Click here to open the filter panel
U
UK GDPR
U
Unexpected serious adverse reaction (SUSAR)
V
Validation (computerised system validation, CSV)
V
Vendor assessment (third-party risk management)
V
Vital interests (Art. 6(1)(d) GDPR)
V
Vulnerable participants (vulnerable subjects)
W
Wearables and digital health technologies (DHT)
W
Withdrawal (of consent and from a clinical trial)
W
World Health Organization (WHO)
X
XAI (explainable artificial intelligence)
Y
Yellow Card scheme (UK)
Z
Zero-knowledge proof
Z
Zero trust architecture
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

P

Personal data breach

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed (Art. 4(12) GDPR). The EDPB Guidelines 9/2022 classify breaches as confidentiality breaches (unauthorised disclosure or access), integrity breaches (unauthorised alteration) and availability breaches (loss of access or destruction), and a single incident, such as ransomware, may combine all three. Not every security incident is a personal data breach: the incident must actually affect personal data.

Under Art. 33 the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals; the notification describes the nature of the breach, categories and approximate numbers of data subjects and records, likely consequences and measures taken. Under Art. 34, where the breach is likely to result in a high risk, affected data subjects must also be informed. A processor must notify its controller without undue delay. Every breach, notified or not, must be documented in a breach register (Art. 33(5)).

In life sciences, common breaches include misdirected emails containing patient lists, lost laptops with unencrypted trial data, compromised EDC or eCOA accounts, ransomware at a site or CRO, and unblinding through misconfigured access. Because health data is involved, risk is rarely "unlikely", and the ENISA severity methodology (assessing data processing context, ease of identification and circumstances of the breach) is widely used to decide on notification. Vendor contracts should impose notification to the sponsor within 24 to 48 hours so that the sponsor can meet its own 72-hour deadline, and breaches affecting trial integrity may also need to be reported as serious breaches under Art. 52 CTR.