Click here to open the filter panel
F
Imported item 13
R
Imported item 14
N
Imported item 15
T
Imported item 16
S
Imported item 17
E
Imported item 18
C
Imported item 19
C
Imported item 2
D
Imported item 20
D
Imported item 21
E
Imported item 22
L
Imported item 23
S
Imported item 24
C
Imported item 25
R
Imported item 26
P
Imported item 27
A
Imported item 28
H
Imported item 29
P
Imported item 3
S
Imported item 30
#
Imported item 31
L
Imported item 32
B
Imported item 33
C
Imported item 34
M
Imported item 35
C
Imported item 36
C
Imported item 37
H
Imported item 38
F
Imported item 39
B
Imported item 4
M
Imported item 40
L
Imported item 41
A
Imported item 42
U
Imported item 43
E
Imported item 44
M
Imported item 45
I
Imported item 46
I
Imported item 47
H
Imported item 48
C
Imported item 49
I
Imported item 5
M
Imported item 50
H
Imported item 6
C
Imported item 7
S
Imported item 8
E
Imported item 9
I
Incapacitated subject
I
Information Commissioner's Office (ICO)
I
Informed consent
I
Inspection
I
Institutional Review Board (IRB)
I
Interactive response technology (IRT)
I
Interactive web response system (IWRS)
I
International data transfer
I
Investigational Medicinal Product Dossier (IMPD)
I
Investigational medicinal product (IMP)
I
Investigational New Drug (IND) application
I
Investigator
I
Investigator's brochure (IB)
I
In Vitro Diagnostic Regulation (IVDR)
I
ISO/IEC 27001 (information security management)
I
ISO/IEC 42001 (AI management system)
J
Joint controllers
K
k-anonymity
K
Key-coded data (coded data)
K
Key (cryptographic key and pseudonymisation key)
K
Kinetics (pharmacokinetics and pharmacodynamics)
L
Large language model (LLM)
L
Lawfulness
L
Legal basis for processing
L
Legally designated representative
L
Legitimate interest
L
Legitimate interest assessment (LIA)
L
Local site investigator
M
Main establishment
M
Medical Device Regulation (MDR)
N
Natural history study
N
NIS2 Directive
N
Notified body
O
Observational study
O
Observer-reported outcome (ObsRO)
O
One-stop-shop mechanism and lead supervisory authority
O
Orphan drug designation (ODD)
P
Patient-reported outcome (PRO)
P
Performance outcome (PerfO)
P
Personal data
P
Personal data breach
P
Pharmacokinetics (PK)
P
Pharmacovigilance
P
Population pharmacokinetics (pop PK)
P
Principal investigator (PI)
P
Principles of data protection
P
Privacy
P
Privacy by design
P
Privacy-enhancing technologies (PETs)
P
Privacy notice (information notice)
P
Processing
P
Processor
P
Profiling
P
Protected health information (PHI)
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

U

Imported item 43

The US CLOUD Act is a 2018 law addressing access to electronic evidence across borders. It clarifies that providers subject to US jurisdiction can be required, through applicable legal process, to disclose data within their possession, custody or control even when those data are stored outside the United States.

Key takeaways

  • Server location alone does not settle jurisdiction.
  • The Act does not create unrestricted access.
  • A foreign order is not itself GDPR permission.

What the Act Changes

The US Department of Justice explanation distinguishes provider disclosure obligations from the Act’s framework for bilateral agreements on electronic evidence. For hosting assessments, keep those mechanisms separate.

IssueOperational meaning
LocationOverseas storage does not automatically exclude US process.
ControlCheck which entity holds or controls the information.
ProcedureDisclosure remains subject to applicable legal process.

Why It Matters for Data Protection

The EDPB’s Article 48 guidelines explain that foreign decisions are not automatically enforceable in the EU. A transfer responding to a foreign authority needs an appropriate processing basis and compliance with GDPR international-transfer requirements. An international agreement may be relevant, but its existence and coverage must be assessed rather than assumed. Other Chapter V routes require their own analysis.

Hypothetical example: A sponsor considers an EU-hosted platform operated by a group with US connections. We recommend reviewing corporate roles, access privileges, encryption-key control and the provider’s process for scrutinising requests. The team records the residual risk instead of equating a European data centre with immunity from foreign legal demands.

Frequently Asked Questions

Does the CLOUD Act allow routine browsing of all cloud data?

No. Its disclosure mechanism operates through applicable legal process.

Does EU hosting remove every exposure?

No. Jurisdiction and possession, custody or control also matter.

Is every disclosure to a foreign authority prohibited?

No. Analyse the processing basis, transfer route and applicable agreement or safeguard.

Related reading: third country, health-data sovereignty and hosting. For practical support, see clinical data hosting.

Updated: 27 October 2026