The recent EU legislative initiatives promoting data sharing are sectoral and cross-sectoralinstruments that aim to make data available by regulating the reuse of publicly and privatelyheld data, including personal data. They also facilitate data sharing by creating of novelintermediaries and sharing environments where the parties involved can pool data and facilitiesin a trusted and secure way.Common European data spaces (EU data spaces) are a novel concept introduced in theEuropean strategy for data and elaborated further within the Data Governance Act (DGA). It isenvisioned that they will facilitate innovation, economic growth and digital transformation andrevolve around creating a framework for data sharing that respects privacy, security and otherapplicable regulatory considerations while promoting cross-sector collaboration andinteroperability.This report attempts to contextualise the main design principles regarding protection of personaldata and demonstrate how to engineer personal data protection through two use cases of anenvisioned EU data space in the pharmaceutical domain.Despite the potential of the EU data spaces, there are still considerations regarding appropriatetechnical and organisational measures and how to engineer them into practice, both from a dataprotection and from a cybersecurity point of view. Even if there are already a good number ofprivacy enhancing technologies that can support us in meeting specific data protection goals,we should not neglect the fact that we are called to address new processing operations, wherethe roles and responsibilities are not always clearly defined.