HDS Certification Is Evolving: What You Need to Know About HDS v2.1

Just when you thought the transition to Version 2.0 of France's Hébergeur de Données de Santé (HDS) — or health data hosting — was almost complete, the certification framework is undergoing another significant update. Following the publication of the Law on Securing and Regulating the Digital Space (SREN) decree on March 24, 2026, a new version of the standard, referred to as HDS v2.1, is now in development.

In this article, we’ll detail the transition to HDS v2.1, what’s changing, new requirements for hosting providers, the timeline involved, and how to prepare for certification.

The HDS v2.0 Transition: What's at Stake

The transition from HDS v1.1 to v2.0 has been well underway since the v2.0 standard was published by decree in April 2024; however, the deadline is firm. After May 16, 2026, all HDS certificates issued under v1.1 will no longer be valid. Any organization that has not yet completed its transition should treat this as an urgent priority.

Why The Transition To v2.1? The SREN Act and Its Impact

Article 32 of the SREN Act, adopted on May 21, 2024, introduced new obligations for health data hosts that the existing v2.0 framework does not fully reflect, including:

• A mandatory obligation to store personal health data exclusively within the European Economic Area (EEA), specified by decree
• New contractual disclosure requirements when data transfers, including remote access, involve countries outside the European Union (EU)/EEA
• Extension of HDS certification obligations to hosting providers offering electronic archiving services

These changes required a formal update to the certification framework, giving rise to HDS v2.1.

Certification Requirement Updates in HDS v2.1

The updates are precise and legally grounded. Here are the key changes to the certification framework:

• Activity 6 (renamed): This reflects the SREN Act's explicit extension of the HDS certification obligation to electronic archiving services, meaning hosting providers offering this type of service are now unambiguously within scope. The backup of health activity now explicitly covers retention of health data in the context of electronic archiving, reflecting the SREN obligation.
• Requirements 28 & 29 (updated data transfer rules): Both requirements now reference Article R.1111-9-1 of the code de la santé publique (CSP), or French Public Health Code. Additionally, Requirement 29 makes clear that remote access from outside the EEA is treated as a data transfer and must either be covered by an EU adequacy decision or by appropriate safeguards under GDPR Article 46, and the customer must be informed of the specifics in the contract.
• Requirement 19 (expanded patient rights): Hosting contracts must now explicitly enumerate patients' rights under GDPR Articles 15–21, including rights of access, rectification, erasure, portability, restriction of processing, and objection.
• Requirements 23-1, 23-2, and 23-3 (contract transparency on data transfers): These requirements impose structured disclosure obligations in hosting contracts:
  • 23-1 (renumbered from previous Requirement 23): Contracts must describe access governance and any applicable transfer information under Article R.1111-9-1, including remote access scenarios.
  • 23-2 (new): Takes up Requirements 29 and 30 of the v2.0 standard by requiring that this information be indicated in the contract even if the third country is the subject of an adequacy decision. If the host or a subcontractor is subject to legislation of a third country that is not a member of the EU or a party to the EEA, the contract must list the applicable regulations, the relevant adequacy decision (if any), and both the mitigation measures and the residual risks where no adequacy decision exists.
  • 23-3 (new): Imposes that the information which is published as part of Requirement 31 (representation of guarantees) must be stated explicitly in the contract.
• Requirement 31 (public transparency map): Adds a reference to III of Article R.1111-11 of the French Public Health Code. Hosts must publish and keep an up-to-date public map of all personal health data transfers outside the EEA, including remote access situations and risks of unauthorized access.

What HDS v2.1 Means Operationally

For hosting providers, the primary obligation is to update customer contracts to reflect the new disclosure requirements.

For certification bodies (CBs) such as Schellman, the changes require:

• Updating issued certificates to reflect the v2.1 framework version and the renamed Activity 6
• Adding controls to verify that new contract templates incorporate the revised requirements, and that existing contracts have been updated for sample testing

What Comes Next: The HDS v2.1 Timeline

The path to HDS v2.1 publication follows a structured sequence that began in March 2026 with the following tentative timeline:

1. March 24, 2026 — SREN HDS decree published in the Official Journal
2. March-May 2026 — Public consultation on the v2.1 framework
3. May-July or August 2026 — Notification period with the European Commission
4. August-September 2026 (estimated) — HDS v2.1 published in the Official Journal

Once published, audits conducted three months after the publication date, whether initial, surveillance, or renewal, will be carried out under v2.1. The most substantive work for hosting providers lies in updating the contractual language to meet the new data sovereignty and transparency obligations. Organizations that start reviewing their contracts now will be well-positioned when the new standard takes effect.

How To Prepare for HDS v2.1 Certification

With the v2.0 transition deadline firmly set for May 16, 2026, now is the time for organizations to look ahead at what HDS v2.1 will bring and begin positioning themselves accordingly.

While v2.1 is still an emerging standard, compliance teams can take several steps today to prepare:

• Complete your v2.0 transition first. If your organization has not yet finalized its HDS v2.0 certification, that remains the immediate priority. A valid v2.0 certificate is the foundation from which your v2.1 readiness will be built.
• Review the v2.1 changes against your current documentation and controls. Identify gaps early so remediation efforts can be planned and resourced proactively, rather than addressed later under deadline pressure.
• Engage your certification body early. Understanding how your auditor is interpreting the new requirements will help you align your internal processes before your next audit cycle.
• Update your internal training and awareness materials. Any changes to security or data protection requirements under v2.1 should be reflected in how your teams are trained and how policies are communicated across the organization.

Staying ahead of certification changes is a signal to partners, customers, and patients that your organization takes data protection seriously. To learn more about HDS v2.1 or for additional information about the certification requirements or timeline, contact us today. In the meantime, discover other HDS certification insights in these helpful resources:

• The New HDS Framework Explained
• How to Prepare for HDS Certification
• How HDS Certification Can Help Protect Your Health Data