GDPR Article 9 and Manuscript Editing: Can You Send Patient Data to an Editor or an AI Tool?

During medical manuscript editing, drafts pass to language editors, translators, publishers and AI writing platforms. Each handover can disclose health information. Patient data protection and medical data privacy depend on whether patients remain identifiable, whether the processing is lawful and whether the recipient offers appropriate safeguards; case reports are a common example [2].

GDPR Article 9 prohibits processing special-category personal data, including data concerning health, unless one of the conditions in Article 9(2) applies [1]. Diagnoses, histories, treatment records and genetic results all qualify, which is why sensitive health data under GDPR turns up even in routine manuscript details.

Article 9 never works alone. Processing needs a lawful basis under Article 6 and an Article 9(2) condition, such as explicit consent, health care, public health or scientific research under EU or national law [1]. Consent to join a study does not automatically cover later disclosure to an external editor or AI service, and the Article 5 principles of purpose limitation, data minimisation and security still apply.

In GDPR and manuscript editing arrangements, the party that decides the purposes and means of processing is the data controller: usually the researcher’s hospital, university or sponsor. An external editor handling personal data on the controller’s documented instructions is a data processor, and Article 28 then requires a contract, often called a data processing agreement, covering instructions, confidentiality, security and sub-processors [1]. A bare confidentiality clause does not replace it, and the recipient’s actual activities, not the label “editor”, decide its role.

An AI platform’s role likewise depends on what it does with content: whether it only provides the requested service, retains submissions, allows human review or uses them to train models.

These provisions work together. A contract with an editor does not, on its own, establish a lawful basis.

Health data anonymisation means no one is identifiable by any means reasonably likely to be used; genuinely anonymous data fall outside the GDPR (Recital 26) [1]. Pseudonymisation of patient data replaces direct identifiers with codes and keeps the key separately. It lowers risk, but pseudonymised data remain personal data: a safeguard, not an exemption [3]. The EDPB’s Guidelines 02/2026 on anonymisation are still a draft open for consultation until 30 October 2026 [4].

Clinical manuscripts are hard to anonymise because identification is often indirect: a rare diagnosis, exact age, treatment date, small locality or distinctive sequence of events, plus images, captions, supplementary files and document metadata. De-identification lowers but does not remove re-identification risk: it is very low in secure research environments [5], but de-identified notes still leak information that a less controlled setting can exploit [6]. Review the whole package and generalise unnecessary detail while keeping the scientific meaning.

AI-assisted manuscript editing may be possible, but combining AI tools and patient data needs a deliberate assessment. Uploading personal data is processing, so it needs the same lawful basis, Article 9 condition and safeguards as any other disclosure. A provider’s promise not to train on your content does not by itself make the processing lawful. Ask:

• Is identifiable information necessary? Grammar and style correction rarely needs names, exact dates or hospital numbers.
• What happens to submitted content? Check retention, deletion, human access, reuse and model training terms.
• Who can access it, and where? Consider sub-processors, locations and whether transfer rules apply.
• Has the institution approved the tool? Research agreements and publisher policies may restrict external AI services.
• Is a DPIA needed? A data protection impact assessment under Article 35 may be required for high-risk processing.

The European Data Protection Supervisor’s guidance on generative AI is useful reading, but it is addressed to EU institutions under Regulation (EU) 2018/1725, not to every hospital, university or commercial provider [7].

GDPR international data transfers arise when an editor or AI provider accesses personal data from outside the EEA; the provider’s headquarters alone does not settle it. Under Chapter V, a transfer can rely on an adequacy decision or safeguards such as standard contractual clauses, set out in Commission Implementing Decision (EU) 2021/914 [8]. The right module and any transfer assessment depend on the parties’ roles. Proportionate security includes restricted access, encryption, secure transfer, controlled retention and a data breach response plan.

GDPR compliance does not replace clinical confidentiality, ethics approvals, data-sharing agreements or journal rules, and consent to publish an identifiable case report is separate from the lawful basis for editing. Responsible sharing of clinical data also needs governance and clear conditions for reuse [9].

Use this GDPR compliance checklist before sending a manuscript to an editor, translator or AI platform.