From regulation to realisation secure processing environment for the European Health Data Space

This thesis operationalises the European Health Data Space (EHDS) notion of a Secure Processing Environment (SPE) by translating technology-neutral regulatory obligations into implementable and testable platform requirements. Following a Design Science Research approach, it introduces a traceability-centred translation mechanism that incrementally refines legal clauses into role-specific requirements and consolidates them in a traceability matrix, keeping interpretations, responsibilities and control points explicit along the EHDS secondary-use journey. Based on this requirements baseline, the thesis designs and implements Badger, a cloud-native SPE prototype on Kubernetes that supports end-to-end workflows, from identity and access management to permit-bound workspaces and controlled result export via an airlock. Evaluation using EHDS-aligned scenarios and a traceability-matrix cross-check indicates strong coverage where obligations can be mapped to enforceable workflow steps and isolation boundaries, while exposing open challenges in enforcing permit conditions and providing a complete end-to-end audit trail. The thesis contributes a reusable method for regulatory grounding under legal uncertainty. For practitioners, it offers a checklist-style traceability matrix and a modular blueprint for realising EHDS-compliant SPE workflows.