The processing of health data for scientific research purposes requires a legal basisunder Article 6 and a justification under Article 9 (2) GDPR by way of an exceptionto the general prohibition in Art. 9(1) of the processing of special category data.Consent tends to be highly advocated for in this regard, in both literature and practice.However, the GDPR permits an alternative option: processing for scientific researchpurposes based on Union or Member State law which provides for suitable andspecific safeguarding measures. This paper undertakes an in-depth examination ofthe ‘research exception’ in Art. 9 (2) (j) GDPR permitting the processing of healthdata for scientific research purposes, thoroughly considering its elements and itsimplications. It refers to examples of Member State implementing legislation andthe proposed European Health Data Space Regulation for illustration purposes andargues that if implemented faithfully, Art. 9 (2) (j) strikes a better balance betweenthe interests of the various stakeholders than consent, which is overall burdensomeand may hinder research. Finally, in light of the uneven implementation of theGDPR’s research exception by the Member States which creates considerable legaluncertainties and results in barriers to the free flow of research data across the EU,this paper calls for a harmonised implementing Union law in this regard.