Neurodata governance

1. Balancing emerging neurotechnology benefits and privacy considerations

Neurotechnologies are “devices and procedures used to access, monitor, investigate, assess, manipulate, and/or emulate the structure and function of the neural systems of natural persons”. Policymakers are increasingly recognising these technologies as a critical frontier to support greater social inclusion, individual and societal resilience, and more productive, performing societies. Originally developed within clinical and therapeutic contexts to support diagnosis, treatment, and rehabilitation (OECD, 2019[1]), neurotechnologies are now advancing rapidly in both capabilities and in the range of emerging applications. This wave in innovation is opening transformative possibilities for health—from clinical neuroprosthetics to cognitive enhancement tools—offering substantial potential to improve lives and strengthen economies.

As capabilities grow and devices become more accessible, applications are expanding beyond health into education, work, wellbeing, and entertainment. This shift brings into sharper focus a set of governance challenges that call for a more forward-looking approach to neurodata. For example, information collected for therapeutic, wellness or research purposes could be repurposed for profiling, product development, targeted advertising, workplace analytics, or insurance risk assessment. Risks of discriminatory outcomes further reinforce the need for stronger governance, as neural data may encode biases, leading to unequal treatment in areas such as employment, education, and insurance.

Finally, ensuring meaningful consent and preventing coercion—especially in asymmetrical contexts such as workplaces or schools—requires safeguards that go beyond formal consent mechanisms. Together, these developments underscore the need for comprehensive neurodata governance frameworks that address not only data protection, but also power imbalances, downstream uses and the unique risks associated with technologies that can both read from and act upon the human brain.

It should be noted that this paper focuses on privacy and data governance implications of neurodata within the current regulatory landscape. It does not intend to analyse all ethical considerations of neurotechnology such as autonomy and neuromodulation. These highly pertinent areas deserve dedicated consideration beyond the data governance and privacy angle adopted here.

Emerging neurotechnology applications and policy implications

To ground policy discussions in real‑world developments, the OECD convened a multistakeholder expert workshop on the privacy implications of neurotechnologies in June 2025 (hereinafter, “the workshop”). On this occasion, neurotechnology companies presented concrete applications currently under development or already in clinical use. These demonstrations highlighted that although the sector is still in its early stages, two complementary benefit pathways are already visible: technologies that restore lost function and treat neural-related conditions in clinical contexts, and consumer‑oriented tools aimed at enhancing daily performance and wellbeing. Taken together, these developments underscore the growing societal relevance of neurotechnology and the need for coherent regulatory frameworks.

Therapeutic restoration of lost function

Clinical demonstrations presented during the workshop illustrated the transformative potential of implantable brain–computer interfaces and similar systems. First, a company demonstrated the profound impact neurotechnology can have for individuals experiencing severe paralysis. Its implantable brain‑computer interface (BCI) supports the restoration of digital independence by enabling users to interact with digital devices through neural signals alone. The company, which has engaged with the U.S. FDA since 2016–2017, has completed two clinical trials involving ten patients, showing meaningful gains in autonomy.

A notable personal example relates to an individual living with Amyotrophic Lateral Sclerosis (ALS) who received the implant in 2019. The system captures movement‑related brain activity and transmits it to a chest‑implanted device, which then communicates via Bluetooth with external devices—enabling users to perform essential “digital activities of daily living” (dADLs), such as communication, shopping, and environmental control. According to company representations, processing occurs locally on the device, which is intended to safeguard user privacy by avoiding cloud‑based computation. This case shows how neurotechnology can restore dignity, independence, and social participation for people with significant mobility and function impairments.

Support daily performance and wellness

A second class of benefits emerges from consumer‑oriented neurotechnology beyond the realm of health. Since 2018, consumer‑focused companies have outnumbered those developing medical devices (Centre for Future Generations, 2025[2]; ICO, 2023[3]; Council of Europe, 2021[4]). During the workshop, another company showed how brain‑sensing capabilities are integrated into earbuds. This approach aims to democratise access to neurotechnology by embedding Electroencephalography (EEG)‑based sensing into familiar devices. For example, one product uses in‑ear sensors to collect EEG and movement data, enabling the extraction of cognitive and behavioural insights. Advances in AI, including brain foundation models, are rapidly accelerating the ability to translate raw brain data into meaningful, real‑time indicators.

Building on these insights, the company is prototyping personalised interventions such as adaptive audio experiences that respond to users’ brain states. Potential applications include improving sleep quality, supporting mindfulness and wellness and enriching gaming experiences. While the market is still emerging, these developments illustrate how non‑medical neurotechnology can support everyday well‑being and empower users to better understand and manage their cognitive states. At the workshop, the company mentioned that regulatory ambiguity exists surrounding consumer neurotechnology (i.e., non-medical contexts) and emphasised the importance of clear, actionable frameworks that protect users while enabling innovation.

The emerging evidence shows significant potential benefits, but also highlights the urgency of establishing clear, anticipatory governance frameworks elaborated through multi-stakeholder cooperation.

Increased neurodata oversight in the face of new privacy risks

Neurotechnologies carry both opportunities and complex risks that should be managed responsibly. Issues related to privacy, mental autonomy, data security, and unequal access highlight the need for protecting people’s rights and interests and maintaining public trust.

Regarding privacy specifically, the characteristics of neurodata give rise to a set of distinct risks as they can reveal information that individuals may not intend or even be able to control. Firstly, neurodata are generated automatically by the brain, meaning people cannot consciously control what is revealed; secondly, organisations could gather extensive, complex neurological data that enables them to infer deeply sensitive attributes, including aspects of mental health; thirdly, because neurotechnologies can both monitor brain activity and potentially influence it, they introduce heightened concerns about opaque automated processing and behavioural manipulation (ICO, 2023[3]).

These risks emerge as progress in the field is accelerated by technologies and applications that collect and process an increasingly diverse range of data. This includes neural signals captured through implanted or wearable sensors, physiological data from biometric monitoring systems, behavioural and cognitive data generated through user interactions, and contextual data drawn from users and their external digital environments and connected devices. Together, these inputs create a rich but highly complex data ecosystem—one that significantly heightens the challenges for effective data governance and robust privacy protection (Winickoff, Kreiling and Lennad, 2024[5]; Ienca et al., 2022[6]).

As a result, privacy regulators tend to adopt a broad definition of the term neurodata to include all these dimensions within the scope of the law. For example, the European Data Protection Supervisor (EDPS) defines neurodata as “information gathered from the brain and/or from the nervous system” as well as the inferences derived from these signals, such as emotional states or behavioural tendencies (European Data Protection Supervisor, 2024, p. 4[7]). This broad definition aims at protecting individuals not only with regard to the collection of raw neural signals, but also with regard to the increasingly powerful inferences that can be drawn from them as neurotechnologies rapidly evolve.

By contrast, the American Medical Association (AMA) adopts a narrower, more objective definition focusing on directly measured signals, by describing neural data as information obtained by measuring the activity of a person’s central or peripheral nervous system through neurotechnologies, explicitly excluding data inferred from non-neural information (American Medical Association, 2024[8]).

Finally, research such as Neurodata Without Borders (NWB) classifies neurophysiology data across different modalities within a unified framework. While these standards serve scientific objectives, they also illustrate the diversity and granularity of neurodata, which can increase the potential for identifiability, sensitive inference, and unintended secondary uses (Liu et al., 2022[9]; Rübel et al., 2022[10]). Examples of the latter may include neurodata reuse for AI training, profiling, product development, advertising, employer analytics or insurance risk modelling.

These definitional differences, which can be explained by differing conceptual boundaries, can yet create misunderstandings between privacy and clinical communities regarding what information should be subject to neurodata governance and protection. While developing operational criteria to determine when neurodata should be classified as biometric data, health data or other sensitive data would be highly valuable for regulatory certainty, establishing such criteria falls outside the scope of this paper and represents an important avenue for future interdisciplinary research and policy development. Broad regulatory definitions of neurodata often trigger enhanced protection requirements—such as the need to obtain explicit consent from individuals—which clinicians may view as neither appropriate nor effective in all circumstances. This highlights the importance of adopting a responsive and evidence-based approach to neurodata privacy, one that is grounded in a realistic assessment of risks and benefits and capable of evolving alongside scientific knowledge and technological developments.

Responsive policy approach needed

Effective and appropriate regulation is needed to deliver all the benefits of neurotechnology to individuals while protecting their privacy. Overly restrictive rules may inhibit innovation and reduce the societal benefits neurotechnology can deliver, while insufficient oversight may fail to mitigate emerging risks and undermine public trust. A responsive approach, evidence-based, adaptable to technological change, and aligned with public expectations, is needed to advance innovation and economic dynamism (OECD, 2025[11]).

Strengthening oversight of neurotechnologies requires focused analysis in four areas:

• Governance landscape for neurotechnologies and neurodata

• Diversity of business models and the role of data in companies’ R&D and value proposition

• How neurodata and personal data are generated, processed, and used throughout the data lifecycle, as well as the data‑related challenges companies face, including the impact of data protection requirements on product development

• How companies engage with regulatory systems, and their experiences with regulators and public authorities.

The paper identifies gaps in knowledge, regulatory coverage, and institutional coordination across all four dimensions. It maps the complex governance landscape applicable to neurodata made of a mix of international instruments, legislative frameworks, and regulatory guidance (Section 2), presents evidence from industry on data flows and governance challenges (Section 3), and outlines a forward‑looking set of policy options (Section 4).

Together, these analyses suggest that a “one-size-fits-all governance” risks to result in concerns of uneven oversight and hindrance to innovation, while potentially overlooking high-risk uses. Consequently, policymakers and regulators need further evidence to design a more nuanced approach to the governance of neurodata. This paper contributes to that evidence base, but continued dialogue is needed to gather additional evidence in close consultation with industry and regulatory bodies. Ultimately, such efforts will reinforce data governance and privacy in neurotechnology and contribute to leverage its societal and innovative value.