Click here to open the filter panel
#
510(k) premarket notification
A
Accountability
A
Accuracy
A
Adequacy decision
A
Ad hoc services
A
Adverse event
A
AI literacy (Art. 4 EU AI Act)
A
AI Officer
A
Analysis Data Model (ADaM)
A
Anonymisation
A
Appropriate safeguards
A
Article 29 Working Party (WP29)
A
Artificial intelligence (AI)
A
Authorised representative (EU AI Act)
A
Automated individual decision-making
A
Auxiliary medicinal product
B
Best-in-class drugs
B
Binding corporate rules (BCR)
B
Biobank
B
Biometric data
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

I

Information Commissioner's Office (ICO)

The Information Commissioner's Office (ICO) is the United Kingdom's independent regulator for information rights, responsible for enforcing the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR, governing cookies and electronic marketing), the Freedom of Information Act and related legislation. Under the Data (Use and Access) Act 2025 it is being restructured as the Information Commission, a board-led body, while keeping the ICO name in public-facing work.

The ICO has powers equivalent to those of an EU supervisory authority: information and assessment notices, enforcement notices, audits, and monetary penalties of up to GBP 17.5 million or 4% of worldwide turnover for the most serious infringements, and up to GBP 17.5 million for PECR breaches. In practice it has favoured reprimands and enforcement notices over large fines for public-sector and health bodies, while pursuing cookie compliance, nuisance marketing and cybersecurity failures. It receives breach notifications within 72 hours, handles complaints, approves BCRs and certification schemes, and issues statutory codes of practice.

For life sciences, ICO guidance on research provisions, on anonymisation and pseudonymisation, on AI and data protection, on DPIAs and on international transfers (the International Data Transfer Agreement and transfer risk assessments) is directly relevant, as is its joint work with the Health Research Authority and the Medicines and Healthcare products Regulatory Agency on trial and health data. Organisations outside the UK that process UK residents' data must appoint a UK representative under Art. 3A UK GDPR, through whom the ICO and data subjects can contact them; iliomad provides this service as UK Data Protection Representative.