Summary
This guide outlines how to ensure GDPR compliance in clinical study protocols, emphasizing the importance of integrating data protection obligations from the start. It details essential elements such as legal bases, data minimization, and participant rights, aimed at expediting trial approvals while safeguarding participant rights.
Summary
Clinical study protocol data protection requires sponsors to embed GDPR obligations directly into the protocol document, covering lawful bases, data minimisation, retention periods, cross-border transfer mechanisms and participant rights. Under EU Clinical Trials Regulation 536/2014 (EU CTR) and the General Data Protection Regulation (EU) 2016/679 (GDPR), the protocol is not merely a scientific document: it is a primary compliance instrument that regulators, ethics committees and data protection authorities scrutinise. Sponsors who treat data protection as a protocol discipline from the outset reduce inspection risk, accelerate ethics approvals and protect participant rights at scale.
Clinical study protocol data protection
A clinical study protocol is the master document that defines a trial's objectives, design, methodology, statistical considerations and organisation. Under Article 2(2)(j) of EU CTR 536/2014, the protocol must include information on the collection, storage and use of personal data. This obligation elevates clinical study protocol data protection from a back-office concern to a front-line design requirement.
Sponsors operating across the European Economic Area (EEA) must satisfy both EU CTR 536/2014 and the GDPR simultaneously. Ethics committees and competent authorities review protocol data protection sections as part of the initial authorisation procedure, meaning that gaps in the protocol can delay trial start dates in every participating Member State.
This guide follows what iliomad calls the Protocol Data Protection Architecture (PDPA) framework: a layered approach that begins with GDPR core principles, builds in EU CTR-specific obligations, and then accommodates country-level formalities. The framework is designed to produce a protocol that is inspection-ready from day one.
What must a clinical study protocol include for GDPR compliance?
The GDPR requires sponsors to document their legal basis, data categories, retention rules and safeguards before processing begins. A compliant clinical study protocol data protection section must address at least six structural elements.
1. Legal basis and controller identification
Article 6 GDPR requires a lawful basis for every processing activity. In clinical trials, the most commonly relied-upon bases are Article 6(1)(c) (legal obligation), Article 6(1)(e) (public task) and, for commercial sponsors, Article 6(1)(f) (legitimate interests). Where the protocol involves special-category health data, Article 9(2)(j) (scientific research) in combination with Member State derogations is typically invoked. The protocol must name the data controller, which is ordinarily the sponsor, and identify any co-controllers, such as academic institutions or contract research organisations (CROs) acting in a dual capacity.
A CRO (contract research organisation) is a company that provides outsourced research services to sponsors, and its role as either a data processor under Article 28 GDPR or a co-controller must be determined and documented in the protocol before site activation.
2. Categories of personal data and data minimisation
The protocol must enumerate every category of personal data collected, including direct identifiers (name, date of birth, contact details) and indirect identifiers (subject identification codes, biomarker data). Article 5(1)(c) GDPR requires that data be adequate, relevant and limited to what is necessary. Listing data categories in the protocol forces this analysis at the design stage and enables ethics committees to assess proportionality.
3. Retention schedule
Data retention in clinical trials is governed by a hierarchy of instruments: Article 5(1)(e) GDPR (storage limitation), Article 58 of EU CTR 536/2014 (minimum 25-year archive for investigational medicinal product (IMP) trials), and ICH E6(R3) Good Clinical Practice (GCP) guidelines. The protocol must state the maximum retention period, the trigger event (last patient last visit, marketing authorisation, trial termination) and the responsible party.
4. Cross-border transfer mechanisms
Where data flows outside the EEA, for example to a US-based sponsor or a central laboratory in Singapore, the protocol must identify the transfer mechanism relied upon. Standard Contractual Clauses (SCCs) adopted by the European Commission in Decision 2021/914 are the most widely used instrument. The protocol section should reference the applicable module (processor-to-processor or controller-to-processor) and confirm that a Transfer Impact Assessment (TIA) has been or will be completed prior to the first data transfer.
5. Data Protection Impact Assessment status
A Data Protection Impact Assessment (DPIA) is a structured risk analysis required by Article 35 GDPR where processing is likely to result in a high risk to the rights and freedoms of natural persons. Large-scale processing of health data in clinical trials almost invariably meets this threshold. The protocol should confirm whether a DPIA has been completed, is in progress or is planned, and cross-reference the version number so that ethics committees can request the document.
6. Participant rights and information obligations
Articles 13 and 14 GDPR require controllers to provide data subjects with specific information at the point of collection. In clinical trials, this obligation is typically discharged through the Informed Consent Form (ICF). The protocol must confirm that the ICF contains a GDPR-compliant privacy notice and describe how participants may exercise their rights (access, rectification, restriction and objection) without prejudice to the scientific integrity of the trial, as permitted under Article 17(3)(d) GDPR.
How do country-specific rules affect the protocol data protection section?
Country-specific rules require sponsors to layer national obligations on top of the GDPR baseline within the protocol. The GDPR is a directly applicable regulation, but Article 9(2)(j) and Article 89 permit Member States to introduce additional safeguards for scientific research processing. These national adaptations must be reflected in the protocol and the ICF for each participating country.
Focus: the example of France and CNIL MR-001
In France, the Commission Nationale de l'Informatique et des Libertés (CNIL) manages research data protection through a system of reference methodologies (Méthodologies de Référence, MR). MR-001 is the CNIL's reference methodology for research involving health data. Sponsors who conform to MR-001 may process data without prior CNIL authorisation, provided they submit a declaration of conformity. The protocol data protection section for French sites must confirm conformity with MR-001, specify the sponsor's registration with the CNIL portal, and document how the MR-001 safeguards (pseudonymisation, access controls, specific retention limits) are implemented.
Focus: the example of Germany and the GDSG framework
Germany operates under a complex federal structure in which each Bundesland (federal state) may adopt its own hospital data protection law in addition to the federal BDSG (Bundesdatenschutzgesetz). The protocol must therefore identify the Bundesland of each German site and confirm that site-specific obligations, such as additional ethics committee opinions or hospital information governance approvals, have been incorporated. The German data protection authorities (Datenschutzbehörden) have issued guidance requiring that pseudonymisation measures be described at a technical level within the trial documentation, and the protocol data protection section is the appropriate location for this description.
Focus: the example of the United Kingdom and the ICO
Following the United Kingdom's departure from the European Union, clinical trials in the UK are governed by UK GDPR (the retained version of EU GDPR as amended by the Data Protection Act 2018) and by the Medicines for Human Use (Clinical Trials) Regulations 2004 (as amended). The Information Commissioner's Office (ICO) is the supervisory authority. For multi-country trials including UK sites, the protocol must maintain two parallel data protection sections or a single section with clearly delineated UK-specific provisions. The UK adequacy decision issued by the EU Commission in June 2021 facilitates EEA-to-UK transfers, but sponsors must monitor its validity period and document the reliance in the protocol.
Focus: the example of Switzerland and nFADP
Switzerland is not an EEA Member State and is not subject to the GDPR directly. The revised Federal Act on Data Protection (nFADP), which entered into force on 1 September 2023, aligns Swiss law closely with GDPR principles but introduces distinct obligations, including the requirement for a data protection impact assessment for high-risk processing and the appointment of a data protection adviser for certain entities. The EU-Switzerland adequacy decision covers EEA-to-Switzerland transfers, but the protocol must still document the legal basis under nFADP and any cantonal health data law applicable to the participating sites.
Protocol data protection architecture: a comparison of key instruments
The table below summarises the primary instruments that shape clinical study protocol data protection obligations across the most common trial jurisdictions.
<table><tr><th>Jurisdiction</th><th>Primary data protection instrument</th><th>Research derogation mechanism</th><th>Supervisory authority</th><th>Key protocol obligation</th></tr><tr><td>EU / EEA</td><td>GDPR (EU) 2016/679</td><td>Article 89 + Member State law</td><td>National DPA (e.g. CNIL, BfArM)</td><td>Legal basis, DPIA, SCCs for transfers</td></tr><tr><td>France</td><td>GDPR + CNIL MR-001</td><td>MR-001 conformity declaration</td><td>CNIL</td><td>MR-001 conformity, CNIL registration</td></tr><tr><td>Germany</td><td>GDPR + BDSG + Landesrecht</td><td>Article 27 BDSG</td><td>Landesbeauftragte</td><td>Site-level pseudonymisation description</td></tr><tr><td>United Kingdom</td><td>UK GDPR + DPA 2018</td><td>Schedule 2, Part 6 DPA 2018</td><td>ICO</td><td>UK-specific privacy notice, adequacy monitoring</td></tr><tr><td>Switzerland</td><td>nFADP (in force Sept 2023)</td><td>Article 34 nFADP</td><td>FDPIC</td><td>nFADP legal basis, data protection adviser</td></tr><tr><td>United States (sites)</td><td>No federal equivalent; HIPAA applies</td><td>HIPAA research authorisation</td><td>HHS / OCR</td><td>HIPAA authorisation or waiver; SCC / SCH for EEA transfers</td></tr></table>How should sponsors manage protocol amendments and data protection updates?
Sponsors must update the clinical study protocol data protection section whenever a material change occurs, and submit the amended protocol for ethics committee and, where required, competent authority review. Common triggers for amendment include a change in the transfer mechanism (for example, replacing Privacy Shield reliance with SCCs following the Schrems II ruling of the Court of Justice of the European Union in July 2020), the addition of a new participating country, a change in the CRO or central laboratory, or a significant change in data categories.
The Trial Master File (TMF) must contain a version-controlled record of every protocol amendment and the corresponding data protection documentation. ICH E6(R3) GCP, published in final form in May 2023, reinforces this requirement by mandating that the TMF support the reconstruction of the trial and the identification of all parties who processed participant data.
Sponsors should establish a standing data protection amendment checklist that maps each protocol change against the GDPR obligations affected. This checklist reduces the risk of inadvertent non-compliance when operational changes are made under time pressure during the conduct phase.
How iliomad supports clinical study protocol data protection
iliomad provides end-to-end support for sponsors embedding data protection into clinical study protocols. Our PDPA framework covers protocol drafting and review, DPIA preparation, SCC module selection, country-specific annex drafting and ethics committee correspondence. We also support the appointment of EU and UK data protection representatives, which are mandatory for sponsors established outside the EEA or UK who conduct trials with participants in those jurisdictions.
If you are preparing for a Phase II or Phase III trial and need a protocol data protection section that satisfies EU CTR 536/2014, the GDPR and national requirements simultaneously, contact iliomad for a scoped assessment. Our team will confirm the obligations applicable to your trial footprint and propose a compliant documentation structure before your first ethics submission.
Explore our clinical trials data protection services to understand how iliomad can support your next study from protocol design to close-out.
FAQs
Our frequently questions
Under Article 35 GDPR, a DPIA is required when processing is likely to result in a high risk to the rights and freedoms of individuals. Given that clinical trials involve large-scale processing of special-category health data, they almost invariably meet this threshold, making a DPIA a near-universal requirement. The clinical study protocol must confirm whether the DPIA has been completed, is in progress or is planned, and cross-reference its version number so that ethics committees can request and review the document. Failing to address DPIA status in the protocol can delay ethics approvals and expose sponsors to regulatory scrutiny.
Sponsors must update the protocol's data protection section whenever a material change occurs and submit the amended protocol for ethics committee and, where required, competent authority review. Common triggers for amendment include: a change in the cross-border transfer mechanism (e.g., replacing an invalidated instrument with SCCs following the Schrems II ruling); the addition of a new participating country; a change in CRO or central laboratory; or a significant change in data categories processed. All protocol amendments and corresponding data protection documentation must be version-controlled and stored in the Trial Master File (TMF), in line with ICH E6(R3) GCP requirements. Sponsors are advised to maintain a standing data protection amendment checklist to manage these updates systematically.
While the GDPR provides a baseline, Member States and third countries may impose additional obligations that must be layered into the protocol. For example: in France, sponsors must confirm conformity with CNIL's MR-001 reference methodology and document pseudonymisation and access controls; in Germany, sponsors must identify the relevant Bundesland for each site and incorporate site-specific ethics or hospital governance requirements; in the UK, sponsors must address UK GDPR and the Medicines for Human Use (Clinical Trials) Regulations 2004, maintaining UK-specific protocol provisions; and in Switzerland, the revised nFADP (in force since September 2023) requires documentation of the legal basis under Swiss law and any applicable cantonal health data rules. Multi-country trials must reflect all applicable national requirements within the protocol and the Informed Consent Form for each jurisdiction.
A Contract Research Organisation (CRO) is a company that provides outsourced research services to sponsors. Under GDPR, a CRO may act either as a data processor under Article 28 or as a co-controller, depending on the level of decision-making authority it exercises over the data. This distinction must be determined and clearly documented in the protocol before site activation. If acting as a processor, a Data Processing Agreement (DPA) must be in place; if acting as a co-controller, a joint controller arrangement must be established and referenced in the protocol.
A GDPR-compliant clinical study protocol data protection section must address six structural elements: (1) Legal basis and controller identification — documenting the lawful basis under Article 6 GDPR and naming the data controller and any co-controllers; (2) Categories of personal data and data minimisation — enumerating all direct and indirect identifiers collected, in line with Article 5(1)(c) GDPR; (3) Retention schedule — defining maximum retention periods, trigger events and responsible parties per Article 5(1)(e) GDPR and Article 58 of EU CTR 536/2014; (4) Cross-border transfer mechanisms — identifying tools such as Standard Contractual Clauses (SCCs) and confirming Transfer Impact Assessments (TIAs); (5) Data Protection Impact Assessment (DPIA) status — confirming whether a DPIA has been completed, is in progress or is planned; and (6) Participant rights and information obligations — ensuring the Informed Consent Form (ICF) contains a GDPR-compliant privacy notice covering rights of access, rectification, restriction and objection.
Clinical study protocol data protection refers to the obligation for sponsors to embed GDPR compliance requirements directly into the clinical trial protocol document. Under EU Clinical Trials Regulation 536/2014 (EU CTR) and the GDPR, the protocol is not just a scientific document — it is a primary compliance instrument reviewed by regulators, ethics committees and data protection authorities. Addressing data protection at the protocol design stage reduces inspection risk, accelerates ethics approvals and protects participant rights across all participating Member States.
When clinical trial data flows outside the European Economic Area (EEA) — for example, to a US-based sponsor headquarters or a central laboratory in Singapore — the protocol must identify and document the applicable transfer mechanism. Standard Contractual Clauses (SCCs), adopted by the European Commission in Decision 2021/914, are currently the most widely used instrument for such transfers. The protocol data protection section should specify the relevant SCC module (e.g. processor-to-processor or controller-to-processor) and confirm that a Transfer Impact Assessment (TIA) has been or will be completed prior to the first data transfer. For transfers to the UK and Switzerland, EU adequacy decisions are in place, but sponsors must monitor their ongoing validity and document reliance on them in the protocol. For US sites, HIPAA authorisation or a waiver applies at the national level, while SCCs or their equivalent remain necessary for EEA-to-US data flows.
Sponsors must update the clinical study protocol data protection section and submit it for ethics committee (and, where required, competent authority) review whenever a material change occurs. Common triggers include: a change in the cross-border transfer mechanism (e.g. replacing an invalidated instrument with Standard Contractual Clauses, as was necessary following the Schrems II ruling in July 2020); the addition of a new participating country with its own national data protection requirements; a change in the CRO or central laboratory affecting controller/processor relationships; or a significant change in the categories of personal data collected. The Trial Master File (TMF) must contain a version-controlled record of every protocol amendment and corresponding data protection documentation, as reinforced by ICH E6(R3) GCP (finalised May 2023). Sponsors are advised to maintain a standing data protection amendment checklist to map each protocol change against the GDPR obligations affected.
A Data Protection Impact Assessment (DPIA) is required under Article 35 GDPR whenever processing is likely to result in a high risk to the rights and freedoms of natural persons. Large-scale processing of health data in clinical trials almost invariably meets this threshold, making DPIAs a standard requirement rather than an exception in the clinical research context. The clinical study protocol must confirm whether a DPIA has been completed, is in progress or is planned, and should cross-reference the DPIA version number so that ethics committees can request the document for review. Completing the DPIA before or alongside protocol drafting — rather than after — helps identify and address privacy risks at the design stage, reducing the likelihood of costly amendments later.
While the GDPR sets a common baseline, Articles 9(2)(j) and 89 allow Member States to introduce additional safeguards for scientific research, which must be reflected in the protocol and Informed Consent Form for each participating country. For example: in France, sponsors must confirm conformity with CNIL's MR-001 reference methodology and register on the CNIL portal; in Germany, the protocol must identify each site's Bundesland and document site-specific pseudonymisation measures; in the UK, sponsors must include UK GDPR-specific provisions and monitor the EU adequacy decision's validity; in Switzerland, the revised nFADP (in force since September 2023) requires a distinct legal basis and, for certain entities, the appointment of a data protection adviser. For multi-country trials, a layered approach — GDPR baseline plus country-specific annexes — is recommended to ensure full compliance across all jurisdictions.
Under Article 2(2)(j) of EU Clinical Trials Regulation 536/2014 (EU CTR), the protocol must explicitly include information on the collection, storage and use of personal data. This elevates clinical study protocol data protection from a back-office concern to a front-line design requirement. Ethics committees and competent authorities review the data protection section as part of the initial trial authorisation procedure, meaning that gaps can delay trial start dates across every participating Member State. Sponsors who treat data protection as a protocol discipline from the outset reduce inspection risk, accelerate ethics approvals and better protect participant rights at scale.
A GDPR-compliant clinical study protocol data protection section must address six structural elements: (1) Legal basis and controller identification — naming the lawful basis under Article 6 GDPR (e.g. legal obligation, public task or legitimate interests) and identifying the data controller and any co-controllers such as CROs; (2) Categories of personal data and data minimisation — listing all direct and indirect identifiers collected, in line with Article 5(1)(c) GDPR; (3) Retention schedule — specifying the maximum retention period, the trigger event and the responsible party, respecting EU CTR 536/2014's 25-year minimum archive requirement; (4) Cross-border transfer mechanisms — identifying the instrument used (e.g. Standard Contractual Clauses) and confirming that a Transfer Impact Assessment has been or will be completed; (5) DPIA status — confirming whether a Data Protection Impact Assessment has been completed, is in progress or is planned; and (6) Participant rights and information obligations — confirming that the Informed Consent Form contains a GDPR-compliant privacy notice and describes how participants may exercise their rights.
Find out how iliomad can help your company.
Only visible in production
Clinical Site Agreement: Navigating US Export Control Review of Cross-Border Data Transfers in Clinical Trials
Learn how institutional export control policies at clinical sites affect cross-border data transfers in trials, even below DOJ Bulk Data Rule thresholds.
Weekly Digest: AI Governance Milestones, EHDS Templates and a Wave of Healthcare Cyber Incidents (Week of 20 October 2026)
This week's digest covers EU AI Act enforcement firsts, EHDS secondary-use templates, AMA agentic AI governance, and a cluster of serious healthcare data breaches affecting hundreds of thousands of patients.
AI-enabled medical devices in Great Britain: what the MHRA's regulatory overhaul means for your compliance strategy
The MHRA is overhauling AI-enabled medical device regulation. Learn what the planned changes mean for clinical data compliance and your governance strategy.
