glossary

Pseudonymised data can still be attributed to a person with additional information held separately, so it remains personal data and the GDPR applies in full (Art. 4(5) GDPR). Anonymised data can no longer be linked to an identifiable person by any means reasonably likely to be used, so it falls outside the GDPR (Recital 26). Most clinical trial datasets are pseudonymised, not anonymous. See pseudonymisation and anonymisation.

A company established outside the EU that offers goods or services to people in the EU, or monitors their behaviour, must designate a representative in the EU under Art. 27 GDPR. The UK GDPR contains the same rule for the UK. Non-EU clinical trial sponsors recruiting participants in Europe are the typical case. See Data Protection Representative (DPR).

Art. 35 GDPR requires a DPIA before processing that is likely to result in a high risk to individuals, including large-scale processing of special categories of data such as health or genetic data. Clinical trials, health data warehouses and AI systems trained on patient data usually meet that threshold. See Data Protection Impact Assessment (DPIA).

Yes. An AI system that is a medical device, or a safety component of one, and that requires third-party conformity assessment under the MDR or IVDR is classified as high-risk under Art. 6(1) and Annex I of the AI Act. Its provider must then meet requirements on risk management, data governance, technical documentation and human oversight. See high-risk AI system.

The controller decides why and how personal data is processed; the processor processes it on the controller's behalf and under its instructions (Art. 4(7) and 4(8) GDPR). In a clinical trial the sponsor is usually the controller, while CROs, laboratories and eClinical vendors act as processors bound by an Art. 28 data processing agreement. See controller and processor.