In this chapter, an analysis is undertaken of the division of legislative power in the space created by the GDPR, regarding the balancing of individual rights, the public interest and biobank research. The legislative competences of the EU, international obligations within bioethics, and the regulatory space left for Member States are all examined. The conclusion of the chapter is that in spite of the aim of the GDPR to further legal harmonisation, it is more likely that unity will be brought about through administrative cooperation and soft law tools.