Biotech & Pharma Sponsors
Most of our clients are clinical stage biotech and pharma sponsors: oncology, gene and cell therapy, rare disease and CNS programmes, often headquartered in the United States with trials recruiting in ten or more countries. They share the same situation: a Phase I to III pipeline, a small corporate team, a CRO network doing the operational work, and personal data of patients, investigators and site staff flowing across the EU GDPR, UK GDPR, Swiss FADP and HIPAA at the same time.
The regulatory exposure is real and specific: Art. 27 GDPR and UK GDPR require a representative for sponsors established outside the EU or the UK; Art. 35 requires a DPIA before processing of health data on a large scale begins; Art. 28 requires compliant contracts with every CRO, laboratory, EDC and IRT provider; and the EU Clinical Trials Regulation 536/2014 layers its own transparency and documentation duties on top.
iliomad delivers this as an operational programme, not a legal opinion: a named DPO, a representative address in the EU and the UK, and a compliance file for each study that your quality and clinical teams can hand to an auditor, an ethics committee or an acquirer.
What a sponsor has to get right
The obligations below apply to every sponsor processing data of EU, UK or Swiss trial participants, whatever the size of the company. Each one produces a document that will be asked for by a site, an ethics committee, a supervisory authority or a buyer's due diligence team.
Processing of health data on a large scale makes the appointment of a Data Protection Officer mandatory under Art. 37(1)(c) GDPR. A sponsor without an establishment in the EU or the UK must in addition designate a representative under Art. 27 GDPR and Art. 27 UK GDPR, named in the informed consent form and privacy notices. iliomad provides both roles through its Global DPO service and its EU and UK representative services.
Art. 35 GDPR requires a DPIA before processing that is likely to result in a high risk, which clinical trials on health data, genetic data or vulnerable populations almost always are. The DPIA must identify each actor's role (sponsor, CRO, sites, vendors), the legal bases per country, transfer mechanisms and the security measures of every party. See our DPIA methodology.
The ICF is where GDPR transparency (Art. 13 and 14) meets ICH GCP. It must name the controller and its representative, state the legal basis per jurisdiction, describe transfers outside the EU and give participants their rights in plain language. Specific national wording applies in Germany, France, Italy and elsewhere. iliomad reviews and redlines ICFs against a checklist organised jurisdiction by jurisdiction. See ICF review.
Every processor needs an Art. 28 GDPR data processing agreement with the mandatory clauses, and every transfer to a third country needs a mechanism: EU Standard Contractual Clauses, the UK Addendum or IDTA, or the Data Privacy Framework for US recipients. Clinical trial agreements with sites often follow mandatory national templates. Our contractual review and vendor assessment services cover the full chain.
US sponsors frequently hold data subject to both GDPR and HIPAA, with different definitions of identifiable data and different breach rules. Transfers from EU sites to a US sponsor, CRO or cloud provider require a documented mechanism and a transfer impact assessment. iliomad maps every flow and documents the mechanism per route. See HIPAA.
A record of processing activities (Art. 30 GDPR), a tested breach notification procedure meeting the deadline of 72 hours under Art. 33, and a process for handling data subject requests from participants and investigators are expected from day one. When a supervisory authority, an ethics committee or an acquirer asks, the file must exist. iliomad maintains it as part of the DPO mandate.
How iliomad Health Data can help you
iliomad Health Data acts as external DPO and EU/UK representative for more than thirty life sciences sponsors, most of them biotech companies based in the United States with multinational trials. We work alongside your clinical operations, regulatory and quality teams and with your CROs, so that compliance is built into the study rather than added at the end. The engagement is priced as a fixed monthly fee for the life of the study, with the build phase concentrated in the first year.
Your clinical teams and your CROs get the same support: see how we work with clinical operations and regulatory affairs teams and with CROs and clinical service providers.
FAQs
Our frequently questions
Yes. A sponsor established outside the EU that processes personal data of trial participants in the EU falls within the territorial scope of the GDPR under Art. 3(2), and the UK GDPR applies on the same logic to participants in the United Kingdom. Receiving only key coded data does not change this for most sponsors, because monitors, auditors and pharmacovigilance teams can link data back to participants through the sites. In practice, the sponsor must designate an EU and a UK representative under Art. 27, appoint a DPO where Art. 37 requires one, carry out a DPIA, sign Art. 28 agreements with its CROs and vendors, and document every transfer of trial data to the United States.
In most cases, yes. Key coded (pseudonymised) data remains personal data under Recital 26 GDPR whenever the individual can be identified by means reasonably likely to be used, and a sponsor's monitors, auditors and safety teams typically have that possibility through source data verification at the sites. The Court of Justice confirmed in EDPS v SRB (September 2025) that identifiability must be assessed from the perspective of each recipient, which can make a difference for a vendor receiving coded data with no route back to the participant. For the sponsor itself, supervisory authorities and ethics committees expect coded trial data to be handled as personal data, and iliomad documents the position flow by flow in the study DPIA.
No. Art. 74 of Regulation (EU) No 536/2014 requires a sponsor not established in the EU to have a legal representative in the Union, responsible for ensuring compliance with the sponsor's obligations under the Clinical Trials Regulation; this role is often taken by the CRO. The GDPR representative under Art. 27 is a separate designation: it is the contact point in the EU for supervisory authorities and trial participants on data protection matters, and it keeps the record of processing activities. The two roles can be held by different organisations, but each must be designated in writing, and the GDPR representative must be named in the informed consent form and privacy notices.
Data collected before withdrawal can usually be kept and used. Art. 28(3) of the Clinical Trials Regulation provides that withdrawal of informed consent does not affect activities already carried out or the use of data obtained before the withdrawal. On the GDPR side, sponsors generally rely on legal bases other than consent for trial data, in line with EDPB Opinion 3/2019, and the right to erasure is limited by Art. 17(3) GDPR where deletion would compromise a legal obligation, public health or the research itself. No new data may be collected after withdrawal, and the informed consent form must explain these rules to participants in plain language.
Art. 58 of the Clinical Trials Regulation requires the sponsor and the investigator to archive the content of the clinical trial master file for at least 25 years after the end of the trial, unless other EU law requires a longer period; participants' medical files follow national law. This is compatible with the storage limitation principle in Art. 5(1)(e) GDPR, because retention is required by law and archiving for research is protected by the safeguards of Art. 89. The retention periods must be stated in the informed consent form and the record of processing, and access to archived data should be restricted to what inspections, safety monitoring and regulatory submissions require.
Before the first ethics submission in Europe. Art. 13 GDPR requires the information given to participants, usually in the informed consent form, to name the controller and its representative, and Art. 35 requires the DPIA to be completed before the processing starts, so both have to exist when the protocol and the ICF are finalised for submission through CTIS. Appointing later usually means amending documents already approved by ethics committees, which costs time at site activation. iliomad typically starts a sponsor mandate at protocol finalisation, sets up the representative designation and the DPIA first, then builds the vendor contracts and the record of processing as the study is rolled out across countries.
Any Questions ?
