Health Data Governance: Why delay is not an option

Sexual and reproductive health rights in the digital age

The digital transformation of health is redefining how people seek and access health services and information. Sexual and reproductive health (SRH) services are no exception, with digital tools reducing access barriers for such services (Sumanjeet et al. 2023). For example, telemedicine is helping women and girls overcome some of the barriers they face in accessing services due to household chores, inadequate finances, childcare responsibilities, the distance to health facilities and lack of time(Figueroa et al. 2021). Whilst digital health tools offer opportunities to help close the SRH service coverage gap, they also open new issues around privacy, equity, trust and rights. Digitalisation has resulted in new frontiers on how information and data is generated, accessed and shared. For example, personal health monitoring through such tools as menstrual and fertility tracking has increased the generation of data outside of traditional healthcare settings, which may not have the same legislative and regulatory protections. In the US, there are worrying signs that women and girls’ search histories, text messages and call logs could become part of investigations and court proceedings in states where access to abortion is criminalised (Korn and Duffy, 2022). Health data can also be exploited to identify and target marginalised groups such as LGBTQ+ communities and people living with HIV (Kovacas and Ranganathan 2019). An analysis of reproductive health Apps across the US and EU revealed that user expectations around data protection are not being met, prompting concern around how data is stored and third-party sharing practices (Zadushlivy et al. 2025).

Legislation and regulation has not kept pace with the rapid development of mobile sexual reproductive health apps and most of the sexual reproductive technologies are silent on privacy issues (Khosla et al. 2023). Where regulations on data protection exist they’re often outdated or misaligned with technological advances (Khosla et al. 2023). The opportunities and risks of digital health tools for SRHR offers a powerful lens through which to examine the importance of health data governance, and particularly legislative frameworks. It raises important concerns around people’s rights and the harms of SRH data misuse which can be immediate and severe. Moreover, inadequate governance can lead to SRH data not being adequately used to improve the health and well-being of women and girls, whether it be policy decisions, patient care, or to advance research and innovation in SRH care. There is a clear need to strengthen health data governance to uphold rights, and in particular SRHR in the age of digital technologies and Al.

Countries must establish laws to govern health data

While most countries (approximately 79 percent) have general data protection and privacy legislation in place (UNCTAD, 2025), health data specific laws are less prevalent. Health-specific data protection laws are important to respond to the unique sensitivities of health information, which, if inadequately protected, can lead to discrimination and stigma, and undermine public trust. The World Health Organization underscores that sensitive medical data and data on vulnerable groups demand particularly stringent protection, grounded in respect for human rights and privacy (WHO, 2020). Europe has seen advances in this area with the creation of the European Health Data Space, which is designed to give people more control over their personal health data and to improve healthcare across the EU, making health data more accessible, secure and useful across the continent (Regulation (EU) 2025/327, 2025). This is also being prioritised in Africa, where the AU Data Policy Framework, specifies that health data is a unique category of data because it contains people’s most personal and sensitive information, therefore demanding more rigorous protections and robust governance instruments (African Union Commission, 2022). Africa CDC recently initiated the drafting of a Continental Health Data Governance Framework with Member States to “establish an agreement around optimal legislation and regulation for the effective and equitable governance of health data, and build continental alignment and collaboration around a harmonised African position on health data governance that supports cross-border data flows, with the needed protections in place”, following an announcement at the Africa Health ExCon in Cairo, Egypt (Africa CDC, 2025).

General data protection frameworks often do not fully address the needs and elevated risks associated with health data, and particularly SRH data, as outlined above. The need for health-specific legislative provisions is therefore essential. This would provide the legal guardrails to safeguard individual rights, ensure equitable access to care, and promote responsible use of digital health technologies. Such laws would also provide formal mechanisms for individuals to seek redress if their data is misused, their rights are violated, or if their data is not being used for public benefit. Such safeguards can only be guaranteed through legislation.

The absence of such legislation in SRHR could be particularly detrimental and lead to negative impacts on maternal mortality, teenage pregnancy and HIV treatment. It could also deepen inequalities as women, adolescents and marginalised groups risk further exclusion from reliable and safe SRH services. The absence of adequate legislation could also result in exploitation of sensitive health data through illegal surveillance and selling of data. Moreover, it could result in the underutilisation of health systems and digital tools all together if users feel their data is not protected.

Citizens are also demanding stronger legislative guardrails for the protection and better use of their health data. Through the My Data Our Health campaign Transform Health is engaging communities on this issue, to raise public and political awareness and mobilise action for better health data governance (Transform Health, 2023). The campaign revealed that many people (nearly 60 percent) were unable to access their own health data, while around 70 percent were unaware who collected it (Transform Health, 2024b). Nearly 50 percent of respondents also indicated that they do not feel confident that their data is well protected.

«The My Data Our Health campaign has brought new ideas in our community that build the confidence of Women living with HIV and adolescent girls and young women to demand their data. Previously no one was aware of the importance of accessing personal health data.» Joan Chamungu, Executive Director, Tanzania Network of Women living with HIV and AIDS (TNW+)

Establishing a global health data governance framework

While national governments hold the ultimate responsibility for strengthening their legislative frameworks, global cooperation can support this process. A global health data governance framework - negotiated and endorsed by Member States through the World Health Assembly - could establish a global commitment and standard for the legislative provisions that need to be in place. It would also support legal coherence across countries, thereby ensuring a comparable standard and needed protections as data moves across borders. This would help build trust, leading to digital health users being more likely to embrace digital health solutions knowing that robust legal protections are in place.

While the need for such a framework is increasingly recognised, governments and supporting institutions have yet to take concrete steps to advance it. Despite digital advances and rapid developments in AI - consuming and generating vast amounts of data - there remains a worrying complacency to address its governance. The risks of inaction are significant and concerning.

Governments must call for health data governance to be on the agenda of the World Health Assembly to initiate the development of a global health data governance framework. Transform Health and partners have been advocating for and supporting this, including through the widely endorsed Health Data Governance Principles and establishing a Model Law, which sets out legislative provisions for health data in the digital age, the foundation of a global framework (Transform Health, 2024a). The Model Law can also be used by governments as a blueprint to support them in strengthening their national legislative frameworks. Such efforts are being supported by Transform Health, including through various tools and a technical support package for countries.

In the absence of such a global framework it is promising to see regional bodies and institutions spearheading this agenda for their citizens, including through the European Health Data Space and recent developments to draft an African Continental Health Data Governance Framework. Such approaches should be emulated at the global level.

Now is the time for governments to take action

Government leadership is essential to strengthen national legislation and advance a global health data governance framework. The current moment represents both urgency and opportunity: political will exists, but action must be accelerated.

Transform Health recommends the following actions from governments to safeguard health data while ensuring its responsible use for public benefit in the digital age:

• Strengthen national health data governance legislation, to safeguard data, prevent discrimination and uphold peoples’ rights, while ensuring responsible data use for public benefit.
• Champion the development and endorsement of a global (and regional) health data governance framework, including by prioritising health data governance at the World Health Assembly.
• Endorse the health data governance principles, as a foundation for stronger national legislation and regional and global frameworks.

Governments have an opportunity - and an obligation - to protect sensitive data, safeguard sexual and reproductive health rights, and ensure that digital health innovations advance equity, safety, and public trust, to deliver health for all.

References

Africa CDC (2025) Africa sets course to strengthen and harmonise health data governance. Emergency Response and Preparedness, 23 July. Available at: https://africacdc.org/news-item/africa-sets-course-to-strengthen-and-harmonise-health-data-governance/ (Accessed: 4 September 2025).

African Union Commission (2022) AU Data Policy Framework. Endorsed by the Executive Council, February. African Union Commission.

European Union, 2025. Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847. Official Journal of the European Union, L (2025) 327, 5 March 2025. Available at: http://data.europa.eu/eli/reg/2025/327/oj (Accessed: 5 September 2025).

Figueroa, C.A., et al. (2021) ‘The need for feminist intersectionality in digital health’, The Lancet Digital Health, 3(8), pp. e526–e533. Available at: https://www.thelancet.com/journals/landig/article/PIIS2589-7500(21)00118-7/fulltext (Accessed: 4 September 2025).

Khosla, R., et al. (2023) ‘Sexual and reproductive health and rights and bodily autonomy in a digital world’, Sexual and Reproductive Health Matters, 4(31). doi:10.1080/26410397.2023.2269003.

Korn, J. and Duffy, C. (2022) How your phone could be used in abortion criminalization. CNN, 6 May. Available at: https://edition.cnn.com/2022/06/24/tech/abortion-laws-data-privacy (Accessed: 20 August 2025).

Kovacas, A. and Ranganathan, N. (2019) Data sovereignty, of whom? Limits and suitability of sovereignty frameworks for data in India. Working Paper 03. Data Governance Network, November.

Sumanjeet, S., et al. (2023) ‘Differential access of healthcare services and its impact on women in India: a systematic literature review’, SN Social Sciences, 3(16), p. 16. doi:10.1007/s43545-023-00607-9.

Transform Health (2023) Where’s My Data? | People React To Asking For Their Health Data | #MyDataOurHealth YouTube, posted by Transform Health. Available at: https://www.youtube.com/watch?v=QnalrRXNx7Q

Transform Health (2024) Model Law on Health Data Governance: A blueprint for strengthening national legislation. Basel: Transform Health. Available at: https://healthdatagovernance.org/model-law/

Transform Health (2024) My Data Our Health: The critical role of citizen’s engagement on health data governance, 12 August. Available at: https://transformhealthcoalition.org/my-data-our-health-the-critical-role-of-citizens-engagement-on-health-data-governance/

UNCTAD (2025) Data Protection and Privacy Legislation Worldwide. UN Conference on Trade and Development (UNCTAD). Available at: https://unctad.org/page/data-protection-and-privacy-legislation-worldwide (Accessed: 4 September 2025).

World Health Organization (2020) WHO data principles. Available at: https://data.who.int/about/data/who-data-principles

Zadushlivy, N., et al. (2025) ‘Exploration of reproductive health apps’ data privacy policies and the risks posed to users: qualitative content analysis’, Journal of Medical Internet Research, 27, e51517.