Click here to open the filter panel
I
Inspection
I
Institutional Review Board (IRB)
I
Interactive response technology (IRT)
I
Interactive web response system (IWRS)
I
International data transfer
I
Investigational Medicinal Product Dossier (IMPD)
I
Investigational medicinal product (IMP)
I
Investigational New Drug (IND) application
I
Investigator
I
Investigator's brochure (IB)
I
In Vitro Diagnostic Regulation (IVDR)
I
ISO/IEC 27001 (information security management)
I
ISO/IEC 42001 (AI management system)
J
Joint controllers
K
k-anonymity
K
Key-coded data (coded data)
K
Key (cryptographic key and pseudonymisation key)
K
Kinetics (pharmacokinetics and pharmacodynamics)
L
Large language model (LLM)
L
Lawfulness
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

M

Main establishment

The main establishment is, for a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of processing are taken in another establishment in the Union which has the power to have them implemented, in which case that other establishment is the main establishment; for a processor with establishments in more than one Member State, it is the place of central administration in the Union or, absent one, the establishment where the main processing activities take place (Art. 4(16) GDPR).

The concept exists to identify the lead supervisory authority under the one-stop-shop mechanism for cross-border processing. Recital 36 and the EDPB Opinion 04/2024 explain that the central administration is presumed to be the main establishment only if it actually takes decisions on purposes and means and has the power to implement them; a letterbox headquarters does not qualify, and the burden of proof lies on the organisation. Where decisions for different processing operations are taken in different Member States, an organisation may have different main establishments for different processing. The EDPB and the lead authority may challenge a designation, as several authorities did in cases involving technology groups that had declared Irish or Luxembourg headquarters.

For international life sciences groups the question is practical: a US sponsor with a Dutch European headquarters and clinical operations in Germany and France will typically have its main establishment in the Netherlands if that is where European decisions on trial data processing are taken, making the Autoriteit Persoonsgegevens its lead authority. Documenting this analysis in the record of processing activities and in group governance charts avoids disputes at the moment of a breach notification or investigation, when the identity of the competent authority must be clear within hours. Groups with no EU establishment have no main establishment and rely instead on their Art. 27 representative.