CROs & Clinical Service Providers
A contract research organisation or clinical service provider is a processor for most of its sponsors, a controller for its own staff and investigator databases, and sometimes a joint controller for activities carried out with investigational sites. It receives a different data processing agreement, a different security questionnaire and a different audit request from every sponsor, and the sponsors' DPOs increasingly expect answers within days.
The obligations under Art. 28 and 32 GDPR, the UK GDPR, HIPAA where US sponsors are involved, and the requirements specific to each sponsor flowing from the EU Clinical Trials Regulation are the same for every study. What differs is the paperwork. A CRO that has documented its processing once (roles, subprocessors, transfers, security measures, breach procedure) turns every new sponsor onboarding into a formality.
iliomad works with CROs, laboratories, imaging and eClinical vendors and clinical supply companies to build that single framework and, where useful, to act as their DPO or EU/UK representative.
What a CRO has to get right
Sponsors delegate the work but not the accountability, so they audit. The obligations below are the ones that appear in every sponsor DPA and every qualification audit.
Art. 28(3) GDPR lists the clauses every DPA must contain; sponsors add their own. A CRO needs a master processor position (standard DPA, subprocessor list, transfer mechanisms, security annex) that it can offer proactively and reconcile quickly against sponsor paper. iliomad drafts it and reviews incoming sponsor DPAs against it. See contractual review.
Laboratories, imaging centres, EDC and IRT providers and cloud hosts are subprocessors that must be authorised and flowed down. Transfers to US sponsors or vendors need EU SCCs, the UK Addendum or the Data Privacy Framework, plus a transfer impact assessment. iliomad maintains the subprocessor register and the transfer file that sponsors ask to see.
Sponsors' qualification audits test the security measures promised in the DPA: access control, encryption, logging, business continuity, incident response. ISO 27001 certification helps but is not required; documented and tested measures are. iliomad prepares the security annex and the evidence pack.
Art. 33(2) GDPR requires a processor to notify the controller without undue delay; sponsor DPAs typically shorten this to 24 or 48 hours. A CRO needs a breach procedure that detects, assesses and notifies within that window across all studies. iliomad writes and tests the procedure and provides severity assessment based on the ENISA methodology.
Investigator databases, site feasibility data, staff records and business contacts are processed by the CRO as controller, with their own privacy notices, records and retention rules. These are the activities most often missed in an organisation focused on its processor role. iliomad covers them in the record of processing and the notices.
Sponsors increasingly select CROs on compliance maturity. A CRO that can hand over a complete data protection file, name its DPO and its EU/UK representative, and pass a qualification audit without remediation wins the study. iliomad supports the audit and, where the CRO is outside the EU or the UK, acts as its representative.
How iliomad Health Data can help you
iliomad Health Data works with CROs and clinical service providers of every size, from specialist regional CROs to global providers, and sits on the sponsor side of the table for more than thirty life sciences companies. That double perspective is what makes our processor frameworks pass sponsor audits first time. Engagements range from a single framework build to a full DPO and representative mandate.
For the sponsor side of the same studies, see our data protection programme for biotech and pharma sponsors.
FAQs
Our frequently questions
Mostly a processor, but rarely only a processor. When a CRO monitors sites, manages data or runs pharmacovigilance for a sponsor, it processes trial data on the sponsor's documented instructions and is a processor under Art. 28 GDPR. It is a controller for its own staff, its investigator and feasibility databases and its business contacts. A CRO can also become a controller for trial data if it decides on purposes of its own, for example by reusing data across sponsors, which Art. 28(10) treats as controller processing. Each role must be documented in the record of processing and reflected in the contracts, because sponsors and authorities test it.
Usually, yes. Art. 37(1)(c) GDPR applies to processors as well as controllers, and the core activity of a CRO, central laboratory or eClinical provider is the large scale processing of health data on behalf of sponsors. Sponsors expect a named DPO in the data processing agreement and in qualification audits, and many will not contract without one. The DPO can be an employee or an external provider, provided it has expert knowledge, is free from conflicts of interest under Art. 38(6) and reports to the highest management level. iliomad acts as outsourced DPO for clinical service providers of different sizes.
Yes, in most cases. Art. 27 GDPR applies to processors as well as controllers: a CRO, laboratory or technology vendor not established in the EU that processes data of trial participants in the EU falls under Art. 3(2) and must designate a representative in a Member State where those participants are located. The UK GDPR imposes the same requirement for UK participants, and Switzerland sets its own conditions in Art. 14 of the revised FADP. The representative must be designated in writing, and its details should appear in your data processing agreements and processor documentation. iliomad acts as EU representative through iliomad Health Data SAS and as UK representative through iliomad Health Data UK Ltd.
Forward them to the sponsor and help it respond. As a processor, a CRO must assist the controller with data subject requests under Art. 28(3)(e) GDPR, but the decision to grant, limit or refuse a request belongs to the sponsor. The CRO should log the request, transmit it to the sponsor within the period set in the data processing agreement, often a few working days, and avoid replying on the substance unless instructed. Because participants are identified only by code at sponsor level, the site usually needs to be involved to verify identity. A documented procedure covering these steps is one of the first things sponsors check during audits.
Tell the sponsor immediately and in writing. Art. 28(3) GDPR requires the processor to inform the controller immediately if, in its opinion, an instruction infringes data protection law. Typical cases include a request to transfer identifiable data to a country without a transfer mechanism, to keep data beyond the agreed retention period or to reuse data for another study. The CRO should record the alert and the sponsor's response, and should not carry out a clearly unlawful instruction, because a processor that acts outside or contrary to lawful instructions is liable under Art. 82(2). iliomad helps CROs draft escalation clauses and handle these exchanges with sponsor DPOs.
Only where the US recipient is certified. The adequacy decision for the Data Privacy Framework between the EU and the United States covers transfers to US organisations that have self certified with the US Department of Commerce, for the categories of data their certification covers; the UK Extension and the Swiss framework play the same role for UK and Swiss data. The EU General Court upheld the adequacy decision in September 2025, but many sponsors still require Standard Contractual Clauses as a fallback. For any recipient that is not certified, the CRO needs SCCs or the UK Addendum and a transfer impact assessment. iliomad maintains this transfer file together with the subprocessor register.
Any Questions ?
