This chapter describes the lessons learned from applying the European Union’s (EU) General Data Protection Regulation (GDPR) to PPI in guideline development in WOREL of Belgium. These lessons can be used in or adapted for other international jurisdictions. When highlighting examples from European law, we refer to the ‘GDPR’. We use the term ‘data protection’ when discussing concepts relevant to an international audience.

Overall, this chapter aims to:

• Clarify how data protection applies to PPI in guideline development, drawing on examples from the application of the GDPR in WOREL, Belgium, and how this must be adapted to each specific setting. These include the national and organisational context, as well as in a research environment with ethics committee oversight or outside a research environment without guidance from such a committee.
• Define key terms relating to personal data, including special categories, data processing, and pseudonymisation compared with anonymisation, so that guideline developers and participants share a clear understanding.
• Justify the lawful basis for data processing in guideline development, for example, section 2j of Article 9 of the GDPR for scientific research (Regulation (EU) 2016/679, Article  9), while recognising that national legislation and local practices may vary. The applicable lawful basis should always be confirmed according to the specific context in which the guideline development takes place.
• Explain what data is typically collected and why, with attention to proportionality and minimisation, which are core GDPR principles applied to PPI in guideline development.
• Describe appropriate technical and organisational safeguards, taking account of the scale of processing and available resources.
• Emphasise transparency and accountability, ensuring that participants understand how their data will be handled and what rights they have.
• Show that ethical and legal oversight is in place, including ethics committee approval when needed, and compliance with EU and national data protection regulations.
• Describe how and when to carry out a Data Protection Impact Assessment.