Data, personal data, and health data are critical in developing new technologies and health interventions, but accessing this data is fraught with ethical concerns. The European Union’s General Data Protection Regulation (GDPR) and the proposed European Health Data Space (EHDS) regulation seek to provide protection of personal data while enabling access to this data for health research. However, it is questionable whether the current and proposed framework (including the exceptions and derogations within these) adequately balance and protect the breadth of rights, including under Articles 8 and 14 of the European Convention on Human Rights, and interests at stake. This chapter reflects on the competing rights and interests of the differing stakeholders involved in the use of health data for health research purposes. We argue that regulatory frameworks need to account for and engage with these competing motivations and interests, and must also ensure that benefits arising are accessible to stakeholders in an equitable manner. We set out some of these competing interests before considering the GDPR and possible role of the EHDS for the governance of data in the health research context given these considerations. We argue that privacy and re-identifiability are not the only concerns relevant here, and make the case that both regulations fail to fully consider the wider social and ethical concerns in this space. The chapter concludes by reflecting on the limits of both regulations, with proposals for reframing of the system from one primarily focused on individual risk to a system that considers both the individual and collective risks and benefits at stake.