You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Processing sensitive human data is fundamental to biomedical research, enabling breakthroughs in disease understanding, biomarker detection and treatment development.
4
-
Rapid and secure access to such data accelerates research, but also introduces significant responsibilities for data protection and privacy.
3
+
Processing sensitive human data is fundamental to biomedical research, enabling breakthroughs in disease understanding, biomarker discovery, and treatment development.
4
+
Rapid and secure access to such data accelerates research but also introduces significant responsibilities for data protection and privacy.
5
5
Cloud-based services are increasingly used in biomedical research to connect researchers, data, and tools throughout the data lifecycle.
6
6
This page summarizes scenarios and requirements for handling sensitive data within the ELIXIR-on-Cloud framework.
7
7
@@ -10,13 +10,16 @@ This page summarizes scenarios and requirements for handling sensitive data with
10
10
Sensitive data processing in research is governed by several legal frameworks, most notably the General Data Protection Regulation (GDPR) and the European Health Data Space (EHDS):
11
11
12
12
***GDPR**: Allows the use of sensitive personal data for research when specific safeguards are in place. Processing is permitted in the public interest, provided measures such as data minimization, pseudonymization, and strict access controls are implemented. Explicit informed consent is often required, and a Data Protection Impact Assessment (DPIA) is strongly recommended.
13
-
***EHDS**: Builds on GDPR by establishing a unified framework for secure sharing and secondary use of electronic health data across the EU. Under EHDS, sensitive health data (e.g., genetic or clinical records) can be reused for research, innovation, and policy-making if anonymized or pseudonymized and accessed through secure processing environments (SPEs).
13
+
***EHDS**: Builds on GDPR by establishing a unified framework for secure sharing and secondary use of electronic health data across the EU. The EHDS is defined as "the first common EU data space dedicated to a specific sector, establishing a common framework for use and exchange of electronic health data across the EU" ([Regulation (EU) 2025/327](eur-lex-ehds)). The EHDS aims to improve individuals' access to their electronic health data and enable secondary use for research, innovation, policymaking, health threats preparedness, patient safety, and regulatory activities.
14
14
15
15
## Environments
16
16
17
17
* A Trusted Execution Environment (TEE) is a secure and isolated area within a computer system or processor that ensures the confidentiality and integrity of code and data during execution. It aims to protect sensitive computations and data from potential threats, such as malware or unauthorized access.
18
-
* A Secure Processing Environment (SPE) is a controlled environment designed to facilitate secure data processing and analysis while maintaining confidentiality, integrity, and privacy. It focuses on secure processing techniques, often including encryption, secure computation, or secure enclaves, to protect data during computation.
19
-
* A Trusted Research Environment (TRE) is a secure and controlled environment specifically tailored for research purposes, providing secure data access, analysis, collaboration, and compliance with legal and ethical requirements. TREs emphasize privacy preservation, data governance, collaboration, and knowledge generation while protecting sensitive data.
18
+
* A Secure Processing Environment (SPE) is a controlled environment designed to facilitate secure data processing and analysis while maintaining confidentiality, integrity, and privacy. It focuses on secure processing techniques, often including encryption, secure computation, or secure enclaves, to protect data during computation. Under the EHDS regulation, sensitive health data (e.g., genetic or clinical records) can be reused for research, innovation, and policy-making if anonymized or pseudonymized and accessed through SPE ([Regulation (EU) 2025/327](eur-lex-ehds)).
19
+
* A Trusted Research Environment (TRE) is a secure and controlled environment specifically tailored for research purposes, providing secure data access, analysis, collaboration, and compliance with legal and ethical requirements. TREs emphasize data governance, collaboration, and knowledge generation while ensuring privacy protection. For TREs, the **Five Safes framework** is particularly relevant as a comprehensive approach to data protection while enabling research access. This framework has been adopted by Health Data Research UK (HDR-UK), NIHR, and other major UK research institutions as the gold standard for balancing data protection with research utility ([What is the Five Safes framework?](ukdataservice-5-safes)).
20
+
21
+
!!! note "SPEs vs TREs"
22
+
Secure Processing Environments (SPEs) and Trusted Research Environments (TREs) are conceptually very similar and serve comparable purposes in providing secure environments for sensitive data processing. The key difference lies in their regulatory and geographical context: SPEs are specifically required within the framework of the EHDS, while TREs are primarily a UK-developed concept and implementation approach.
20
23
21
24
### Similarities
22
25
@@ -27,21 +30,6 @@ Sensitive data processing in research is governed by several legal frameworks, m
27
30
***Controlled Access and Authentication**: Authenticates code and data before execution to ensure only trusted and verified code runs.
28
31
***Collaboration and Analysis**: There is an offer of tools and infrastructure that enable researchers to perform analysis and collaborate within a secure environment. This allows for sharing and combining datasets while maintaining data privacy.
29
32
30
-
### Differences
31
-
32
-
***Focus**:
33
-
* TEE: Secures startup, code and data during execution.
34
-
* SPE: Ensures secure data processing and computation.
35
-
* TRE: Provides a comprehensive and secure environment for research activities, including data access and compliance.
36
-
***Data Handling**:
37
-
* TEE: Focuses on securing the execution of code and data.
38
-
* SPE: Involves secure data processing and temporary storage for processing purposes.
39
-
* TRE: Covers secure data storage, access controls, and privacy-preserving methods.
40
-
***Application Context**:
41
-
* TEE: Used in secure mobile device environments and secure cloud computing.
42
-
* SPE: Applied in secure data analytics and cryptographic computations.
43
-
* TRE: Tailored for research involving sensitive datasets like healthcare research.
44
-
45
33
## Use Cases
46
34
47
35
Researchers may require access to sensitive data in different scenarios.
@@ -57,4 +45,4 @@ We also distinguish between whether the data should be processed in the cloud or
57
45
***Data repository**: Data is stored in a single database. Researchers request access, are authorized, and transfer encrypted data to their secure environment for analysis.
58
46
***Federated database**: Data is distributed across multiple nodes. Metadata is accessible via APIs and a central portal. Researchers request access to datasets at individual nodes, which then provide data for transfer or processing.
59
47
***Cloud platform**: Centralized sensitive data is hosted on a platform. Authorized users log in and analyze data directly within an SPE, using workflows or interactive tools.
60
-
***Federated processing**: Sensitive data remains on separate nodes with restricted transfer. Analysis is performed via APIs in an SPE, often combining results from multiple sources. A special case of this is federated learning, where models are trained in several iterations and updated on different data sets.
48
+
***Federated processing**: Sensitive data remains on separate nodes with restricted transfer. Analysis is performed via APIs in an SPE, often combining results from multiple sources. A special case of this is federated learning, where models are trained through several iterations and updated with different datasets.
Copy file name to clipboardExpand all lines: docs/guides/index.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,5 +3,5 @@
3
3
The ELIXIR-on-Cloud project is an initiative from the ELIXIR Compute Platform.
4
4
Our goal is to support scientists across Europe in using cloud environments for their research activities.
5
5
We support the use of ELIXIR services as well as open-source software, and the project has close connections with various academic cloud providers.
6
-
One of our key focuses is developing and providing software that implements the specifications defined by the Global Alliance for Genomics and Health (GA4GH) for federated processing of workloads ([GA4GH Cloud Work Stream](https://www.ga4gh.org/work_stream/cloud/)).
6
+
One of our key focuses is developing and providing software that implements the specifications defined by the Global Alliance for Genomics and Health (GA4GH) for federated processing of workloads ([GA4GH Cloud Work Stream](ga4gh-cloud-ws)).
7
7
This documentation here offers guidance and best practices on how to use the services, further develop our services, and deploy services within the ELIXIR-on-Cloud Framework.
*[ELIXIR]: ELIXIR unites Europe’s leading life science organisations in managing and safeguarding the increasing volume of data being generated by publicly funded research. It coordinates, integrates and sustains bioinformatics resources across its member states and enables users in academia and industry to access services that are vital for their research.
4
6
*[FOSS]: Free & Open Source Software
5
7
*[GA4GH]: The Global Alliance for Genomics and Health is a policy-framing and technical standards-setting organization, seeking to enable responsible genomic data sharing within a human rights framework.
0 commit comments