General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, is the European Union's framework law on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Adopted on 27 April 2016 and applicable since 25 May 2018, it replaced Directive 95/46/EC and applies directly in all EU Member States and, through the EEA Agreement, in Norway, Iceland and Liechtenstein. The UK retained it as the UK GDPR after Brexit.
The GDPR is built around principles (Art. 5: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability), legal bases (Art. 6 and 9), data subject rights (Chapter III), obligations of controllers and processors (Chapter IV, including DPIAs, DPOs, breach notification and records), international transfers (Chapter V), and enforcement by supervisory authorities with fines of up to 4% of worldwide turnover (Chapter VIII).
Its reach is extraterritorial: under Art. 3(2) it applies to organisations outside the EU that offer goods or services to, or monitor, people in the EU, which captures any non-EU sponsor recruiting European patients and requires a Data Protection Representative. For life sciences, the GDPR interacts with the Clinical Trials Regulation, the MDR/IVDR, the AI Act and the European Health Data Space, and is supplemented by national rules on health research (for example France's reference methodologies). See iliomad's GDPR overview and DPO services.
