Research in public health is particularly dependent on the unrestricted use of data. The processing of personal health data can serve health-related public interests and bring significant benefits to individuals and society ( https://www.oecd.org/health/ministerial-statement-2017.pdf ). In contrast, data protection law aims to protect personal data and is consequently based on the prohibition principle and the principle of purpose limitation. Although the General Data Protection Regulation (GDPR) also contains research-friendly approaches and provides the possibility of privileging research data processing at various points, in practice, data protection still poses challenges to research for public health purposes. The concept of consent is questionable, and—especially in Germany—many uncertainties arise from the complex patchwork of state-specific regulations. New concepts such as “broad consent,” “dynamic consent,” “no consent,” and “synthetic data” are intended to facilitate the processing of data for research purposes in line with data protection law. Fueled by these debates, national and international data protection laws will inevitably have to face changes in the near future.