The present article emerges from the project ‘RECAP preterm – Research on European Children and Adults Born Preterm’ which has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 733280. Under this project, a report, whose objective was to describe and compare the Challenges and Opportunities of Record-Linkage Processes, was developed by an ISPUP partner and presented in September 2019. Now, we discuss the issue focused on General Data Protection Regulation (GDPR) and national law, with a critical view as to how the legal regime for accessing routinely collected health and educational data and its subsequent processing for research purposes. The main results of this article are the reflection on the difficulties that scientific research faces and the consideration of future legislative changes in a world where data protection is a priority policy concern. Although scientific research in health is recognised by International, European and National law as an asset for the development of society, this article seeks to demonstrate that the possibilities for access and use of personal data, including sensitive data, are not broad.