Data protection in clinical research

Clinical research processes personal data in databases, trial files and documents. Protecting those data requires a lawful basis, defined responsibilities and safeguards throughout their use.

Scope of the GDPR

The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, has applied since 25 May 2018. ^{1, 2, 3, 4, 5} Its aims include harmonising EU data-protection law, strengthening individuals' control over their personal data and improving security. ^{6, 4} It applies across industries, including medical writing that involves access to personal health information. ^{7, 8, 9}

Clinical databases, case report forms, trial master files, protocols and clinical study reports can fall within its scope, whether records are electronic or on paper. ¹⁰ Companies established in the EU are covered, and the regulation also reaches organisations outside the EU that monitor people in the EU. ^{11, 12} A sponsor outside the EU running a global trial with an EU site may therefore be covered even without an EU office. ¹²

Anonymous information and information about legal entities such as companies fall outside the regulation's personal-data scope, as does processing for purely household or personal purposes. ^{10, 11} The regulation protects living people; national rules may additionally protect deceased people's data. ^{13, 14}

Personal data and processing

The following distinctions define types of data encountered in clinical research. ¹⁵

Term	Meaning
Personal data	Information relating to an identified or identifiable living person, including through names, identification numbers, location or online identifiers, or physical, physiological, genetic, mental, economic, cultural or social characteristics; separate pieces can identify someone when combined.
Genetic data	Personal data about inherited or acquired genetic characteristics, providing unique information about physiology or health and resulting particularly from analysis of a biological sample.
Biometric data	Data from technical processing of physical, physiological or behavioural characteristics that permit or confirm unique identification, such as facial images or fingerprints.
Sensitive personal data	Data whose nature and processing context create particular risks to rights and freedoms; examples include racial or ethnic origin, political opinions, religion or beliefs, trade-union membership, genetics, health and sexual orientation.
Health data	Personal data about physical or mental health, including healthcare provision, that reveal health status.
Protected personal data	EMA Policy 0070's term for information about an identified or identifiable person, including identification through numbers or physical, physiological, mental, economic, cultural or social factors.
Individual patient data	Data recorded separately for each participant in a clinical study.
Aggregated data	Statistical data combined across people to show trends or values without identifying individuals.

^{15, 16, 4, 2, 17}

Omitting names and addresses does not remove trial data from scope, and staff data must be considered alongside participants’ data. ¹⁸

Trials process demographics, health and genetic data, some of which are sensitive and require additional safeguards. ^{19, 20} Processing includes manual or automated collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure, dissemination, combination, restriction, erasure and destruction. ²¹ Collection, analysis, reporting and sharing during a clinical trial are processing, so sponsors, contract research organisations (CROs) and sites all participate in it. ^{21, 22}

Data sharing means making data available to others, while personal-data protection concerns the rights of data subjects. ²¹ Transparency under GDPR means lawful, fair processing with information for the person about data use, storage, access and dissemination; clinical-research transparency instead concerns sharing research data to meet requirements and advance knowledge. ²¹

Controllers, processors and medical writers

A data subject is the living person whose data are processed. ¹⁶ The controller determines, alone or jointly, the purposes and means of processing; a processor processes personal data on the controller's behalf. ^{16, 23} A sponsor typically acts as controller, a CRO may act as co-controller or processor, and a site may act as processor; a sponsor may also process its own data. ¹⁸

Medical-writing providers processing personal data on behalf of trial controllers have processor responsibilities, but their role is sometimes overlooked, leaving safeguards and breach risks underestimated. ^{20, 24} Article 28 requires controllers to use processors providing sufficient guarantees of appropriate technical and organisational measures to protect subjects' rights. ²⁰ Responsibilities should be defined before work begins in the contract, and CRO writers should consult company privacy experts while sponsor writers seek input from their own privacy function. ^{25, 26}

In clinical-report anonymisation, the sponsor as controller decides the balance between protection and data utility; the CRO processes both study data and the personal data involved in anonymising reports. ^{27, 28} The CRO may propose technical approaches but must follow the controller's instructions, and GDPR requires a data-processing agreement governing that work. ²⁸ The controller carries the main accountability for compliance. ²⁴

A recipient is a person or body receiving disclosed personal data, except a public authority receiving them within a particular inquiry under EU or Member State law. ¹⁶ A data exporter transfers personal data from the EU/EEA to a non-EEA country or international organisation and must meet applicable transfer requirements. ¹⁶ Independent data-protection authorities in Member States supervise the law using investigative and corrective powers. ¹⁶

Anonymity and identifiability

Pseudonymisation prevents attribution to a specific person without additional information, which must be kept separately under technical and organisational safeguards. ^{20, 29} Trial subject codes replacing names are pseudonymisation; coded trial data remain personal data within GDPR. ^{30, 31, 29} Encryption or use of the label “de-identified” does not remove data from scope if re-identification remains possible. ²⁹

Anonymous information does not relate to an identifiable person, or has been rendered anonymous so the person is no longer identifiable; Recital 26 excludes it from GDPR. ^{29, 20, 17, 24} Anonymisation must be irreversible. ^{29, 21} Direct identifiers allow direct recognition or contact, such as names, emails, telephone numbers and addresses; indirect identifiers include background demographics, characteristics, attributes and socioeconomic information. ²⁹

The data a writer handles depend on the document. ^{20, 31}

Document	Participant data typically encountered
Clinical study report	Pseudonymous data that may identify someone when datasets are combined; exceptionally, directly identifiable data in submissions to authorities.
Statistical outputs	Pooled or pseudonymous data.
Safety reports	Identifiable data; exceptionally, directly identifiable data.
Case reports	Identifiable data; exceptionally, directly identifiable data.
Scientific journal articles	Pseudonymous data that may identify someone when datasets are combined.

³¹

Writing real-world evidence documents may expose writers to identifiable information in free-text CIOMS suspected-adverse-reaction forms completed by healthcare professionals. ^{32, 33} Safety-report sources can include clinical and safety databases, registries, mobile devices, apps, patient diaries and electronic health records; quality control by additional writers and statisticians widens access and security risk. ³³

A registry for a rare condition with perhaps 100 patients in a country can permit identification through combined fields even when names and addresses are not collected. ^{34, 35} Collecting only a birth year, or month and year, rather than a complete birth date can reduce personal information, provided the remaining data still permit meaningful analysis. ^{35, 36}

Lawful processing and research consent

Processing health-related personal data requires both an Article 6 legal basis and an Article 9(2) condition permitting processing of the special-category data. ³⁷ Explicit consent is one route, but other grounds exist. ^{38, 3} Possible Article 6 grounds include legitimate interests or performance of a public-interest task. ³⁹ Article 9(2)(j) provides for scientific-research processing subject to conditions, including Article 89(1), proportionality, respect for data-protection rights and suitable safeguards. ³ Article 89(1) requires minimisation: research should use data that do not permit identification where possible, with pseudonymisation or anonymisation as far as feasible. ³⁷

Consent to participate in a trial and consent as a data-processing basis serve different purposes, as the Commission's April 2019 questions and answers on GDPR and the Clinical Trials Regulation clarified. ⁴⁰ Rules requiring informed consent for participation continue to apply even when processing uses another legal basis. ⁴¹ Standard protocol and consent-template wording should be reviewed against European Data Protection Board Opinion 3/2019 on that interplay. ⁴²

In 2020 EU Member States were reported to differ over whether consent was required for health-data processing in research. ^{3, 40} A healthcare lawyer advised against relying on consent where participation necessarily entails processing and the patient–investigator relationship creates a power imbalance, because consent may not be freely given. ^{43, 41, 44} Her concern was that later challenges to consent's validity could make processing unlawful; she preferred an appropriate legitimate-interest or public-interest basis together with the scientific-research condition. ⁴¹ Consent is valid only when freely given, with genuine choice and the ability to refuse or withdraw without detriment; a clear imbalance with the controller can undermine that freedom. ⁴³

Research and public-health processing can qualify for exceptions to individual rights, but an exception is not permission to ignore participants' rights. ^{45, 46, 47} Withdrawal from a trial does not necessarily prevent processing data collected before withdrawal. ^{48, 49} Research exceptions can limit the right to erasure. ⁵⁰ Consent materials should explain what happens to already-collected data following withdrawal. ⁴⁹

Secondary research and US rules

Big-data analyses commonly reuse data collected for another purpose, often pooling or linking studies and databases. ⁵¹ The GDPR recognises that research purposes may not be fully identifiable at collection and permits consent to broader research areas. ⁵¹

The US Revised Common Rule, effective from 21 January 2019, introduced broad consent for unspecified future research involving storage, maintenance or secondary use of identifiable private information or biospecimens. ⁵² Broad consent must specify the types of research, information, institutions that may reuse it and the time frame. ⁵² Under the HIPAA Privacy Rule, covered entities such as health plans, healthcare clearinghouses and providers should obtain written authorisation for secondary-research use of protected health information, stating its purpose, information, authorised users and duration; research without individual authorisation can instead use an institutional review board or privacy-board waiver. ⁵² In the 2020 account, de-identified health information required neither consent nor HIPAA authorisation. ⁵²

In 2019 the US approach was described as a mixture of federal and state rules, with no single GDPR equivalent; Japan and Canada also had personal-information protection laws. ⁴⁰ HIPAA does not provide the GDPR's right to be forgotten, and the two jurisdictions protect different categories of information, including different treatment of trade-union membership. ⁵⁰

Safeguards throughout the research workflow

Processing should be lawful, fair and transparent, and participants should know how their data are used. ⁵³ Data should be accurate, relevant and limited to what is necessary for collection and presentation, with a specified, explicit and legitimate purpose normally recorded in the protocol. ^{53, 54, 33} In one multiregional-trial example, electronic case report forms in some regions still collected patient initials and full dates of birth, illustrating the need to assess data minimisation across regions. ⁵⁴ Investigator CVs collected for the trial master file should not be repurposed for sales or business development. ^{54, 55} Personal data should be retained for predefined periods and erased or destroyed when those periods end. ⁵⁵ Access to paper and electronic files should be restricted to people who need them. ⁵⁶ Controllers must be able to demonstrate compliance. ⁵⁶

Privacy by design builds compliance into systems; privacy by default minimises collection, processing and reporting. ^{1, 26} Clinical databases, electronic trial master files, electronic patient-reported outcome systems and documents should incorporate data limitation, minimisation and controlled access from the outset. ⁵⁷ Public submission does not remove protection obligations. ⁴⁷ Growing disclosure requirements make balancing privacy, transparency and scientific utility important for public trust. ^{58, 1, 59}

A 2023 checklist proposed organisational controls for writing providers. ⁶⁰

• Establish a data-protection policy.
• Establish a breach procedure with step-by-step containment actions.
• Establish archiving and destruction procedures.
• Make staff aware of data-protection policies and procedures.
• Use confidentiality clauses with processors and freelancers handling personal data.
• Promote a privacy culture.

⁶⁰

Its logical security controls addressed access and processing. ⁶¹

• Control and restrict access to sources containing personal data.
• Limit the number of users with access.
• Limit access duration.
• Use robust passwords, secure internet connections, encryption and protection against malicious software.
• Define how, to whom, by whom and under what circumstances data can be accessed, erased or returned to the sponsor.
• Establish traceability procedures for logging access to documents containing personal data.
• Encrypt data.

⁶¹

Its physical controls protected equipment and records. ³³

• Secure servers and data-exchange platforms physically.
• Secure workstations physically.
• Establish procedures for paper records containing personal data.
• Define how hardware maintenance is managed.
• Establish procedures against non-human sources of risk.

³³

Writing providers, including freelancers, should adopt technical, organisational and IT safeguards suited to their size and budget. ³³ No system is infallible, so privacy awareness remains necessary across the writing community. ³³

Deceased participants and staff

Data on a deceased participant may still identify living relatives and thus remain personal information relating to those relatives. ^{13, 14} A clinical-study-report narrative containing details of blackmail and a suicide attempt illustrated one medical writer's concern that sensitive events might also have appeared in local newspapers and linked the deceased patient to living family members. ^{62, 63} Staff data in the electronic trial master file also require security, restricted access and protection by design and default. ^{63, 18}

Public-health emergencies and non-compliance

In April 2020 the European Data Protection Board issued Guidelines 03/2020 on scientific-research processing of health data during the COVID-19 outbreak, addressing privacy alongside public safety. ⁶⁴ Organisations remained obliged to process personal data lawfully during the emergency, and writers needed to follow changing guidance. ^{64, 65}

Non-compliance can bring financial and legal consequences, including significant fines and restrictions on processing or cross-border transfers. ^{66, 1, 2} Upper-tier fines may reach €20 million or 4% of annual company turnover, whichever is greater. ²⁶ Loss of participants' and public trust is a further consequence; protecting data helps patients, clinicians and the public trust the systems using them. ^{66, 67}