Key points The secondary use of health and genetic data between different actors and countries can be medically and scientifically rewarding, but it requires a solid legal framework to enable responsible cross-border and cross-sector access to such data. From an EU data protection law standpoint, such secondary use requires a legal basis under Article 6(1) and a permission under Article 9(2) of the EU General Data Protection Regulation (GDPR). However, we argue that, in practice, a suitable legal basis is not always available to all stakeholders to process health and genetic data for secondary uses. The EU has recently proposed a European Health Data Space (EHDS), which is the first common EU ‘data space’ in a specific area to emerge from the ‘European strategy for data’. Among other aims, the EHDS seeks to provide a consistent, trustworthy, and efficient system for reusing health and genetic data for research, innovation, policy-making, and regulatory activities (ie, secondary use). Yet, the EHDS does not account for the different phases in the data reuse lifecycle in a sufficiently encompassing manner, resulting in missing or insufficient GDPR legal bases for undertaking certain crucial processing operations. As a result of the dependency on legislative acts and the varying nature of stakeholders involved, we find that there can be significant hurdles for secondary use, and some actors can even be excluded from participation entirely. Consequently, we advocate new data protection legislative solutions to harmonize data for cross-border sharing.