The report gives an overview of the existing legislation in the Nordic countries regarding the collection and re-use of health-related personal data in medical research. It also looks at how ethical review is integrated in the regulatory frameworks, including in the European general data protection regulation that will come into force May 2018.