Biotech & Pharma Sponsors

Most of our clients are clinical-stage biotech and pharma sponsors: oncology, gene and cell therapy, rare disease and CNS programmes, often headquartered in the United States with trials recruiting in ten or more countries. They share the same situation — a Phase I to III pipeline, a small corporate team, a CRO network doing the operational work, and personal data of patients, investigators and site staff flowing across the EU GDPR, UK GDPR, Swiss FADP and HIPAA at the same time.

The regulatory exposure is real and specific: Art. 27 GDPR and UK GDPR require a representative for non-EU and non-UK sponsors; Art. 35 requires a DPIA before large-scale processing of health data begins; Art. 28 requires compliant contracts with every CRO, laboratory, EDC and IRT provider; and the EU Clinical Trials Regulation 536/2014 layers its own transparency and documentation duties on top.

iliomad delivers this as an operational programme, not a legal opinion — a named DPO, a representative address in the EU and the UK, and a study-by-study compliance file that your quality and clinical teams can hand to an auditor, an ethics committee or an acquirer.

What a sponsor has to get right

The obligations below apply to every sponsor processing data of EU, UK or Swiss trial participants, whatever the size of the company. Each one produces a document that will be asked for — by a site, an ethics committee, a supervisory authority or a buyer's due-diligence team.

Appointing a DPO and an EU/UK representative

Large-scale processing of health data makes the appointment of a Data Protection Officer mandatory under Art. 37(1)(c) GDPR. A sponsor without an establishment in the EU or the UK must in addition designate a representative under Art. 27 GDPR and Art. 27 UK GDPR, named in the informed consent form and privacy notices. iliomad provides both roles through its Global DPO service and its EU and UK representative services.

Data protection impact assessment per study

Art. 35 GDPR requires a DPIA before processing that is likely to result in a high risk — which clinical trials on health data, genetic data or vulnerable populations almost always are. The DPIA must identify each actor's role (sponsor, CRO, sites, vendors), the legal bases per country, transfer mechanisms and the security measures of every party. See our DPIA methodology.

Informed consent forms and privacy notices

The ICF is where GDPR transparency (Art. 13 and 14) meets ICH-GCP. It must name the controller and its representative, state the legal basis per jurisdiction, describe transfers outside the EU and give participants their rights in plain language. Country-specific wording applies in Germany, France, Italy and elsewhere. iliomad reviews and redlines ICFs against a jurisdiction-by-jurisdiction checklist — see ICF review.

Contracts with CROs, sites and vendors

Every processor needs an Art. 28 GDPR data processing agreement with the mandatory clauses, and every transfer to a third country needs a mechanism — EU Standard Contractual Clauses, the UK Addendum or IDTA, or the Data Privacy Framework for US recipients. Clinical trial agreements with sites often follow mandatory national templates. Our contractual review and vendor assessment services cover the full chain.

Cross-border transfers and US HIPAA interplay

US sponsors frequently hold data subject to both GDPR and HIPAA, with different definitions of identifiable data and different breach rules. Transfers from EU sites to a US sponsor, CRO or cloud provider require a documented mechanism and a transfer impact assessment. iliomad maps every flow and documents the mechanism per route — see HIPAA.

Records, breach procedures and authority interactions

A record of processing activities (Art. 30 GDPR), a tested breach notification procedure meeting the 72-hour deadline of Art. 33, and a process for handling data subject requests from participants and investigators are expected from day one. When a supervisory authority, an ethics committee or an acquirer asks, the file must exist. iliomad maintains it as part of the DPO mandate.

How iliomad Health Data can help you

iliomad Health Data acts as external DPO and EU/UK representative for more than thirty life-sciences sponsors, most of them US-based biotech companies with multi-country trials. We work alongside your clinical operations, regulatory and quality teams and with your CROs, so that compliance is built into the study rather than added at the end. The engagement is priced as a fixed monthly fee for the life of the study, with the build-out concentrated in the first year.