Scientific research is a crucial tool for advancing healthcare and public health. In cross-border research collaborations, researchers need to navigate a complex pool of different requirements, which potentially hamper scientific research. This chapter aims to map the current legal landscape in seventeen Member States of the European Economic Area in the context of the secondary processing of health and genetic data for scientific research purposes. It critically assesses the transposition of GDPR in the national legal order of each State and its interplay with other applicable legislations. Our research findings show that only a handful examined Member States have a dedicated Act on secondary use, as the majority rely on provisions of different laws. Consent, which has been traditionally relied upon for the processing of health and genetic data for scientific research purposes, still remains the most commonly used legal basis. However, there is an increasingly common stance among experts towards the lack of appropriateness of consent as legal basis and a preference over using it as additional safeguard. Most Member States have enabled the derogation from the exercise of data subject rights under art 89(2) GDPR, while providing a series of appropriate safeguards, mostly including anonymisation, pseudonymisation and encryption.