discloses the information Art. 19 DSG demands, is a separate inquiry that the form does not answer by existing. A sponsor that treats the executed HFG consent as a receipt for DSG compliance has not made an error of law so much as skipped a question.
3. The DSG as Supplement, Not Substitute
The Swiss data-protection authority has taken a consistent, if deliberately incomplete, position on the interface. In its published guidance on human research, the EDÖB frames the HFG as governing research-specific consent and further use, "supplemented by the general principles" of the DSG.5EDÖB, guidance on human research (Humanforschung) and processing of personal data in the medical field. The operative word is supplemented. The DSG applies alongside the HFG; it is not displaced by it. What the guidance does not do is declare that HFG consent, by itself, discharges every DSG requirement for sensitive health data.
That reticence is itself the finding. Swiss law has traditionally treated the HFG informed consent as sufficient basis for associated data processing, a reading that made sense under the predecessor data-protection statute, which imposed lighter requirements on sensitive data. The revised DSG raised those requirements. It extended the catalogue of sensitive personal data in Art. 5(c) DSG to genetic data and to biometric data that uniquely identify a natural person, and it tightened the conditions on which consent is valid, with Art. 6(6) DSG requiring that consent be given for one or more specific processing operations. The express-consent requirement for sensitive data is not the novelty it is sometimes taken for: the predecessor statute already carried it, and what moved around it was the specificity the revised text demands. Whether the older lex specialis reading survives that change is the question the EDÖB has not squarely answered, and the guidance that exists is careful to describe the two regimes as complementary rather than to rank one over the other.
For the sponsor, the consequence is practical rather than theoretical. Absent a definitive statement that HFG consent suffices, the exposure runs the other way: the DSG requirements may sit on top of the HFG requirements, and whether the consent documentation, the participant information sheet and the site processing arrangements were built on that assumption is a question the executed form does not answer. The same consent-quality concerns that data-protection authorities raise about trial consent (dependency, health status, and the pressure of the clinical setting) apply to the HFG consent framework as much as to any other. A form that an ethics committee accepts as freely given may still leave open whether the processing it authorizes rests on a DSG-sound footing.
4. Where Broad Consent Diverges: Recital 33, the EDPB Guidelines, and the Generalkonsent
The European side has since spoken, at least in draft. In April 2026 the EDPB adopted Guidelines 1/2026 on processing of personal data for scientific research purposes and opened them for public consultation, with the consultation window running to 25 June 2026.6EDPB, Guidelines 1/2026 on processing of personal data for scientific research purposes (adopted 15 April 2026; public consultation 16 April to 25 June 2026). The Guidelines take up the long-uncertain question of broad consent. Building on Recital 33 GDPR, they accept that a controller may rely on consent given to areas of scientific research where the purposes cannot be fully specified at the point of collection, provided additional safeguards are in place, and they allow that broad consent may be combined with more granular, project-by-project consent. As at 12 May 2026 the Guidelines remain in draft; they clarify the European position without yet fixing it.
The Guidelines also revisit the threshold question of what counts as scientific research at all, setting out indicative factors, among them a methodical and systematic approach, adherence to ethical standards, verifiability and transparency, autonomy and independence, and a potential to contribute to existing scientific knowledge or to apply existing knowledge in novel ways, that processing should exhibit before it can claim the research regime's accommodations. The threshold does not turn on who funds the trial: the autonomy and independence factor applies, in the Guidelines' words, "regardless of whether the research activities are carried out by an academic institution, non-profit organisation, public institution or a for-profit organisation (such as a commercial company or a start-up)", and the Guidelines' own worked example treats a pharmaceutical company's clinical trial as scientific research. What the factor asks instead is whether the research team is qualified and free to define the research questions, choose the methods, and publish the results, a question the protocol and the publication clauses of the site agreements answer long before a regulator does. A sponsor that assumes its trial automatically qualifies as scientific research, and so inherits the broad-consent latitude and the presumption that further research processing is compatible with the original purpose, is assuming a characterization the Guidelines invite a regulator to test rather than one the sponsor may take for granted.
Switzerland has its own construct for the same problem, and it does not map cleanly onto the European one. The general consent, or Generalkonsent, familiar to every Swiss research site rests on Art. 17 HFG, which pulls the question forward to the moment of collection, and on the further-use provisions of Art. 32-33 HFG. Those provisions do not run on a single coding ladder. Biological material and genetic data may be re-used for research only with consent after sufficient information, in coded and in uncoded form alike, and may be anonymized only where the person was informed in advance and did not object. Non-genetic health-related personal data require consent for uncoded re-use, coded re-use needs only prior information and an unexercised right to object, and anonymized data fall outside the mechanism altogether. Art. 34 HFG opens a narrow route through both branches where obtaining consent or giving the information about the right to object is impossible, disproportionately difficult, or unreasonable to ask of the person, where no documented refusal exists, and where the research interest outweighs the person's interest in deciding about the further use. Swiss law is also stricter than the European broad-consent model in one respect that a general consent cannot paper over. Where uncoded biological material or genetic data are re-used, the consent contemplated by Art. 28 HFV attaches to a defined research project, with its nature, purpose, duration and course disclosed, rather than to an open area of research, which is the breadth that Recital 33 GDPR and Guidelines 1/2026 are prepared to accommodate.
The divergence matters because it defeats the tidy assumption that one further-use consent, drafted to the more permissive European standard, will satisfy the Swiss one. It will not necessarily do so, and neither construct automatically discharges the DSG's own requirements for sensitive data. The heterogeneity is not new. The EDPB acknowledged in its 2021 response to the European Commission that the legal bases for health-research processing vary across Member States and that the resulting lack of homogeneity "cannot be solved in the EDPB guidelines or by means of Codes of conduct."7EDPB, response to the European Commission on the consistent application of the GDPR, focusing on health research (2 February 2021). Guidelines 1/2026 clarify the concept of research and the use of broad consent; they do not harmonize the national legal-basis layer, and they say nothing about Swiss law.
A further layer is arriving on a known schedule. The European Health Data Space Regulation establishes a secondary-use regime for electronic health data, including clinical-trial data, operated through health data access bodies.8Regulation (EU) 2025/327 (EHDS), Chapter IV (secondary use); application staggered from 26 March 2029. Its secondary-use provisions begin to apply from 26 March 2029, with certain data categories following on 26 March 2031. That build-out is a distinct architecture, concerned with access to data for downstream research rather than with the primary-use consent at the point of enrollment, and it warrants its own analysis. What matters here is only that the further-use landscape the Generalkonsent governs will not stay still, and that a consent architecture designed for a trial beginning in 2026 may face a materially different secondary-use regime before that trial's data completes its useful life.
5. Strategic Considerations
The practical questions surface at protocol design and in the site contracts, not during the trial. To which standard should the consent form be drafted, when the HFG governs participation, the DSG governs the processing of sensitive data, and the GDPR governs any European site, and each attaches its formalities differently to the same signature? If the DSG does not require consent to make the processing lawful, does obtaining express consent anyway import withdrawal rights and downstream erasure questions that an overriding-interest or statutory basis would not have carried, and has the protocol weighed that trade-off deliberately rather than by default?
The multi-site sponsor faces a sharper version of the same tension. Where a Swiss site's further-use consent must attach to a defined research project for uncoded biological material and genetic data while an EU site relies on the broader consent that Recital 33 GDPR and the draft Guidelines permit, can one master consent architecture serve both, or does the divergence force site-specific documentation that the sponsor's templates were not built to produce? And on whose authority should a multi-year protocol be built, when Guidelines 1/2026 remain in draft with their consultation window running to June 2026, and the EDÖB, as at 12 May 2026, has issued no definitive statement that HFG consent suffices for the DSG? A protocol anchored to a position that is not yet final on one side of the border and not yet articulated on the other is a protocol resting on two moving foundations.
Underneath all of it is a contracting question that the consent form cannot answer. The allocation of controller and processor roles between the sponsor, the site, and any contract research organization determines who owes which DSG and GDPR duties, and a site agreement that assumes the executed consent settles the data-protection position leaves that allocation unexamined. The consent form that satisfies the ethics committee and the contract that governs the data are two different instruments, and the distance between them is where the exposure sits, usually invisible until an audit or a participant's withdrawal request forces the question into the open.