R
Real-world data (RWD)
R
Real-world evidence (RWE)
R
Recipient
R
Record of processing activities (RoPA)
R
Restriction of processing
R
Right not to be subject to solely automated decision-making
R
Right of access
R
Right of information
R
Right of rectification
R
Rights of the data subject
R
Right to data portability
R
Right to erasure ("right to be forgotten")
R
Right to object
R
Right to restriction of processing
S
Scientific research purposes (Art. 89 GDPR)
S
Secondary use of health data
S
Security breach (security incident)
S
Security of processing
S
Sensitive data
S
Serious adverse event (SAE)

Word of the Day

Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person (Art. 4(5) GDPR). In a clinical trial, replacing a participant's name with a subject number while the investigator keeps the enrolment log is the archetypal example; the coding of samples and images works the same way.

Pseudonymisation is a security and risk-reduction measure expressly encouraged by the GDPR (Art. 25, 32 and 89), but it does not take data outside the Regulation. Recital 26 states that pseudonymised data which could be attributed to a person by the use of additional information remains personal data, and the EDPB Guidelines 01/2025 confirm this even where the recipient of the data cannot itself access the key. The concept is therefore fundamentally different from anonymisation, which is irreversible, and from de-identification under HIPAA, which follows a prescriptive US standard.

Effective pseudonymisation depends on design choices that should be documented in the DPIA: who holds the key and under what controls; whether pseudonyms are random codes or keyed hashes; how indirect identifiers such as full dates of birth, rare diagnoses or free text are handled; and how the pseudonymisation domain is defined so that datasets shared with different recipients cannot be linked. Well-designed pseudonymisation lowers risk scores, supports the compatibility of secondary use under Art. 89 and serves as a supplementary measure for international transfers.

see more
Click a letter to view all its definitions
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Term of the Day

Natural history study

A natural history study is a preplanned observational study intended to track the course of a disease over time, identifying demographic, genetic, environmental and other variables that correlate with its development and outcomes in the absence of intervention, or under standard of care. Designs may be retrospective (chart review of existing records) or prospective (longitudinal follow-up of a cohort or registry).

Natural history data is particularly important in rare and paediatric diseases, where randomised placebo-controlled trials may be infeasible or unethical. The FDA (guidance on rare disease natural history studies, 2019) and the EMA accept well-designed natural history studies to define endpoints and biomarkers, identify patient subgroups, estimate sample sizes and, in some cases, serve as external or historical control arms for single-arm trials supporting orphan products.

Because they are non-interventional, natural history studies fall outside the CTR and are governed by national law (for example France's MR-003 or MR-004 reference methodologies) and by the GDPR. They typically involve secondary use of medical records, long-term follow-up, genetic data and small populations in which anonymisation is rarely achievable, so pseudonymisation, a DPIA and a robust research legal basis under Art. 9(2)(j) are essential. Registries maintained by patient organisations or academic consortia raise additional questions of joint controllership and data access governance.

FAQs

Our frequently questions

What is the difference between anonymisation and pseudonymisation under the GDPR?

Pseudonymised data can still be attributed to a person with additional information held separately, so it remains personal data and the GDPR applies in full (Art. 4(5) GDPR). Anonymised data can no longer be linked to an identifiable person by any means reasonably likely to be used, so it falls outside the GDPR (Recital 26). Most clinical trial datasets are pseudonymised, not anonymous. See pseudonymisation and anonymisation.

Who needs to appoint an EU or UK data protection representative?

A company established outside the EU that offers goods or services to people in the EU, or monitors their behaviour, must designate a representative in the EU under Art. 27 GDPR. The UK GDPR contains the same rule for the UK. Non-EU clinical trial sponsors recruiting participants in Europe are the typical case. See Data Protection Representative (DPR).

When is a Data Protection Impact Assessment (DPIA) mandatory?

Art. 35 GDPR requires a DPIA before processing that is likely to result in a high risk to individuals, including large-scale processing of special categories of data such as health or genetic data. Clinical trials, health data warehouses and AI systems trained on patient data usually meet that threshold. See Data Protection Impact Assessment (DPIA).

Does the EU AI Act apply to medical device software?

Yes. An AI system that is a medical device, or a safety component of one, and that requires third-party conformity assessment under the MDR or IVDR is classified as high-risk under Art. 6(1) and Annex I of the AI Act. Its provider must then meet requirements on risk management, data governance, technical documentation and human oversight. See high-risk AI system.

What is the difference between a controller and a processor?

The controller decides why and how personal data is processed; the processor processes it on the controller's behalf and under its instructions (Art. 4(7) and 4(8) GDPR). In a clinical trial the sponsor is usually the controller, while CROs, laboratories and eClinical vendors act as processors bound by an Art. 28 data processing agreement. See controller and processor.

Find out how iliomad can help your company.

[Map placeholder]
Only visible in production
38.709099
-39.182035
1.6
6d17042a3425c5b3
Your message has been received!
We'll get back to you as soon as possible.
Something went wrong, please try again.