Summary
This article explores the role of Data Protection Officers (DPOs) in overseeing cross-border data transfers in clinical trials, highlighting necessary legal tools and compliance strategies. It outlines a four-step oversight model enabling DPOs to advise on the transfer mechanisms while emphasizing the sponsor's accountability in decision-making.
A cross-border data transfer in clinical trials happens whenever participant data is sent to, or made accessible from, a country outside the EEA, which makes it a restricted transfer under Chapter V of the GDPR. Each such transfer needs a lawful transfer tool: an adequacy decision, standard contractual clauses, binding corporate rules or an Article 49 derogation. Where the destination offers no adequacy finding, the exporter must also run a transfer impact assessment and add supplementary measures. The sponsor as controller decides and owns this, while the data protection officer (DPO) advises on it and monitors it.
Key takeaways
- Sending clinical trial participant data outside the EEA is a restricted transfer under GDPR Articles 44 to 49 and needs a valid transfer tool for each leg of the chain.
- Under GDPR Article 39, the data protection officer advises on and monitors cross-border transfers, but the sponsor as controller makes and owns the decision.
- After Schrems II, the EDPB Recommendations 01/2020 set out a six-step transfer impact assessment and name clinical trials among the transfer purposes to assess.
- Standard contractual clauses under Decision (EU) 2021/914 use a modular structure that fits the sponsor, CRO and sub-processor chain but cannot bind third-country public authorities.
- The same trial can trigger EEA, UK and Swiss transfer rules in parallel, so each jurisdiction's tool and documentation should be confirmed separately.
The DPO's transfer oversight model
The DPO does not choose the transfer mechanism, but a workable operating model lets the DPO advise and monitor without owning the controller's decision. Four steps structure that oversight:
- Map the transfer. Identify every point where participant data leaves or is accessible from outside the EEA, across the sponsor, CRO, investigator sites and technology vendors.
- Verify the tool. Confirm the legal basis for each leg: adequacy, standard contractual clauses, binding corporate rules or a derogation.
- Advise on the assessment. Where there is no adequacy finding, support the controller through a transfer impact assessment and the selection of supplementary measures.
- Monitor and re-evaluate. Track the sub-processor chain, document oversight, and re-examine the transfer when the law or the destination changes.
This model is the differentiator of our approach to data protection in clinical trials: it ties mechanism selection to a named accountability role rather than treating transfers as a one-off legal question.
When does clinical trial data count as a cross-border transfer?
Clinical trial data counts as a cross-border transfer whenever personal data is transmitted to, or remotely accessed from, a third country, meaning a country outside the EEA that has no equivalent EU adequacy arrangement. This applies to coded or pseudonymised participant data too, because pseudonymised data remains personal data under the GDPR. A trial generates transfers in many ordinary situations: a non-EEA sponsor receiving data from EEA sites, a CRO coordinating a multi-country study, a central laboratory or cloud vendor hosted abroad, and safety reporting into global pharmacovigilance systems. Each of these legs needs its own analysis, because the restricted transfer rules of Articles 44 to 49 apply leg by leg, not once per trial.
Who is accountable: sponsor, CRO, sites, vendors and the DPO?
The sponsor, as controller, is accountable for the lawfulness of each transfer. The CRO usually acts as a processor, investigator sites may be separate or joint controllers depending on the arrangement, and vendors act as processors or sub-processors. The DPO advises and monitors across all of them but does not decide. The table below summarises the typical allocation of roles.
<table><tr><th>Actor</th><th>Typical GDPR role</th><th>Transfer responsibility</th></tr><tr><td>Sponsor</td><td>Controller</td><td>Decides the transfer tool, runs or commissions the assessment, bears accountability</td></tr><tr><td>CRO</td><td>Processor</td><td>Implements the tool, flows obligations to sub-processors, documents the chain</td></tr><tr><td>Investigator site</td><td>Controller or joint controller</td><td>Confirms its own export legs and local-law constraints</td></tr><tr><td>Technology vendor</td><td>Processor or sub-processor</td><td>Signs clauses, applies technical and organisational measures</td></tr><tr><td>DPO</td><td>Advisory and monitoring</td><td>Advises on obligations, monitors compliance, flags gaps</td></tr></table>For the processor side of this picture, our analysis of the CRO as data processor in clinical trials sets out how contractual duties cascade down the chain.
What does GDPR Article 39 require the DPO to do for transfers?
Article 39 gives the DPO a monitoring and advisory mandate, not a decision-making one. The DPO's tasks include to inform and advise the controller and processor of their obligations, and to monitor compliance, including the assignment of responsibilities, awareness-raising, training and the related audits, as set out in Article 39 GDPR. For cross-border transfers, that translates into reviewing the transfer map, challenging the choice of tool, checking that transfer impact assessments are performed and documented, and building transfers into the audit plan. The EDPB also recommends, as an organisational supplementary measure, that the DPO be appropriately and timely involved and given access to information on international transfers. Appointing an outsourced data protection officer gives sponsors a practitioner who performs this role hands-on.
Which transfer mechanism applies: adequacy, SCCs, BCRs or derogations?
The mechanism depends on the destination and the transfer scenario. An adequacy decision removes the need for additional safeguards; where none exists, standard contractual clauses (SCCs) are the most common tool for a trial. The SCCs in Decision (EU) 2021/914 combine general clauses with a modular approach to cater for various transfer scenarios and the complexity of modern processing chains, which fits the sponsor, CRO and sub-processor structure, as the European Commission standard contractual clauses decision sets out. The clauses cannot, however, bind third-country public authorities, which is why a destination assessment remains necessary.
<table><tr><th>Mechanism</th><th>When it applies</th><th>Clinical trial use</th></tr><tr><td>Adequacy decision</td><td>Destination recognised as adequate</td><td>No extra safeguards needed; verify current status</td></tr><tr><td>Standard contractual clauses</td><td>No adequacy; most third countries</td><td>Default tool for sponsor, CRO and vendor legs</td></tr><tr><td>Binding corporate rules</td><td>Intra-group transfers</td><td>Large sponsors with global affiliates</td></tr><tr><td>Article 49 derogations</td><td>Occasional, specific situations</td><td>Narrow; not a routine basis for bulk trial data</td></tr></table>Adequacy status changes, so our reading is that certified arrangements such as the EU-US Data Privacy Framework should be verified at the time of writing before relying on them, given the history of legal challenge to such findings.
The UK and Swiss layers: do they change the analysis?
Yes. A single multinational trial can trigger EEA, UK and Swiss transfer rules at the same time, and each has its own tool and paperwork. These layers should be confirmed separately rather than assumed to mirror the EEA position.
Focus: the example of the United Kingdom
Transfers of participant data out of the UK fall under the UK GDPR and are typically covered by the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs. Sponsors should confirm the current ICO position and the applicable version before relying on it, and consider whether an EU and UK data protection representative is required where the sponsor has no UK or EEA establishment.
Focus: the example of Switzerland
Swiss transfers are governed by the revised Federal Act on Data Protection (revFADP). The Federal Data Protection and Information Commissioner (FDPIC) recognises the EU SCCs subject to Swiss-specific adaptations and maintains its own list of countries with adequate protection. In our reading, the Swiss position should be checked directly rather than inferred from the EEA analysis, as its adequacy list and amendments do not always align.
How does the DPO advise on a transfer impact assessment?
A transfer impact assessment (TIA) is the case-by-case evaluation an exporter must perform to check whether the law and practice of the destination country undermine the chosen transfer tool. After the Schrems II judgment, the EDPB Recommendations 01/2020 on supplementary measures set out six steps: know your transfers, verify the transfer tool, assess the law and practice of the third country, identify and adopt supplementary measures, take any formal procedural steps, and re-evaluate at intervals. The recommendations name clinical trials among the transfer purposes to assess, and state that contractual measures alone cannot prevent public-authority access. The DPO's contribution is to advise the controller through each step, confirm who runs the assessment, and check that the sub-processor chain and the supporting evidence are documented. Our guide to data transfer compliance in clinical trials expands on the operational detail.
How does the DPO monitor transfers across the CRO and sub-processor chain?
Monitoring is continuous, not a point-in-time sign-off. The DPO keeps the transfer map current, checks that each new vendor or sub-processor is added under a valid tool, and feeds transfers into the audit programme. Where no adequacy applies, supplementary measures such as pseudonymisation and strong encryption can be effective, provided the keys stay in the EEA and the importer cannot re-identify participants. Documenting this oversight, including who was consulted and when, is what turns a defensible decision into an audit-ready one.
How iliomad helps
iliomad acts as your outsourced DPO and as your EU, UK and Swiss data protection representative, mapping trial data flows, selecting and documenting transfer tools, running transfer impact assessments and monitoring the CRO and vendor chain. We implement the oversight model above hands-on, so your transfers hold up to audit and regulator scrutiny. Get in touch to discuss your trial's cross-border data transfer obligations.
FAQs
Our frequently questions
Yes. A single multinational clinical trial can simultaneously trigger EEA, UK, and Swiss transfer rules, and each jurisdiction has its own tools and documentation requirements that must be confirmed independently. In the UK, transfers are governed by the UK GDPR and are typically covered by the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, with the current ICO position verified before reliance. In Switzerland, transfers fall under the revised Federal Act on Data Protection (revFADP), and the FDPIC recognises EU SCCs subject to Swiss-specific adaptations. The Swiss adequacy list does not always align with the EEA position, so it must be checked directly rather than assumed to mirror it.
A Transfer Impact Assessment (TIA) is a case-by-case evaluation that a data exporter must perform to determine whether the law and practice of the destination country undermine the effectiveness of the chosen transfer tool. It became mandatory following the Schrems II judgment, and the EDPB Recommendations 01/2020 set out a six-step framework for conducting one, specifically naming clinical trials among the transfer purposes to assess. Where no adequacy decision applies, the TIA must be completed before transferring data, and supplementary measures — such as pseudonymisation and strong encryption with keys retained in the EEA — may be required to safeguard participant data.
Under GDPR Article 39, the DPO holds a monitoring and advisory mandate, not a decision-making one. The DPO's tasks include informing and advising the controller and processor of their obligations, and monitoring compliance, including the assignment of responsibilities, awareness-raising, training, and related audits. A practical DPO oversight model covers four steps: mapping the transfer, verifying the tool, advising on the transfer impact assessment, and continuously monitoring and re-evaluating. The DPO does not choose the transfer mechanism but ensures the controller's decision is informed and defensible.
The sponsor, acting as controller, is ultimately accountable for the lawfulness of each cross-border transfer. The CRO typically acts as a processor, investigator sites may be separate or joint controllers depending on the arrangement, and vendors act as processors or sub-processors. The Data Protection Officer (DPO) advises and monitors across all parties but does not make the transfer decision — that responsibility remains with the sponsor as controller. Each party's role and obligations should be clearly documented in the trial's data protection framework.
The applicable mechanism depends on the destination country and the specific transfer scenario. Where an adequacy decision exists, no additional safeguards are required. Where none exists, Standard Contractual Clauses (SCCs) under Decision (EU) 2021/914 are the most common tool, offering a modular structure that fits the sponsor, CRO, and sub-processor chain. Binding Corporate Rules (BCRs) are another option for intra-group transfers, while Article 49 derogations may apply in specific limited situations. It is important to verify certified arrangements such as the EU-US Data Privacy Framework at the time of reliance, given the history of legal challenges to such findings.
Clinical trial data counts as a cross-border transfer whenever personal data is transmitted to, or remotely accessed from, a country outside the EEA that has no equivalent EU adequacy arrangement. This applies even to coded or pseudonymised participant data, since pseudonymised data remains personal data under GDPR. Common scenarios include a non-EEA sponsor receiving data from EEA sites, a CRO coordinating a multi-country study, a central laboratory or cloud vendor hosted abroad, and safety reporting into global pharmacovigilance systems. Each of these "legs" requires its own analysis, as Articles 44 to 49 apply leg by leg, not once per trial.
Yes. A single multinational clinical trial can trigger EEA, UK, and Swiss transfer rules simultaneously, and each jurisdiction has its own transfer tools and documentation requirements. For the UK, transfers out of the UK are governed by the UK GDPR and are typically covered by the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs. For Switzerland, the revised Federal Act on Data Protection (revFADP) applies, and the FDPIC recognises EU SCCs subject to Swiss-specific adaptations. Neither the UK nor the Swiss position should be assumed to mirror the EEA analysis, as their adequacy lists and requirements do not always align. Each layer must be confirmed separately.
A transfer impact assessment (TIA) is a case-by-case evaluation that the data exporter must perform to determine whether the law and practice of the destination country undermine the effectiveness of the chosen transfer tool. Following the Schrems II judgment, the EDPB Recommendations 01/2020 set out six steps: know your transfers, verify the transfer tool, assess the law and practice of the third country, identify and adopt supplementary measures, take any required formal procedural steps, and re-evaluate at intervals. The DPO's role is to advise the controller through each step, confirm who is responsible for running the assessment, and ensure that the sub-processor chain and supporting evidence are properly documented.
The sponsor, acting as controller, is ultimately accountable for the lawfulness of each transfer. The CRO typically acts as a processor and is responsible for implementing the transfer tool and flowing obligations down to sub-processors. Investigator sites may be separate or joint controllers and must confirm their own export legs and local-law constraints. Technology vendors act as processors or sub-processors and are required to sign the relevant clauses and apply appropriate technical and organisational measures. The DPO advises and monitors across all parties but does not bear accountability for the controller's decisions.
Under GDPR Article 39, the DPO holds an advisory and monitoring mandate — not a decision-making one. The sponsor, as controller, decides and owns the choice of transfer mechanism. The DPO's role involves four key steps: (1) mapping every point where participant data leaves or is accessible from outside the EEA; (2) verifying the legal basis for each transfer leg; (3) advising the controller through transfer impact assessments and the selection of supplementary measures where no adequacy finding exists; and (4) continuously monitoring the sub-processor chain, documenting oversight, and re-evaluating transfers when the law or destination changes.
When no adequacy decision covers the destination country, standard contractual clauses (SCCs) under Decision (EU) 2021/914 are the most common tool. Their modular structure fits the typical sponsor, CRO, and sub-processor chain in clinical trials. Where intra-group transfers are involved, binding corporate rules (BCRs) may apply for large sponsors with global affiliates. Article 49 derogations are available only in narrow, specific situations and are not a routine basis for bulk trial data transfers. Regardless of the tool chosen, a transfer impact assessment must also be conducted, as SCCs cannot bind third-country public authorities.
A cross-border data transfer occurs whenever participant data is transmitted to, or remotely accessed from, a country outside the EEA that has no equivalent EU adequacy arrangement. This includes coded or pseudonymised data, since pseudonymised data remains personal data under the GDPR. Common examples in clinical trials include a non-EEA sponsor receiving data from EEA sites, a CRO coordinating a multi-country study, a central laboratory or cloud vendor hosted abroad, and safety reporting into global pharmacovigilance systems. Each of these "legs" requires its own analysis under GDPR Articles 44 to 49.
Find out how iliomad can help your company.
Only visible in production
Weekly Privacy and Life Sciences Digest: Ransomware Surge, Biometric Guidance and AI Governance Developments (10 November 2026)
This week's digest covers the Vortex ransomware group targeting healthcare, AEPD biometric guidance, Saudi PDPL amendments, ICO special category updates and AI funding rounds.
CRO data processor: GDPR obligations, contracts and accountability in clinical trials
Understand how a CRO acts as a data processor under GDPR in clinical trials: key obligations, DPA requirements, liability and practical compliance steps.
Investigator Site Agreement GDPR: Managing EU Privacy Requirements at NIH and US Federal Sites
Learn how to handle GDPR obligations at NIH and US federal clinical trial sites, including ICF language, Data Privacy Notices and OHSRP clearance requirements.
