Summary

A contract research organisation (CRO) acting as a data processor in a clinical trial must be bound by a data processing agreement (DPA) that meets the requirements of Article 28 of the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679. The sponsor, as data controller, retains full accountability for the lawfulness of processing. Practical compliance requires a clearly scoped DPA, documented sub-processor chains, transfer safeguards and alignment with the EU Clinical Trials Regulation (EU CTR) 536/2014.

CRO data processor

A contract research organisation (CRO) is a service provider that performs clinical trial activities, such as site monitoring, data management and pharmacovigilance, on behalf of a pharmaceutical sponsor. When a CRO processes personal data of trial participants in that capacity, it qualifies as a data processor under Article 4(8) GDPR, meaning it handles personal data solely on the documented instructions of the controller.

Misclassifying a CRO's role, or leaving the contractual relationship silent on data protection, is one of the most common compliance gaps identified during regulatory inspections. This article explains the legal framework, the contractual requirements and the practical steps that sponsors and CROs must take to operate within GDPR.

What makes a CRO a data processor rather than a joint controller?

A CRO is a data processor when it processes trial data exclusively according to the sponsor's instructions and has no independent purpose for that processing. This distinction matters because processors and joint controllers carry different legal obligations and liability exposure under GDPR.

The European Data Protection Board (EDPB) Guidelines 07/2020 on the concepts of controller and processor clarify that the determining factor is whether a party exercises discretion over the purposes of processing. A CRO that follows a sponsor's clinical protocol, uses the sponsor's electronic data capture (EDC) system and returns all data to the sponsor at study end is a processor. If, however, the same CRO were to use participant data for its own business analytics or pooled benchmarking databases, it would likely become a joint controller for that additional purpose.

In practice, the boundary can be blurred when a CRO supplies its own technology platform, retains data for quality assurance beyond the trial, or conducts safety signal detection independently. Sponsors should conduct a written role assessment at the outset of each study and document the conclusion in the trial master file (TMF), which is the master repository of essential documents required under EU CTR 536/2014 and ICH E6(R2) Good Clinical Practice.

Focus: the example of France

The Commission Nationale de l'Informatique et des Libertés (CNIL), France's national data protection authority, has consistently emphasised that sponsors conducting trials under the CNIL's methodology reference MR-001 must identify all processors and sub-processors before submitting their declaration. Where a CRO is engaged, its role, the data flows it handles and the contractual basis must be documented before the MR-001 declaration is filed. Failure to list a CRO correctly can invalidate the declaration and trigger a requirement for a full authorisation procedure, adding months to study start-up.

Focus: the example of the United Kingdom

Following the United Kingdom's departure from the European Union, the UK GDPR (as retained in domestic law by the European Union (Withdrawal) Act 2018) applies to trials conducted at UK sites. The Information Commissioner's Office (ICO) has confirmed that the substantive requirements for processor contracts mirror those of EU GDPR Article 28. UK-based CROs processing data on behalf of EU sponsors must, in addition, assess whether a transfer mechanism such as the UK International Data Transfer Agreement (IDTA) is needed for the return flow of data to the EU sponsor.

What must a data processing agreement with a CRO contain?

A data processing agreement (DPA) is the mandatory written contract between a controller and a processor, required by Article 28(3) GDPR, that sets out the subject matter, duration, nature and purpose of the processing, the type of personal data, the categories of data subjects and the obligations and rights of the controller.

For a clinical trial DPA with a CRO, the minimum mandatory clauses are as follows:

1. A precise description of the processing activities, referencing the protocol number and version.
2. An instruction that the CRO may process trial data only in accordance with the sponsor's written instructions, including the protocol and any operational manuals.
3. Confidentiality obligations binding all CRO personnel with access to participant data.
4. Technical and organisational security measures, specified at an appropriate level of detail for the sensitivity of health data, which is a special category under Article 9 GDPR.
5. Conditions for engaging sub-processors, discussed further below.
6. Assistance obligations: the CRO must help the sponsor respond to data subject requests under Articles 15 to 22 GDPR and to fulfil obligations under Articles 32 to 36 GDPR, including data protection impact assessments (DPIAs).
7. Deletion or return of data at study end, with confirmation in writing.
8. Cooperation with audits and inspections by the sponsor and competent supervisory authorities.

A DPA that omits any of these elements is non-compliant. Sponsors should not rely on a CRO's standard master service agreement (MSA) as a substitute; the data protection provisions must meet the Article 28 standard specifically.

<table><tr><th>DPA element</th><th>GDPR reference</th><th>Clinical trial application</th></tr><tr><td>Processing instructions</td><td>Art. 28(3)(a)</td><td>Protocol, SAP, EDC manual</td></tr><tr><td>Confidentiality of personnel</td><td>Art. 28(3)(b)</td><td>NDA schedule or DPA annex</td></tr><tr><td>Security measures</td><td>Art. 28(3)(c) &amp; Art. 32</td><td>ISO 27001 controls, pseudonymisation</td></tr><tr><td>Sub-processor approval</td><td>Art. 28(2) &amp; 28(4)</td><td>Lab vendors, eClinical platforms</td></tr><tr><td>Data subject rights assistance</td><td>Art. 28(3)(e)</td><td>SOP for withdrawal and erasure</td></tr><tr><td>DPIA assistance</td><td>Art. 28(3)(f)</td><td>Pre-activation assessment</td></tr><tr><td>Data return or deletion</td><td>Art. 28(3)(g)</td><td>End-of-study data transfer protocol</td></tr><tr><td>Audit rights</td><td>Art. 28(3)(h)</td><td>Sponsor audit clause, authority access</td></tr></table>

How should sponsors manage CRO sub-processors in a trial?

Sub-processors are third parties engaged by the CRO to carry out specific processing activities on the controller's data. Under Article 28(2) GDPR, a processor may not engage a sub-processor without the controller's prior written authorisation, either specific (naming the entity) or general (permitting a category with notification obligations).

In clinical trials, CRO sub-processors typically include electronic clinical outcome assessment (eCOA) and electronic patient-reported outcome (ePRO) platform providers, central laboratory vendors, interactive response technology (IRT) suppliers and cloud hosting providers. Each sub-processor must be bound by a contract imposing the same data protection obligations as those in the principal DPA, as required by Article 28(4) GDPR.

Sponsors should maintain a sub-processor register as part of the TMF, updated whenever a sub-processor is added or replaced. Where a sub-processor is located outside the European Economic Area (EEA), a transfer mechanism must be in place. The standard contractual clauses (SCCs) adopted by the European Commission in Decision 2021/914 are the most commonly used instrument, supplemented by a transfer impact assessment (TIA) where the destination country does not offer an adequate level of protection under Article 45 GDPR.

Focus: the example of the United States

Many CROs route trial data through US-based cloud infrastructure or use US-headquartered eClinical vendors. Following the invalidation of Privacy Shield in Schrems II (Case C-311/18, Court of Justice of the European Union, July 2020), transfers to the United States must rely on the EU-US Data Privacy Framework (DPF), adopted by the European Commission in Decision 2023/1795, or on SCCs with a completed TIA. Sponsors should verify that their CRO's sub-processor contracts incorporate the correct module of the 2021 SCCs: Module 3 (processor to processor) applies when the CRO transfers data to a sub-processor.

Focus: the example of Switzerland

Switzerland is not an EEA member state. Swiss CROs or sub-processors are subject to the revised Federal Act on Data Protection (revFADP), which entered into force on 1 September 2023. The European Commission has recognised Switzerland as providing adequate protection under EU GDPR, so intra-EEA-to-Switzerland flows do not require SCCs. However, the adequacy decision predates the revFADP and covers the earlier framework; sponsors conducting ongoing assessments should monitor whether the European Commission updates its adequacy finding.

Focus: the example of India

India has enacted the Digital Personal Data Protection Act 2023 (DPDPA 2023), which is being brought into force in stages. At the time of publication, the European Commission has not issued an adequacy decision for India. Sponsors transferring trial data from EEA sites to Indian CRO processing centres must therefore execute Module 2 or Module 3 SCCs (depending on whether the Indian entity is a controller or processor) and document the TIA. Given the complexity, some sponsors elect to restrict processing of EEA participant data to EEA infrastructure where operationally feasible.

Accountability and liability: who is responsible when a CRO causes a breach?

Accountability under GDPR rests primarily with the controller. Article 82(2) GDPR provides that a processor is liable for damages only where it has failed to comply with obligations specifically directed to processors, or where it has acted outside or contrary to the lawful instructions of the controller.

In practice, this means that if a CRO suffers a personal data breach because it failed to implement the security measures specified in Article 32 GDPR, both the sponsor and the CRO may face regulatory action. The supervisory authority may investigate the sponsor for failing to select a processor offering sufficient guarantees under Article 28(1) GDPR, and may separately investigate the CRO for the security failure itself.

Article 33 GDPR requires the sponsor, as controller, to notify the competent supervisory authority within 72 hours of becoming aware of a breach likely to result in a risk to individuals. The CRO must notify the sponsor without undue delay upon discovering a breach, as required by Article 33(2) GDPR. The DPA should specify the notification pathway, the contact persons and the maximum response time, which should be shorter than 24 hours to allow the sponsor to meet its own 72-hour deadline.

Sponsors operating multi-country trials should map the lead supervisory authority under the one-stop-shop mechanism of Article 56 GDPR where the trial involves EEA member states. For trials also conducted in the United Kingdom, the ICO operates separately and UK-specific breach notifications must be filed independently under Article 33 UK GDPR.

Focus: the example of Ireland

Ireland's Data Protection Commission (DPC) serves as the lead supervisory authority for many global pharmaceutical sponsors whose EU establishment or main establishment is located in Ireland, including several large CROs. DPC enforcement decisions in the life sciences sector have emphasised the need for detailed, operationally tested incident response procedures in DPAs, not merely template language. Sponsors and CROs should review DPC guidance on processor contracts, available on the DPC's official website, when drafting or updating their agreements.

Practical compliance checklist for sponsors engaging a CRO

The following steps reflect current regulatory expectations from GDPR Article 28, EDPB guidance and EU CTR 536/2014:

1. Conduct a written role assessment (processor, joint controller or independent controller) before contract execution.
2. Execute a GDPR-compliant DPA covering all Article 28(3) mandatory elements.
3. Obtain a list of all sub-processors and verify that each is bound by equivalent obligations.
4. Identify all international data transfers in the CRO's processing chain and confirm that an adequate transfer mechanism is in place for each.
5. Complete a DPIA for the trial, incorporating the CRO's processing activities, as required for large-scale processing of special category health data under Article 35 GDPR.
6. Store the DPA, sub-processor register, TIAs and DPIA in the TMF.
7. Include a breach notification SOP in the DPA and test it at study start-up.
8. Schedule at least one audit or vendor assessment of the CRO during the trial.

Work with iliomad on your CRO data processor framework

Iliomad provides specialist data protection support to clinical trial sponsors and CROs operating under GDPR and EU CTR 536/2014. Our services include Article 28 DPA drafting and review, sub-processor mapping, TIA completion, DPIA facilitation and ongoing DPO support.

If you are preparing a Phase II or Phase III study and need a compliant CRO data processor framework before your trial activation date, contact the iliomad team to discuss your requirements.