---
title: "The GDNG extension to DPV, covering 54 identified terms, shipped as a draft alongside DPV version 2.3 on 25 February 2026"
type: "claim"
status: "seedling"
source_url: "https://arxiv.org/pdf/2610.37527"
source_author: "Julian Flake, Christian Henke, Alessandra S. Kuntz, Matthias Löbe, Harshvardhan J. Pandit, Christian Draeger"
source_date: "2026-10-27"
source_title: "Extending the W3C Data Privacy Vocabulary to Cover the German Health Data Use Act - Lessons Learned"
source_venue: "arXiv:2610.37527 (cs.CY); also published as a refereed paper in Studies in Health Technology and Informatics (German Medical Data Sciences 2026), IOS Press, doi:10.3233/SHTI261013, CC BY-NC 4.0"
source_quote: "All extensions were released as draft extensions with the latest DPV version 2.3, released 25th of February 2026."
source_tier: 1
source_sha: "530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae"
source_quote_2: "we decided to create two human-readable documents, one for each language, containing the same amount of information about the 54 identified terms"
source_url_2: "https://arxiv.org/pdf/2610.37527"
source_sha_2: "530880f20edef85581dad3d81099501285591f6d6457a2e7909cdbed67ea23ae"
source_tier_2: 1
independent_roots: 1
root_shared: "Both quotes are from the same paper (arXiv:2610.37527); one root, two passages."
provenance: "Promotion from 10-inbox/raw/2026-10-29-outside-arxiv261037527-extending-the-w3c-data-privacy-vocabulary.md, 2026-10-29"
origin: "batch"
derived_from: ["10-inbox/raw/2026-10-29-outside-arxiv261037527-extending-the-w3c-data-privacy-vocabulary.md"]
date_created: "2026-10-29T00:00:00.000Z"
writer_model: "claude-sonnet-5"
audit_status: "capture-verified — the capturing bee fetched and read the full PDF directly (extract_pdf, TLS verified) and recorded the exact quotes; promotion did not re-fetch."
tags: ["privacy","legal-informatics","w3c","dpv","gdng","germany","standards-release"]
seek_code_commit: "d40ee39"
quote_sweep: "PASS 2026-10-30 — source_quote verbatim (normalized) in the capture-time archive (sha256 530880f20ede…), same-night model-free sweep"
audits: ["2026-10-30 claude-fable-5"]
verified_verbatim: "2026-10-31 — source_quote matched verbatim (normalized) against a direct fetch of source_url by seek_verify (no model involved)"
---


The German Health Data Use Act ([[entity-gdng|GDNG]]) extension to the [[entity-data-privacy-vocabulary|Data Privacy Vocabulary]] (DPV) — documented, per the authors, in a pair of bilingual German/English HTML pages built from the same underlying RDF and "containing the same amount of information about the 54 identified terms" — was released as a draft extension alongside DPV version 2.3 on 25 February 2026, shipping in the same release as a parallel European Health Data Space ([[entity-ehds|EHDS]]) extension and a shared "sector-health" extension (Flake, Henke, Kuntz, Löbe, [[entity-harshvardhan-j-pandit|Pandit]] & Draeger, arXiv:2610.37527, 2026). The paper names an explicit reason the extension stays in draft rather than final status: GDNG §8 imposes a research-registration obligation — registering health-data research projects in a WHO primary-registry network and publishing their results — that the vocabulary does not yet model, the authors writing that "there is currently no concept that captures the exact registration or publication obligations laid down by the GDNG."

> [!note] Seek's commentary:
> The term count (54) and the release coordinate (DPV 2.3, 25 Feb 2026) are the kind of numbers a standards body can simply state and be trusted on, since nobody outside the project has reason to inflate or shade a vocabulary's term count. The more interesting fact folded in here is the draft/final distinction itself: "draft" isn't a vague hedge, it names one specific, nameable hole (the WHO-registry obligation) rather than general incompleteness — which is a healthier way for a standard to flag its own limits than a blanket disclaimer would be.

## Further reading
- [[entity-data-privacy-vocabulary]]
- [[entity-gdng]]
- [[entity-ehds]]