Legal, Privacy & Compliance Leads
Internal general counsel, privacy leads and compliance officers in life sciences companies face a specialised regulatory field with generalist resources. GDPR and UK GDPR are the starting point; the Clinical Trials Regulation, national health data rules, the EU AI Act, HIPAA and state privacy laws in the United States, and the expectations of ethics committees, notified bodies and hospital procurement follow. External counsel provides opinions; the implementation still lands on your desk.
What you need is a partner who works the way you do (precise instruments, documented positions, defensible files) and who has already solved the sector's recurring problems: the legal basis for research data across Europe, the transfer mechanism for a US sponsor, the wording of a German ICF, the classification of an AI diagnostic under the AI Act.
iliomad complements the internal function rather than replacing it: as EU or UK representative where you have no establishment, as a delivery team for DPIAs, gap assessments and contract reviews, or as an AI Officer while the AI Act programme is built.
What a legal or privacy lead needs from a specialist partner
The areas below are where life sciences privacy diverges from general corporate privacy, and where a specialist saves the most time.
Clinical research relies on Art. 6(1)(f) or (e) with Art. 9(2)(j) GDPR in most Member States, on consent in others, and on specific national provisions (for example the French CNIL reference methodologies). The position must be documented per country and reflected in the ICF, the DPIA and the record of processing. iliomad maintains a compliance wiki organised country by country and applies it to your studies.
Art. 27 GDPR and UK GDPR representation is more than a mailbox: the representative must be named in notices, hold the record of processing, and handle authority and data subject contacts. iliomad Health Data SAS acts as EU representative from its registered office in France and iliomad Health Data UK Ltd as UK representative from Cambridge, with a monthly activity report. See EU representative and UK representative.
A structured gap assessment across legal basis, transparency, data subject rights, governance, transfers, vendor management, security, retention and incident management, scored against the regulation with a remediation roadmap by priority. iliomad's gap analysis covers GDPR, UK GDPR, HIPAA, PIPEDA and other regimes in one exercise.
A pipeline of studies, products or vendors produces a pipeline of DPIAs, DPAs and security assessments that no internal team of one can absorb. iliomad delivers them to a consistent methodology and template, with tracked changes and rationale, so that the internal lead reviews rather than drafts. See DPIA and contractual review.
The AI Act adds a second regulatory layer: applicability and role qualification per system, classification under Art. 5, 6 and Annexes I and III, provider or deployer obligations, fundamental rights impact assessments where required, and AI literacy under Art. 4. iliomad delivers the applicability memorandum, the gap assessment and, where needed, the technical documentation. See AI compliance services.
Supervisory authority enquiries, partner audits and data breaches all have short deadlines and long consequences. iliomad prepares the file in advance, assesses breach severity with the ENISA methodology within hours, and drafts responses for your review. Our quality assurance reviews keep the file ready for audit between events.
How iliomad Health Data can help you
iliomad Health Data works with internal legal and compliance leads as an extension of their function. We are certified data protection professionals (CIPP/E, CIPM, CDPO) with ISO 27001, 27005 and 9001 certification, and we work only in life sciences. You set the positions; we document and implement them, and we bring the sector precedent from more than thirty clients and 75 countries when the position is not yet set.
Your clinical and regulatory colleagues have their own page: data protection for clinical operations and regulatory affairs.
FAQs
Our frequently questions
Yes, that is how most of our engagements with legal and compliance leads run. The internal lead sets the company's positions, external counsel advises on contentious or novel legal questions, and iliomad implements: representative mandates, DPIAs, gap assessments, contract and ICF reviews, and AI Act documentation, delivered in tracked changes with the regulatory rationale. We bring precedent from more than thirty life sciences clients and over 75 countries, and we escalate questions that call for a legal opinion rather than answering them ourselves. The result is more capacity for the internal function without losing control of the file.
Yes, and the GDPR anticipates it. Art. 38(2) requires the controller to give the DPO the resources necessary to carry out their tasks and maintain expert knowledge, which can include external specialists. Internal DPOs in life sciences commonly use iliomad to absorb peaks of DPIAs and contract reviews, to cover specialist areas such as multinational clinical trials or the AI Act, or to act as EU, UK or Swiss representative where the company has no establishment. The internal DPO keeps the role and the independence attached to it under Art. 38(3), while the delivery capacity grows.
When it is established outside Switzerland and its processing of data of people in Switzerland meets the conditions of Art. 14 of the revised Federal Act on Data Protection (FADP), in force since 1 September 2023. The obligation applies where the processing relates to offering goods or services in Switzerland or monitoring behaviour there, and is extensive, regular and involves a high risk for the persons concerned. Clinical trials with Swiss sites and health data platforms with Swiss users often meet these criteria. The controller must publish the representative's name and address, and the representative keeps a register of the processing activities. iliomad acts as Swiss representative alongside its EU and UK mandates.
The Data (Use and Access) Act 2025 amends the UK GDPR rather than replacing it, and its main data protection provisions came into force on 5 February 2026. For life sciences, the key changes are a clarified definition of scientific research that can include commercially funded research, the possibility of relying on consent to an area of scientific research when the precise purposes cannot be specified at collection, and more flexibility for further processing for research. The Act also introduces recognised legitimate interests, reforms the rules on automated decision making and requires controllers to operate a complaints procedure from June 2026. Divergence from the EU GDPR remains limited, but UK notices, ICFs and records should be checked against the amended text.
It is the written record of the representative mandate for the reporting month. It lists any contacts received from supervisory authorities, trial participants or other data subjects and how they were handled, summarises the regulatory and guidance changes relevant to your studies and products in the EU, the UK or Switzerland, and sets out the actions expected from your company and from iliomad in the coming month. It also confirms that the record of processing held by the representative is up to date. The report is short enough for a general counsel or a board to read in minutes, and it provides evidence of the representative's activity if an authority asks.
Art. 4 of the AI Act, as amended by the Digital Omnibus (Regulation (EU) 2026/1744), requires providers and deployers to take measures to support the AI literacy of their staff and of other people operating AI systems on their behalf. In practice, the company needs an inventory of the AI systems and tools it uses or builds, training adapted to each role and proportionate to the risks of each use, and a record of what has been delivered. For life sciences, the training must cover health data, scientific integrity and the limits of AI outputs in clinical or regulatory work. iliomad builds this as part of its AI Governance service.
Any Questions ?
