Click here to open the filter panel
B
Biotechnology
B
Broad consent
B
Business associate agreement (BAA)
C
Central imaging
C
Central laboratory
C
Chemistry, Manufacturing and Controls (CMC)
C
Clinical outcome assessment (COA)
C
Clinical research
C
Clinical study
C
Clinical trial
C
Clinical trial agreement (CTA)
C
Clinical trial phases
C
Clinical Trials Information System (CTIS)
C
Clinical trial site
C
Clinical Trials Regulation (CTR) 536/2014
C
Clinician-reported outcome (ClinRO)
C
CNIL (Commission nationale de l'informatique et des libertés)
C
Codes of conduct
C
Consent
C
Contract research organisation (CRO)
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

S

Supplementary measures

Supplementary measures are the additional safeguards that a data exporter must adopt, on top of an Art. 46 GDPR transfer tool such as standard contractual clauses or binding corporate rules, where the transfer impact assessment concludes that the law or practice of the destination third country would impinge on the effectiveness of the tool, typically because public authorities can access the data beyond what is necessary and proportionate in a democratic society. The concept comes from the Court of Justice's Schrems II judgment (C-311/18) and was operationalised by the EDPB Recommendations 01/2020, adopted in final form on 18 June 2021.

The EDPB distinguishes technical, contractual and organisational measures, and stresses that only technical measures can prevent access by foreign authorities; contractual and organisational measures complement them. Effective technical measures include encryption in transit and at rest where the keys are held exclusively by the exporter or a trusted entity in the EEA and the importer cannot decrypt (Use Case 1: storage for backup), pseudonymisation where the additional information is held in the EEA and re-identification by the importer or authorities is not reasonably possible (Use Case 2), split or multi-party processing across importers in different jurisdictions, and processing in a protected recipient environment such as a professional bound by secrecy. The Recommendations identify scenarios where no effective measure exists, notably transfers to cloud providers or processors that need access to data in the clear (Use Case 6) and remote access for business purposes (Use Case 7), when the destination's law is problematic. Contractual measures include transparency obligations on government requests, commitments to challenge them, and the 2021 SCC Clauses 14 and 15; organisational measures include internal policies, access restrictions and data minimisation.

In clinical research, supplementary measures are most relevant for transfers of pseudonymised trial data to a US sponsor or CRO that is not certified under the Data Privacy Framework, where keeping the code key at the EU site and restricting the dataset to what the protocol requires can satisfy Use Case 2. They are of little help where the importer must see identifiable data, such as a non-EU central reading centre receiving medical images with embedded identifiers, in which case the data flow itself should be redesigned. Measures adopted must be documented in the TIA and reflected in contracts.