Imagine Isaac Newton today.
An apple falls in a lab. It hits a volunteer on the head. Personal data is processed. Notes are taken. Reactions are observed. A pattern begins to emerge.
Now ask the EDPB’s draft Guidelines 1/2026 a simple question: is this “scientific research”?
At one level, the answer should be easy. Of course, the volunteer should be protected. Of course, there should be safeguards. Of course, the GDPR matters.
But that is not where the real difficulty lies.
The real difficulty is that the Guidelines increasingly seem to confuse science with the institutional habits of established academia.
On paper, the Guidelines say the right things. They repeat that “scientific research” should be interpreted broadly. They acknowledge applied research, technological development, and privately funded research. They even say research can be conducted for profit.
But then the document builds a gatekeeping structure around six so-called key indicative factors. Meet all six, and you are presumed to be doing scientific research. Miss one, and the burden flips. Now you must justify and demonstrate why your work should nonetheless count as science.
That is where the problem begins.
Because what are these factors really doing?
They privilege publication and sharing of results. They emphasise autonomy and independence in a way that sits far more comfortably with universities than with product teams, startups, commercial labs, or tightly governed industrial R&D. They refer to researchers as having academic or scientific qualifications, even citing a PhD as an example. They ask whether the activity contributes to society’s general knowledge and well-being. They point towards independent review bodies as evidence of scientific merit.
None of this is wholly irrational. But taken together, it creates a very particular image of what “real” science looks like. It looks planned. It looks like the committee approved. It looks publishable. It looks institutionally familiar. It looks, above all, respectable to the regulator.
That may describe some science. It does not describe all of it.
Real discovery is often messy. It is iterative. It is exploratory. It is sometimes secretive for good reasons. It does not always begin with a neat hypothesis, a peer review pipeline, a university partner, or a public dissemination strategy. Some of the most consequential scientific and technological breakthroughs have emerged from private labs, hybrid teams, commercial settings, or environments where publication comes later, if at all.
That is why the Newton example matters.
If Newton had to prove from the outset that his apple incident sat neatly within a comprehensive research plan, satisfied a regulator’s preferred picture of independence, and was directed toward publicly verifiable and shareable results, we would immediately see how odd the exercise is. The problem is not the existence of safeguards for the person under the tree. The problem is that the Guidelines risk turning the legal concept of scientific research into a cultural test about what regulators think science ought to look like.
And this is also where the legal structure begins to wobble.
Recital 159 GDPR does not point in a narrow direction. It says scientific research should be interpreted broadly to include technological development and demonstration, fundamental research, applied research, and privately funded research. That is a strong textual signal. Yet the Guidelines seem unable to state openly that private research is excluded, because the GDPR will not allow them to do so. So instead, they move by implication. They construct a six-part test whose centre of gravity lies in publication, external review, academic qualifications, and public-facing scientific legitimacy. Formally, private research remains included. Functionally, it is placed under suspicion.
That is why the document feels oddly extra legal. The six-factor framework is not derived directly from the GDPR’s text. It is assembled by gesturing toward a mix of codes, standards, and general research norms, without a convincing explanation of why those materials should harden into a quasi-legal threshold for access to the GDPR’s research framework. The result is not genuine clarification. It is a kind of duck test for science: if the work looks enough like the regulator’s preferred image of research, it gets through. If not, the burden shifts back to the controller to explain itself.
The paragraph on verifiability and transparency is a particularly good example. It says results are shared with other parties, for example, by publication, or will be shared in the future, subject to intellectual property and trade secret limits. But that formulation quietly narrows the space that Recital 159 seemed to leave open. It treats dissemination as the standard marker of legitimacy, even though serious R&D often involves controlled disclosure, regulatory reporting, internal validation, or confidential development pathways that are no less methodologically rigorous than those required for journal articles. The GDPR did not define scientific research as publishable research. The Guidelines come dangerously close to saying exactly that.
There is one genuinely useful clarification buried in the text. The section on ancillary processing operations appears to recognise that preparatory and supporting activities related to research can themselves fall under the broader umbrella of scientific research. That matters. But even there, the drafting is clumsy. The Guidelines seem to suggest that anonymisation, as a preparatory step, can sit within the research framework. In contrast, elsewhere the logic of anonymisation is that, once the process succeeds, the resulting data falls outside the GDPR. That is not fatal as a legal proposition, but it needed to be explained much more carefully than it was.
And here is the deeper economic point. If Newton cannot satisfy this test inside the EU, he does not stop experimenting. He moves the lab. He relocates the team, the capital, and the data-intensive stage of the work to a jurisdiction with clearer, more functional rules. That is how this kind of regulatory posture harms innovation. It does not usually kill it outright. It pushes it elsewhere.
That is a mistake.
The GDPR itself does not treat scientific research as a status reserved only for universities, peer-reviewed journals, or people with the right institutional markers. It structures it as a purpose category, constrained by safeguards. That is the key point. The right question is not whether the project feels academic enough. The right question is whether the activity is genuinely directed at generating new knowledge or resolving scientific or technological uncertainty, and whether it is being conducted under robust safeguards.
That is also why the Guidelines’ own examples are so revealing. A startup doing generative AI research is treated as scientific research when it partners with a university, secures ethical review, uses established methods, and publishes a peer-reviewed paper. But the same document treats a company’s internal analysis of sales data for marketing strategy as outside scientific research. The line between those examples is not just about science versus non-science. It is also about which forms of institutional legitimacy the EDPB is prepared to recognise.
And that poses a serious risk to modern R&D.
Commercial research is said to be included, but it is included in a way that feels permanently suspect. Product development is not excluded in express terms, but it is pushed into a posture of justification. Startups and industrial labs are told, in effect, you may count as science, but only if you can perform science in a manner that looks sufficiently like academia.
That is not legal clarity. That is a recipe for contestability, compliance conservatism, and chilled innovation.
There is a better way.
A serious framework would ask whether the work contains an appreciable element of novelty and whether it seeks to resolve scientific or technological uncertainty. It would then insist on strong Article 89-style safeguards: data minimisation, pseudonymisation where possible, ethical oversight where appropriate, transparency, access controls, and meaningful governance. That approach would protect people without redefining science so narrowly that only the most institutionally legible forms of research can enter the gate.
The law should police harm, coercion, opacity, and misuse of personal data.
It should not turn into a No True Scotsman test for science.
Otherwise, the next Newton will not be told to watch where the apple is falling.
He will be told to come back once he has a committee, a publication strategy, and a more respectable biography. And if he cannot do that, he will build the laboratory somewhere else.