Data protection in healthcare: What ENISA plans for 2026

In November 2026, calendar week 46, the European Cybersecurity Agency (ENISA) publishes comprehensive health care data protection guidelines. These guidelines are designed to implement Article 32 of the GDPR, which sets out the security of personal data. ENISA aims to ensure that health data – such as diagnoses or treatment plans – are protected against unauthorised access and misuse. The measures include technical and organisational protection measures relevant to medical facilities and IT systems to ensure the confidentiality and integrity of the data.

The new guidelines stress the need to design digital healthcare systems so that they are not only efficient, but also secure. This includes, for example, encrypted communication channels, access restrictions and the application of security standards that can also be implemented in practice. ENISA also emphasizes the importance of training and educating employees in order to ensure compliance with the GDPR in practice.

Implementation of these guidelines is a challenge for many healthcare companies, as they often face limited resources and technical capacity. At the same time, however, it is also a duty to uphold patients’ rights and build trust in digital care. The requirements of the GDPR are not only legally binding, but also a protection for people’s privacy.

## What does this mean for your company? ENISA’s new data protection guidelines require healthcare companies to regularly check their IT systems and processes for security and compliance. It is important that all employees know and comply with the requirements of the GDPR. Compliance with these guidelines is not only a legal obligation, but also a protection for patients’ data and the company’s reputation.

## How ISN/xynap supports this The Infrastructure and AI modules in xynap provide GDPR compliant infrastructure and AI tools that support data security and the implementation of GDPR guidelines.