Recipient

A recipient means a natural or legal person, public authority, agency or another body, to which personal data are disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients, and their processing of those data must comply with the applicable data protection rules according to the purposes of the processing (Art. 4(9) GDPR).

The definition is functional: a processor is a recipient even though it acts on behalf of the controller; a joint controller receiving data is a recipient; an affiliate within the same group is a recipient. The exclusion for authorities is narrow and covers, for example, a tax authority or court requesting specific information in an investigation, not routine or systematic reporting to regulators such as adverse reaction reporting to the EMA or data submissions to the FDA, which remain disclosures to recipients.

Recipients matter because data subjects must be informed of "the recipients or categories of recipients" under Art. 13(1)(e) and 14(1)(e), and the right of access includes the right to know to whom data has been disclosed; the Court of Justice (Österreichische Post, C-154/21) held that individuals are entitled to the identity of specific recipients where they ask for it. In a clinical trial the recipients typically include the sponsor and its affiliates, the CRO, laboratories, imaging and technology vendors, ethics committees, regulators, data monitoring committees, auditors and insurers. The informed consent form, the record of processing activities and the DPIA should list them consistently, and the list should be updated when vendors change.