The EU’s General Data Protection Regulation (GDPR) and other strict personal data protection rules have significantly reduced research and development investments in the pharmaceutical and biotechnology sectors, according to a new study by Etla. The decline in investments has been particularly steep among small and medium-sized enterprises (SMEs) operating in domestic markets. There is a risk that strict regulation will push companies to shift their investments to countries with lighter regulation. This could weaken the position of high-regulation countries as operating environments for health technology and medical innovation.
The Etla study Privacy Regulation and R&D Investments: Causal Evidence from Global Pharmaceutical and Biotechnology Firms (Etla Working Paper 130) examines the impact of strict privacy regulations on research and development spending in the pharmaceutical and biotechnology sectors. The study uses an extensive firm-level dataset covering the world’s largest R&D investors from 2013 to 2023.
According to Etla, access to patient-specific health data is essential for innovation in the pharmaceutical and biotechnology industries, particularly for conducting clinical trials. The new research shows that strict privacy regulation significantly reduces companies’ investments in research and development.
“The results are clear: strict health data privacy regulation severely cuts R&D investments in the sector. On average, investments dropped by 39 percent within four years of the regulation taking effect,” says Dr. Heli Koski, Research Director at Etla, who led the study.
The impact is strongest on domestic SMEs
The effects of personal data protection regulation are not evenly distributed. The largest cuts in investment were made by pharmaceutical and biotechnology SMEs operating only in domestic markets. Their R&D spending fell by as much as 63 percent, compared to around 27 percent for large multinational companies. On average, SME investments decreased by 50 percent.
Koski notes that the new research indicates that personal data protection regulations may limit the prerequisites for data-driven innovation, especially in industries where personal data plays a key role. According to Koski, regulation increases administrative and technical burdens and influences where it is worthwhile to carry out R&D activities.
“Large multinational companies generally have better opportunities than small domestic firms to reorganize — for example, by relocating their R&D operations to countries where health data regulation is more flexible,” Koski says.
In the long term, strict privacy regulations may divert investments away from high-regulation countries, potentially weakening their position as operating environments for health technology and medical innovations.
“In the long run, the entire global innovation landscape could even change,” Koski warns.
Pictured: Heli Koski, Research Director, Etla