Health research in vaccine development has been crucial during COVID-19. The GDPR has provided mechanisms and various safeguards to process sensitive data for health research. That said, consent in the GDPR is not an attractive option for health research as there are a number of practical difficulties. Public authorities and private entities may rely on the legitimate basis of public interest and legitimate interests, respectively, together with other lawful grounds under special categories. However, applying these legitimate bases mainly depend on the laws of member states. The guidelines of the EDPB provide broad suggestions on the GDPR in health research, but it lacks concrete guidance on trans-national health research. Using genetic data for cross border health research is hampered by the divergence of privacy laws among countries. Hopefully, these countries will understand the importance of establishing a multilateral framework to process genetic data for health research in vaccine development, allowing for more harmonized cooperation to fight COVID-19.