World Health Organization (WHO)
The World Health Organization (WHO) is the specialised agency of the United Nations responsible for international public health, established in 1948 and headquartered in Geneva, with six regional offices and 194 Member States. It sets norms and standards, coordinates the response to health emergencies under the International Health Regulations (2005), maintains classifications such as the International Classification of Diseases (ICD-11) and the Anatomical Therapeutic Chemical (ATC) system, runs prequalification programmes for medicines, vaccines and diagnostics, and issues guidance across the health spectrum. Its constitution and the 2024 amendments to the International Health Regulations are central to global public health security.
For clinical research and pharmaceutical companies, the WHO matters in several concrete ways. The WHO International Clinical Trials Registry Platform (ICTRP) defines the Trial Registration Data Set and recognises primary registries (including the EU CTIS public portal and ClinicalTrials.gov) whose registration is a condition of publication under ICMJE rules. The WHO Programme for International Drug Monitoring, run with the Uppsala Monitoring Centre, collects pharmacovigilance reports in VigiBase and provides the WHODrug dictionary used to code medications in trials. WHO guidelines on good clinical practice, ethics review, and the 2016 guidance on ethical issues in public health surveillance shape national frameworks, particularly in low- and middle-income countries where trials increasingly recruit.
The WHO has also become an influential voice on health data governance and artificial intelligence. Its 2021 guidance on ethics and governance of AI for health, the 2024 guidance on large multi-modal models, the 2023 global strategy on digital health and its work on data sharing in emergencies set principles (transparency, accountability, inclusiveness, protection of autonomy and privacy) that regulators and funders reference. The WHO is not a data protection regulator and its instruments are not directly binding on companies, but where a sponsor relies on public health grounds under Art. 9(2)(i) or Art. 49(1)(d) GDPR, WHO declarations of emergencies and recommendations often supply the factual basis. As an international organisation, the WHO is also a distinct category of recipient under Chapter V GDPR when personal data is shared with it.
