Background <p>When using ePortfolios in healthcare education, the collection and processing of personal data from various stakeholders, also known as data subjects (e.g., students, mentors, supervisors) is inevitable. This is why it is crucial to identify the stakeholders who need to comply with legal obligations imposed by data protection law, and to assess the legal grounds for processing personal (health) data. Research on the legal aspects of such ePortfolios is lacking. Therefore, the aim of this study was to identify and document the data protection requirements for ePortfolios in clinical healthcare education that apply in the EU.</p> Methods <p>Desk research based on a traditional legal analysis of legislation, policy documents, guidelines, case law, and legal doctrine was performed during a multidisciplinary ePortfolio research project.</p> Results <p>The analysis resulted in a description of the relevant EU data protection requirements covering the Charter of Fundamental Rights and the General Data Protection Regulation, a translation of these legal requirements into the context of ePortfolios in clinical healthcare education and the formulation of recommendations for data protection compliance based on these insights: (1) the duties and responsibilities of educational institutions and the healthcare student must be clarified in an agreement before the start of an internship, (2) ‘(substantial) public interest’ is the most appropriate legal basis for the processing of health data in ePortfolios, and (3) adequate and appropriate measures to protect the fundamental rights and interests of the data subjects must be provided.</p> Conclusion <p>This study contributes to the limited literature on the legal aspects of the use of digital technologies, such as ePortfolios, in healthcare education. There is a need for rigorous evidence on how to design legally compliant ePortfolios for healthcare education.</p>