Founders & Executives
Founders and executives of life sciences companies come to us at recognisable moments: the first trial is about to open in Europe; a large pharma partner or a hospital customer has sent a due diligence questionnaire; a financing round or an acquisition is under way and the data room needs a data protection file; or a product has just become an AI system under the EU AI Act.
The questions are practical. Who is accountable? What do we have to appoint, document and sign? What will an investor, a partner or an authority ask for, and how fast can we produce it? How much does it cost, and how do we keep it from becoming a distraction for a team that should be running the science?
iliomad answers with a fixed fee mandate: a named DPO or AI Officer, a representative address in the EU and the UK where needed, a compliance file built in the first year and maintained after, and a monthly reporting rhythm your board can read in five minutes.
What an executive is accountable for
The company, not the DPO, is the controller. These are the decisions and documents that sit with the executive team, and that a partner, a buyer or a regulator will trace back to you.
A DPO under Art. 37 GDPR where health data is processed on a large scale; an EU and UK representative under Art. 27 where the company has no establishment there; an AI compliance owner where the company provides or deploys AI systems. Outsourcing the roles is permitted and, below a certain size, the only realistic option. iliomad provides them as one mandate. See Global DPO and AI Officer.
Pharma partners, acquirers and investors ask for the record of processing, the DPIAs, the DPA register, the breach procedure, the privacy notices and evidence that the roles above exist. A company that can produce them in a day negotiates from strength. iliomad builds the file to that standard and runs due diligence audits on both sides of transactions.
iliomad prices mandates as a flat monthly fee for the life of the engagement, with the build phase concentrated in the first year and maintenance thereafter. Scoped deliverables (a DPIA, a gap assessment, an ICF review) are quoted as fixed amounts. There is no rate card surprise and no incentive to prolong work.
Each mandate includes a monthly report and a monthly meeting: what was done, what is open, what changed in the regulation and what the company must decide. Executives see the risk position without reading the underlying documents. When a regulator or a partner writes, iliomad drafts the answer.
Employees adopt AI tools faster than policies follow, and companies that develop AI systems acquire provider obligations under the EU AI Act. An acceptable use policy, an AI inventory and an onboarding process for third party tools are the minimum; provider obligations come with classification. iliomad delivers governance and AI Act compliance as one programme. See AI compliance services.
Law firms tell you what the law requires. iliomad does the work: the appointments, the documents, the contracts, the training, the audit responses. We are regulatory compliance specialists with ISO 27001, 27005 and 9001 certification and CDPO certified consultants, working exclusively in life sciences across more than 75 countries.
How iliomad Health Data can help you
iliomad Health Data is the external data protection and AI compliance function of more than thirty life sciences companies, most of them led by their founders and backed by venture capital. The CEO speaks to a senior consultant, the team speaks to the same consultant, and the board reads one report. The mandate scales with the company, from a first European study to a global programme, without a change of provider.
Raising a round or answering an investor? See how we support investors, incubators and accelerators. Already have an internal privacy lead? See our support for legal, privacy and compliance leads.
FAQs
Our frequently questions
As soon as the company starts processing personal data that matters to its value: the first clinical study, the first users of a digital product, the first dataset used to train a model, or the first data shared with a pharma partner. Before that point, a short baseline is enough: a record of processing, privacy notices, contracts with key vendors and a clear internal owner. The cost of acting early is low, while the cost of rebuilding consents, contracts or datasets after a partner or investor has spotted the gap is high. iliomad often starts with a lighter mandate at seed stage and scales it when trials or products launch.
No. Art. 38(6) GDPR allows the DPO to carry out other tasks only if they do not create a conflict of interest, and the DPO guidelines endorsed by the EDPB list senior management roles, such as chief executive, chief operating or financial officer and heads of IT or HR, as incompatible, because these people determine the purposes and means of processing. A founder who runs the company cannot independently monitor its compliance. Small companies therefore usually appoint an external DPO, which Art. 37(6) expressly allows, while the founder remains the decision maker on data protection matters.
The company. Art. 5(2) and Art. 24 GDPR place accountability on the controller, and the DPO guidelines endorsed by the EDPB state that the DPO is not personally responsible for compliance failures. Outsourcing transfers the work and the expertise, not the responsibility: fines, orders and liability under Art. 82 are addressed to the company. That is why an outsourced mandate must give management visibility and documented decisions. iliomad's mandates include a monthly report and meeting that set out what has been done, what remains open and which decisions belong to the executive team.
Most of the work can be done within the first year. The urgent items come first, typically in the opening weeks: appointing the DPO and representatives, securing the documents needed for an upcoming study, partnership or financing, and fixing any contract that blocks a deal. The record of processing, DPIAs, vendor agreements, policies and training then follow in a planned sequence. After that, the file needs maintenance rather than rebuilding, as studies, vendors and products change. iliomad structures its mandates the same way, with the build concentrated in the first year and a flat monthly fee that stays predictable.
Fines are possible but rarely the first problem. Art. 83 GDPR allows fines of up to €20 million or 4% of worldwide annual turnover, yet for an early stage company the more immediate risks are commercial: an ethics committee query that delays a study, a pharma partner that pauses a deal, an investor who asks for a specific indemnity, or a hospital that rejects a tender. Supervisory authorities can also order a company to stop processing or to erase data under Art. 58(2), which can make a dataset or a trained model unusable. These risks are far cheaper to prevent than to remediate under deadline.
For a company with one or a few programmes, an outsourced mandate is usually significantly less expensive than a qualified internal hire. An internal DPO for a life sciences company needs expertise in clinical research, health data and increasingly AI, which means a senior, full time salary from day one. iliomad charges a flat monthly fee sized to the number of studies, products and countries in scope, and quotes scoped deliverables, such as a DPIA or a gap assessment, as fixed amounts. The company gains a team rather than one person, which covers absences, peaks of work and specialist questions. As the company grows, the mandate can evolve to support an internal DPO rather than replace one.
Any Questions ?
