Cross-country variation in the use of personal health data is linked to differences in risk management in the trade off between risks to individual patient privacy and risks to public health and the good governance of health systems. Informed consent has become the pillar for protecting individual’s autonomy. The requirement to obtain patient consent is often either impossible or impracticable when studies involve the linkage of national historical databases. There is significant variation across countries in granting an exemption to patient consent requirements for projects within the public interest. Among the 19 countries participating in this part of the study, ten countries report that an exemption to patient consent requirements is possible under existing law; while seven countries report that an exemption is not possible without introducing new authorising legislation. There are also concerns with compliance with the legality and appropriateness of sharing data between government authorities that either prevent data linkages (four countries) or result in lengthy and complex negotiations (four countries).This chapter discusses the OECD guiding principles for the protection and transborder flow of personal data and cross-country differences in the application of these principles found in these OECD studies, including in the conduct of data linkage activities, the sharing of data and in the development of data from electronic health records.