What Counts as Scientific Research? The EU’s Digital Omnibus Could Set the Definition

Most of the attention on the European Union's Digital Omnibus has gone to what it does to privacy, and to the warning from more than 130 civil society organizations and unions that it is the largest rollback of digital rights the Union has attempted. Less noticed is a short passage that would, for the first time, write a definition of "scientific research" into the General Data Protection Regulation (GDPR).

That passage's impact extends well beyond data protection. No EU instrument currently defines research in its operative provisions. Copyright law relies on the idea repeatedly, in the exceptions for text and data mining and in the treatment of research organizations, without defining it, and the Commission is now consulting on a harmonized copyright exception for research that will need a definition to rest on. So will the forthcoming European Research Area (ERA) Act. A definition agreed in the GDPR could become an important reference point for EU legislation.

In this context, the Commission published its own proposal in November 2025, in the shape of a new Article 4(38) GDPR:

“any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society´s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.’”

In the European Parliament, the file is shared between the Industry, Research and Energy (ITRE) and Civil Liberties, Justice and Home Affairs (LIBE) Committees, with Members of the European Parliament (MEPs) Aura Salla (European People's Party, Finland) and Marina Kaljurand (Socialists and Democrats, Estonia) as rapporteurs. Their June 2026 joint draft report left the Commission's definition largely in place.

Since then, the two MEPs have tabled opposing definitions: MEP Salla's follows the OECD template for research and development (R&D), while MEP Kaljurand's drops the commercial-interest sentence and confines research to autonomous, public-interest work. The argument is now in the amendments, tabled in large numbers, that the committees have to work through.

For the researchers, universities and libraries that Knowledge Rights 21 (KR21) represents, the definition will help determine which activity carries the freedoms the GDPR attaches to research, and which does not.

The amendments fall along five fault lines.

1. Should there be a definition at all?

Some MEPs would delete the definition outright on the grounds that this forms a basis for lighter obligations under GDPR, and so lower data protection. The concern is legitimate. However, removing the definition leaves regulators and courts to draw the boundary case by case, which is the uncertainty researchers already face. A clear statutory definition could provide greater legal certainty than leaving the boundary to case-by-case interpretation.

2. Does building and testing AI count as research?

The Commission’s proposed definition says nothing about artificial intelligence (AI). Several amendments would change that by introducing explicit confirmation that developing, training, testing and validating AI systems can be scientific research where the general conditions are met.

Others (from far-left and far-right parties) actively state that the development, training or optimization of AI should be excluded.

None of this sits easily with what the Commission is saying elsewhere. When Executive Vice President Henna Virkkunen launched the AI Continent Action Plan in April 2025, her first argument was talent: Europe, she said, has an "unparalleled pool" of it, and 30 percent more AI researchers than the United States. Commissioner Ekaterina Zaharieva has spent the same period making the case for science to choose Europe, with a Choose Europe for Science package now approaching 1 billion euros. In November, the two jointly launched RAISE, a virtual institute for AI in science.

The Commission is recruiting AI researchers to Europe and counting them as a strategic asset. That creates a potential tension between the Commission’s AI-in-science policy and a GDPR definition that could exclude core AI development, training or testing from “scientific research”.

3. Research, or research and development?

The deepest split is over how far downstream the definition reaches. The Commission's text expressly includes activity that supports innovation, such as technological development and demonstration, and says research does not stop being research because it also serves a commercial interest. One group of amendments keeps that breadth: some actively confirm that privately funded research is covered, add a reference to competitiveness, or clarify that work inside a company, or feeding later commercial use, is still research.

MEP Axel Voss goes furthest, with a justification that research should be defined "by its purpose, methodology and contribution to knowledge, not by whether it is carried out by academia, public bodies or companies".

Others pull the other way, from the Greens through to ESN, removing the reference to innovation to keep the definition focused on core research.

This is the line KR21 has argued over for years. European copyright law already separates commercial from non-commercial research in a way that Europe's main competitors (US, China, Japan, Singapore) do not, and that separation makes collaboration between universities and companies harder than it needs to be. A GDPR definition that keeps commercial-facing research inside the boundary, as the Commission's does, is the sounder starting point.

4. Method, and the problem of legislating intention

A separate group of amendments would write in tests for what type of research qualifies. Amendments from the S&D and the Greens would require research to be methodical and systematic; while two EPP amendments would make it "creative and systematic", documented and traceable, and point to the OECD's Frascati Manual, the standard reference for defining R&D.

There are also calls to obligate publishing, following peer review, with a view to ensuring that the results can subsequently be checked. Much of this tracks the joint opinion of the EU's two data-protection authorities, which asked for a systematic method, independent conduct and verifiable results. A linked set of proposals would judge research by intent, asking whether it is "genuinely intended" to produce such results.

Worth noting is what nobody disputes: the Commission's text already requires research to follow the ethical standards of its field, with amendments from various MEPs adding respect for participants' autonomy and consent. Those are the safeguards that protect people. The risk lies in tests that a regulator, or a rights holder, can use to second-guess whether a project is "genuine" enough: the kind of open-ended judgment that chills researchers and hands a lever to anyone with an interest in restricting access to their work. Objective, method-based criteria are workable. Subjective tests of intention are not.

5. Autonomy and independence

A final theme, running through amendments from the S&D, Renew and the Greens group, is that research should be conducted autonomously and free from undue pressure.

A recital from the Renew group would permit commercial and private interests while asking that processing be kept "functionally separated from commercial monetization, tracking, or profiling.” Independence is a real principle of good research and worth stating.

Drawn too tightly, though, a functional-separation test could catch the ordinary public-private research that EU funding policy actively encourages. Such language should protect researchers from interference, not turn collaboration itself into a mark against the research claim.

What the committees should hold onto

A workable definition is not hard to describe. It covers research that supports innovation and enables research centers to partner easily with start-ups, scale-ups and industry in general. It is explicit that developing and testing AI can count as research. It rests on objective, method-based criteria rather than judgments about a researcher's intent. And it treats independence as a protection for researchers rather than a disqualification of their partners.

That is close to what the Commission proposed: inclusion of development and innovation, an open definition of methods, a focus on overall goals, and adherence to ethical standards.

The reason to get it right is that the GDPR is not where this definition will stop. Once adopted, it could become a reference point the next time the EU legislates on research, on data, or on copyright, because no other instrument offers such a definition. The two committees are not only deciding how the data-protection rules treat science. They are writing down, for the rest of the body of EU law to borrow, what Europe means by research.

For now, the Omnibus is under negotiation in both the European Parliament and the Council (Member States), with the ambition of finalizing the dossier by the end of the year. Nonetheless, on a dossier with many potential political sticking points, sufficient consensus may still take longer to find.