Click here to open the filter panel
L
Legal basis for processing
L
Legally designated representative
L
Legitimate interest
L
Legitimate interest assessment (LIA)
L
Local site investigator
M
Main establishment
M
Medical Device Regulation (MDR)
N
Natural history study
N
NIS2 Directive
O
Observational study
O
Observer-reported outcome (ObsRO)
O
One-stop-shop mechanism and lead supervisory authority
O
Orphan drug designation (ODD)
P
Patient-reported outcome (PRO)
P
Performance outcome (PerfO)
P
Personal data
P
Personal data breach
P
Pharmacokinetics (PK)
P
Pharmacovigilance
Population Pharmacokinetics
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

S

Sub-processor

A sub-processor (the GDPR speaks of "another processor") is a processor engaged by a processor to carry out specific processing activities on behalf of the controller. Under Art. 28(2) GDPR the processor may not engage a sub-processor without the prior specific or general written authorisation of the controller; in the case of general authorisation, the processor must inform the controller of any intended addition or replacement, giving the controller the opportunity to object. Under Art. 28(4) the processor must impose on the sub-processor, by contract, the same data protection obligations as those set out in its own contract with the controller, and remains fully liable to the controller for the sub-processor's performance.

Sub-processor chains are long in clinical research and digital health. A CRO acting as processor for the sponsor will itself use EDC, eCOA and safety database vendors, translation agencies, cloud hosting providers, help-desk providers and freelance monitors; each of these is a sub-processor, and each may use further sub-processors such as infrastructure providers. Where a sub-processor is located in a third country, the processor must ensure a Chapter V transfer mechanism, and the controller's transfer impact assessment must extend down the chain.

Operationally, controllers should require a maintained sub-processor list (often Annex III of the SCCs or a schedule to the DPA), a notice period and objection right for changes, security and audit commitments that flow down, and breach notification timelines that leave room for the controller's own 72-hour deadline. The EDPB Opinion 22/2024 confirmed that the controller must be able to identify every sub-processor in the chain and to verify that guarantees are in place, although the depth of verification can be proportionate to risk. iliomad's vendor assessment service maps these chains for sponsors and HealthTech companies.