Clinical Operations & Regulatory Affairs
Clinical operations, regulatory affairs and quality leads carry most of the daily data protection load in a sponsor: the ICF wording a German ethics committee has queried; the data protection section of a protocol for CTIS submission; the clinical trial agreement a French site insists must follow the national template; the CRO's data processing agreement; the vendor questionnaire from an imaging provider; the investigator who asks who the EU representative is.
Each question has a precise regulatory answer (Art. 13 GDPR for the ICF, Art. 28 for the CRO contract, Art. 27 for the representative, the Clinical Trials Regulation 536/2014 for the protocol), and each answer has to arrive before the study milestone, not after.
iliomad works inside your study timelines. Our consultants review documents in tracked changes with the regulatory rationale, join site and CRO calls when needed, and maintain the study compliance file so that your inspection readiness does not depend on a folder someone left behind.
Where data protection meets the study timeline
The items below are the recurring data protection deliverables of a clinical study. Each is tied to a milestone (ethics submission, site activation, database lock, archiving) and each is reviewed by someone outside the company.
Ethics committees review the data protection language of the ICF against Art. 13 GDPR and national requirements: the controller and representative, legal bases, transfers outside the EU, retention, rights and contact points. Germany, France, Italy and Spain each have their own expectations. iliomad reviews master and country ICFs with tracked changes and rationale. See ICF review.
The protocol's confidentiality and data protection section must be consistent with the ICF, the DPIA and the CTA, and must describe pseudonymisation, data flows, retention and secondary use in a way a competent authority accepts. Special topics such as eDiaries, photography, future biomedical research and genetic data need model language. iliomad reviews protocols before submission.
Several countries impose mandatory CTA templates whose data protection clauses cannot be freely amended; others require GDPR Art. 28 or joint controller language to be added. Site legal departments push back on sponsor paper. iliomad reviews CTAs against the country template and the GDPR checklist and gives the site a reasoned position. See contractual review.
Each CRO, laboratory, EDC, IRT, imaging and eCOA vendor is a processor requiring a DPA, a transfer mechanism and a security assessment before data flows. Study start dates slip when this is done late. iliomad runs the assessment and the contract review in parallel with vendor selection. See vendor assessment.
The DPIA required by Art. 35 GDPR is also the document that answers most site and ethics committee questions. It maps every actor and every flow, scores the risks and records the measures. iliomad produces it from the protocol, ICF, agreements and data management plan, and updates it when the study changes. See DPIA.
Investigators and site staff are data subjects too: their professional data is processed for trial conduct and pharmacovigilance, and they need a notice under Art. 13 and 14 GDPR. Inspectors ask for it. iliomad drafts site staff information notices, maintains the record of processing per study and supports inspection responses.
How iliomad Health Data can help you
iliomad Health Data's consultants are certified data protection professionals with clinical research experience; they read protocols, understand CTIS and speak to CROs and sites in their own terms. Reviews are delivered as Word documents in tracked changes, with the regulatory rationale in comments, on agreed turnaround times. The DPO mandate includes a monthly meeting with the clinical and regulatory team, so that questions are answered before they become findings.
For the same obligations seen at company level, see data protection for biotech and pharma sponsors.
FAQs
Our frequently questions
It depends on the purpose and, often, on the country. In its Opinion 3/2019 on the interplay between the Clinical Trials Regulation and the GDPR, the EDPB distinguishes processing for reliability and safety purposes, such as safety reporting and archiving, which rests on a legal obligation under Art. 6(1)(c) with Art. 9(2)(i), from processing for research activities, which can rest on public interest under Art. 6(1)(e), legitimate interests under Art. 6(1)(f) or explicit consent, combined with a condition under Art. 9(2), typically (i), (j) or (a). National law and ethics committees narrow the options in several Member States, so the basis chosen must be documented per country and reflected consistently in the ICF, the DPIA and the record of processing.
No. Informed consent under Art. 28 and 29 of the Clinical Trials Regulation is an ethical and procedural requirement to take part in the study. Consent under the GDPR is only one possible legal basis for processing personal data, and the EDPB considers that it will often not be the most appropriate basis for core trial processing, notably where there is an imbalance between sponsor and participant or where withdrawal would make data unusable. Many sponsors therefore rely on public interest or legitimate interests as the GDPR basis, while still obtaining informed consent to participate. The ICF must explain both clearly, so that participants understand what they agree to and how their data is used.
Yes, under conditions. Art. 28(2) of the Clinical Trials Regulation allows the sponsor to ask participants, when they consent to the trial, to agree to the use of their data outside the protocol exclusively for scientific purposes. On the GDPR side, Art. 5(1)(b) treats further processing for scientific research as compatible with the initial purpose, provided the safeguards of Art. 89 are in place, such as pseudonymisation and data minimisation. National rules add requirements in several countries, and genetic data or samples often require specific consent. The ICF, protocol and DPIA should describe future research from the start, because adding it later means returning to ethics committees and participants.
Within the period set in the request for information, which cannot exceed 12 days under the Clinical Trials Regulation. Art. 6(8) and Art. 7(2) of Regulation (EU) No 536/2014 frame requests for additional information during the assessment of Part I and Part II, and the application lapses if the sponsor does not respond in time. Data protection questions on the ICF, the legal basis, the representative or transfers are frequent in Part II assessments, so answers have to be drafted in days, not weeks. iliomad prepares reasoned responses and revised documents in tracked changes within the submission timeline.
Through two parallel notification tracks. Under the GDPR, a processor such as a CRO or vendor must notify the sponsor without undue delay, and the sponsor, as controller, has 72 hours from awareness to notify the competent supervisory authority under Art. 33, and must inform participants under Art. 34 when the risk is high; a site acting as controller for its own records handles its own notification. Under Art. 52 of the Clinical Trials Regulation, the sponsor must also notify the Member States concerned through CTIS within seven days if the incident is a serious breach likely to affect participants' safety and rights or the reliability of the data. iliomad assesses severity with the ENISA methodology and drafts both notifications.
Whenever the amendment changes the data processing. Art. 35(11) GDPR requires the controller to review the DPIA when the risk represented by the processing changes. Typical triggers are new countries, new vendors or data flows, new categories of data such as genetic data or images, new endpoints collected through eDiaries or wearables, and extended retention or secondary use. Purely clinical changes, such as a new dose cohort with the same data set, usually need only a documented check. Aligning the DPIA review with the substantial modification process keeps the ICF, the DPIA and the record of processing consistent for inspectors.
Any Questions ?
