Summary
A voluntary enrollment pause in clinical trials necessitates urgent updates to data protection obligations, including modifications to GDPR compliance, informed consent documentation, and risk assessments. Sponsors must ensure accurate processing records and conduct comprehensive Data Protection Impact Assessments to reflect changes in study protocols and participant risks.
What does a voluntary enrollment pause mean for participant data protection?
A voluntary enrollment pause triggers a cascade of data protection obligations because the legal basis for processing, the scope of data collected and the risk profile of the study all change simultaneously. Sponsors must treat the pause as a data-governance event from the moment it is declared.
The GDPR (Regulation (EU) 2016/679) establishes that personal data must be processed lawfully, fairly and transparently, and that the purpose of processing must remain specified and explicit (Article 5(1)(a) and (b)). When the protocol of a phase 3 trial is amended to adjust dosing, restrict enrollment or modify monitoring procedures, the original purpose statement and legal basis documented in the trial master file (TMF) may no longer accurately reflect what is occurring. Sponsors are therefore required to update their Records of Processing Activities (RoPA) under Article 30 GDPR promptly and before amended procedures take effect at clinical sites.
Beyond record-keeping, the enrollment pause changes the risk profile of the study in a manner that may require a revised or supplementary Data Protection Impact Assessment (DPIA). Article 35 GDPR mandates a DPIA for large-scale processing of health data. Where the original DPIA assessed risk on the basis of a specific dosing regimen and a defined cohort size, a material deviation from either parameter constitutes a change in the nature of processing that warrants reassessment under Article 35(11) GDPR, which requires sponsors to review a DPIA when the processing is likely to result in a high risk.
How must informed consent documentation be updated after an enrollment pause?
Informed consent documentation must be updated whenever the risk profile of a trial changes materially. An enrollment pause triggered by adverse events is precisely such a change, and existing participants must be re-consented if the amended protocol alters the procedures to which they originally agreed.
The Informed Consent Form (ICF) serves a dual purpose in clinical research: it is an ethical instrument under ICH E6(R3) Good Clinical Practice (GCP), the international standard governing the design, conduct and reporting of clinical trials to ensure data credibility and participant protection, and it is simultaneously the primary transparency mechanism required by Article 13 GDPR. When a sponsor adjusts dosing or introduces additional safety monitoring, both the clinical and the data protection sections of the ICF require amendment.
The data protection section of the ICF must, at minimum, disclose the updated categories of data collected, any new recipients of safety data (such as an independent Data Safety Monitoring Board convened in response to the pause), the retention period for data generated under the revised protocol, and participant rights under Articles 15 to 22 GDPR. Where the amendment also affects pharmacovigilance reporting, the ICF must make clear that certain safety data are processed on the basis of a legal obligation under Article 6(1)(c) GDPR and that the right to erasure under Article 17 GDPR does not apply to that processing stream.
Focus: The example of France (CNIL and MR-001)
In France, interventional clinical trials are governed by the Méthodologie de Référence MR-001, a standardised methodology issued by the Commission Nationale de l'Informatique et des Libertés (CNIL), the French supervisory authority, which permits sponsors to process health data for research purposes without individual CNIL authorisation provided all MR-001 conditions are met. An enrollment pause that results in a protocol amendment may require the sponsor to re-examine whether the study still qualifies under MR-001 or whether a specific authorisation from CNIL is now required. Any amendment to the ICF must also be re-submitted to the ethics committee (Comité de Protection des Personnes, CPP) before the amended form is used at French sites.
Focus: The example of the United Kingdom (ICO)
In the United Kingdom, the UK GDPR and the Data Protection Act 2018 impose obligations equivalent to EU GDPR for sponsors operating at UK clinical sites. The Information Commissioner's Office (ICO) expects sponsors to maintain a lawful basis for processing that accurately reflects the processing as it actually occurs. A protocol amendment that changes the nature or scope of data collection should be reflected in an updated privacy notice and, where applicable, a revised DPIA submitted through the sponsor's internal governance process. The ICO's guidance on research confirms that the research exemptions under Schedule 2, Part 6 of the Data Protection Act 2018 do not remove the obligation to keep participants informed of material changes.
Focus: The example of Germany (Landesbehörden)
Germany's federal structure means that data protection oversight for clinical trials is exercised at the Länder level, with each state data protection authority (Landesbeauftragte für den Datenschutz) holding jurisdiction over sites within its territory. German law additionally requires compliance with the Arzneimittelgesetz (AMG), the German Medicinal Products Act, which cross-references GCP obligations. A protocol amendment following an adverse-event-driven pause must be notified to the relevant ethics committee (Ethikkommission) and, depending on the amendment's scope, to the Bundesinstitut für Arzneimittel und Medizinprodukte (BfArM). Sponsors operating across multiple German Länder should ensure that site-level data protection representatives are informed of the amended processing activities in a timely manner.
Expedited safety reporting and pharmacovigilance data flows
Expedited safety reporting obligations run in parallel with data protection obligations and are not diminished by an enrollment pause. Sponsors must continue to report Suspected Unexpected Serious Adverse Reactions (SUSARs) to the European Medicines Agency (EMA) through the Clinical Trials Information System (CTIS) established under EU Clinical Trials Regulation 536/2014 (EU CTR), the primary EU legislative instrument governing the authorisation, conduct and supervision of clinical trials.
Article 42 EU CTR requires sponsors to report SUSARs electronically to all member states in which the trial is being conducted. The processing of SUSAR data involves the transfer of participant health data to regulatory authorities, which must be documented in the RoPA and disclosed to participants in the ICF. Where SUSAR reporting requires transferring data to regulators outside the European Economic Area, such as the United States Food and Drug Administration (FDA), the sponsor must ensure that an appropriate transfer mechanism under Chapter V GDPR is in place, whether through adequacy decisions, Standard Contractual Clauses (SCCs) or another listed derogation under Article 46 GDPR.
The table below summarises the key obligations that arise in parallel during an enrollment pause and distinguishes their regulatory basis.
What obligations apply to existing participants who remain enrolled?
Existing participants who continue treatment after an enrollment pause retain all data subject rights under GDPR, and the sponsor's obligations to those individuals intensify rather than diminish. Sponsors must ensure that ongoing monitoring activities, amended safety assessments and any new data collection introduced as a result of the pause are covered by a valid legal basis and disclosed transparently.
Article 9(2)(j) GDPR permits the processing of special category health data for scientific research purposes subject to suitable and specific measures under Article 89 GDPR. Those measures, which typically include pseudonymisation, access controls, data minimisation protocols and confidentiality agreements with site staff, must remain fit for purpose under the amended protocol. Where dosing adjustments or additional neurological monitoring introduce new categories of data, sponsors must assess whether existing measures adequately protect that data or whether supplementary safeguards are required.
Sponsors should also review the clinical site agreements and data processing agreements in place with investigator sites and Contract Research Organisations (CROs). A CRO is a company engaged by a sponsor to perform one or more trial-related duties or functions on the sponsor's behalf, acting as a data processor under Article 28 GDPR. Any change to the processing activities performed by a CRO, including expanded safety monitoring or additional data collection, must be reflected in an updated data processing agreement as required by Article 28(3) GDPR.
Focus: The example of Ireland (Data Protection Commission)
Ireland is home to the European headquarters of several global pharmaceutical sponsors, making the Data Protection Commission (DPC) a significant supervisory authority for clinical trial data governance. The DPC has published guidance on health research that requires sponsors to document the basis on which research is conducted under the Health Research Regulations 2018 (S.I. No. 314 of 2018). Where an enrollment pause prompts a material protocol change, sponsors should assess whether the amended study still falls within the scope of the consent originally obtained under those regulations or whether additional explicit consent from participants is required.
Focus: The example of Spain (AEPD)
The Agencia Española de Protección de Datos (AEPD) has issued guidance aligning Spanish clinical trial data protection practice with both EU CTR 536/2014 and GDPR. Spanish law additionally requires that modifications to clinical trial protocols receive approval from the Agencia Española de Medicamentos y Productos Sanitarios (AEMPS) and the relevant ethics committee before amended data collection begins at Spanish sites. Sponsors with sites in Spain should ensure that amended ICFs are approved by the Comité de Ética de la Investigación con medicamentos (CEIm) before re-consenting participants.
A practical compliance framework for enrollment pauses
Sponsors benefit from a pre-defined response protocol that activates automatically when enrollment is paused, rather than assembling obligations reactively. The following sequence reflects best practice across EU and UK jurisdictions.
- Convene a cross-functional team within 24 hours of the enrollment pause decision, comprising the Chief Medical Officer, the Data Protection Officer (DPO) and the regulatory affairs lead.
- Issue a hold notice to all clinical sites within the same 24-hour window, specifying that no new data collection beyond existing participant safety monitoring may proceed until the amended protocol is in place.
- Initiate a gap analysis of the existing DPIA against the amended protocol, with a written output submitted to the DPO within five business days.
- Draft amended ICF data protection sections for each jurisdiction, taking into account local ethics committee requirements and supervisory authority guidance.
- Prepare updated RoPA entries for each processing activity affected by the pause, including safety reporting data flows to national regulators and the EMA via CTIS.
- Ensure that cross-border transfer mechanisms for SUSAR data to non-EEA regulators remain valid, and obtain updated SCCs or rely on documented Article 49 derogations where necessary.
- Appoint or confirm local data protection representatives in jurisdictions where the sponsor lacks an EEA or UK establishment, in compliance with Article 27 GDPR and its UK equivalent under section 27 of the Data Protection Act 2018.
Iliomad specialises in data protection compliance for clinical trials across EU and UK jurisdictions, including DPIA reviews, ICF data protection sections, DPO services and cross-border transfer strategies. If your organisation is navigating an enrollment pause or protocol amendment, contact the iliomad clinical trials team to discuss how we can support you.
FAQs
Our frequently questions
Sponsors should have a pre-defined response protocol that activates automatically when an enrollment pause is declared. Best practice across EU and UK jurisdictions includes the following steps: (1) Convene a cross-functional team — including the CMO, DPO, and regulatory affairs lead — within 24 hours. (2) Issue a hold notice to all clinical sites within the same window, restricting new data collection to existing participant safety monitoring. (3) Initiate a DPIA gap analysis against the amended protocol, with a written output delivered to the DPO within five business days. (4) Draft amended ICF data protection sections for each jurisdiction, accounting for local ethics committee requirements. (5) Update RoPA entries for all affected processing activities, including safety data flows to national regulators and the EMA via CTIS. (6) Confirm that cross-border transfer mechanisms for SUSAR data to non-EEA regulators remain valid, updating SCCs or documenting Article 49 derogations as needed. (7) Appoint or confirm local data protection representatives in jurisdictions where the sponsor lacks an EEA or UK establishment, per Article 27 GDPR and section 27 of the UK Data Protection Act 2018.
National frameworks add jurisdiction-specific layers to the baseline EU GDPR obligations. In France, sponsors must verify that their study still qualifies under the CNIL's standardised methodology MR-001, or seek specific CNIL authorisation. In the UK, the ICO expects updated privacy notices and revised DPIAs to reflect any changes in the nature or scope of data collection. In Germany, the federal structure means data protection oversight is exercised at the Länder level, requiring notifications to the relevant Ethikkommission and potentially to the BfArM, with site-level data protection representatives kept informed. In Spain, protocol modifications must receive approval from the AEMPS and the relevant CEIm before amended data collection begins. Sponsors operating across multiple jurisdictions should map these requirements proactively as part of their response protocol.
Existing participants who continue treatment after an enrollment pause retain all data subject rights under GDPR, and sponsor obligations intensify. All ongoing monitoring, amended safety assessments, and any new data collection must be supported by a valid legal basis and disclosed transparently. Article 9(2)(j) GDPR permits processing of special category health data for scientific research, subject to suitable safeguards under Article 89 GDPR — such as pseudonymisation, access controls, data minimisation, and confidentiality agreements. Sponsors must also review and, where necessary, update data processing agreements with investigator sites and Contract Research Organisations (CROs) to reflect any expanded or amended processing activities, as required by Article 28(3) GDPR.
Yes. Expedited safety reporting obligations are not diminished by an enrollment pause. Sponsors must continue to report Suspected Unexpected Serious Adverse Reactions (SUSARs) to the European Medicines Agency (EMA) through the Clinical Trials Information System (CTIS), as required by Article 42 of EU Clinical Trials Regulation 536/2014. SUSAR data flows to regulatory authorities must be documented in the RoPA and disclosed to participants in the ICF. Where SUSAR reporting involves transferring data to regulators outside the EEA (e.g., the FDA), sponsors must ensure a valid transfer mechanism is in place under Chapter V GDPR, such as Standard Contractual Clauses (SCCs) or an adequacy decision.
Informed Consent Forms (ICFs) must be updated whenever the risk profile of a trial changes materially, as is the case when an enrollment pause is triggered by adverse events. The ICF serves both as an ethical instrument under ICH E6(R3) GCP and as the primary transparency mechanism under Article 13 GDPR. Amendments must cover: updated categories of data collected, any new recipients of safety data (e.g., an independent Data Safety Monitoring Board), revised data retention periods, and participant rights under Articles 15–22 GDPR. Where pharmacovigilance reporting is affected, the ICF must clarify that certain safety data are processed under a legal obligation (Article 6(1)(c) GDPR) and that the right to erasure under Article 17 GDPR does not apply to that processing stream. Jurisdiction-specific requirements also apply — for example, in France, amended ICFs must be re-submitted to the ethics committee (CPP), and in Spain, they must receive approval from the CEIm before re-consenting participants.
A voluntary enrollment pause is a data-governance event that triggers immediate obligations. The legal basis for processing, the scope of data collected, and the risk profile of the study all change simultaneously. Sponsors must update their Records of Processing Activities (RoPA) under Article 30 GDPR before amended procedures take effect at clinical sites. Additionally, a revised or supplementary Data Protection Impact Assessment (DPIA) may be required under Article 35 GDPR, as any material deviation in dosing regimen or cohort size constitutes a change in the nature of processing that warrants reassessment.
Sponsors benefit from a pre-defined response protocol that activates automatically when an enrollment pause is declared, rather than assembling obligations reactively. Best practice across EU and UK jurisdictions involves the following key steps: (1) Convene a cross-functional team — including the Chief Medical Officer, Data Protection Officer (DPO), and regulatory affairs lead — within 24 hours of the pause decision. (2) Issue a hold notice to all clinical sites within the same window, restricting new data collection to existing participant safety monitoring only. (3) Initiate a gap analysis of the current DPIA against the amended protocol, with a written output submitted to the DPO within five business days. (4) Draft jurisdiction-specific amendments to the ICF data protection sections, accounting for local ethics committee requirements. (5) Update RoPA entries for all affected processing activities, including safety reporting flows to national regulators and the EMA via CTIS. (6) Verify that cross-border transfer mechanisms for SUSAR data to non-EEA regulators remain valid. (7) Confirm that local data protection representatives are appointed in jurisdictions where the sponsor lacks an EEA or UK establishment, as required by Article 27 GDPR and section 27 of the Data Protection Act 2018.
Yes, while the GDPR provides a common baseline, significant national-level differences apply. In France, sponsors must verify whether the amended protocol still qualifies under CNIL's Méthodologie de Référence MR-001, or whether a specific CNIL authorisation is required; any amended ICF must also be re-approved by the ethics committee (CPP). In Germany, oversight is exercised at the Länder level, and a protocol amendment must be notified to the relevant Ethikkommission and potentially to BfArM. In Ireland, the Data Protection Commission (DPC) requires sponsors to assess whether the amended study still falls within the scope of consent obtained under the Health Research Regulations 2018. In Spain, amended ICFs must receive approval from the CEIm ethics committee and the AEMPS before re-consenting participants. In the UK, the ICO expects sponsors to update privacy notices and DPIAs to accurately reflect any changes in the nature or scope of data collection under UK GDPR and the Data Protection Act 2018.
Existing participants who continue treatment after an enrollment pause retain all data subject rights under GDPR, and sponsor obligations to those individuals intensify rather than diminish. Sponsors must ensure that ongoing monitoring activities, amended safety assessments, and any new data categories introduced by the revised protocol are covered by a valid legal basis and disclosed transparently. Article 9(2)(j) GDPR permits processing of special category health data for scientific research, subject to suitable safeguards under Article 89 GDPR — such as pseudonymisation, access controls, and data minimisation — which must remain fit for purpose under the amended protocol. Sponsors must also review and update data processing agreements with investigator sites and Contract Research Organisations (CROs) under Article 28(3) GDPR to reflect any expanded processing activities resulting from the pause.
Expedited safety reporting obligations are not paused alongside enrollment. Sponsors must continue to report Suspected Unexpected Serious Adverse Reactions (SUSARs) to the European Medicines Agency (EMA) through the Clinical Trials Information System (CTIS) under Article 42 of EU Clinical Trials Regulation 536/2014, within 7 or 15 days of becoming aware of a qualifying event. These reporting activities involve the transfer of participant health data to regulatory authorities, which must be documented in the RoPA and disclosed in the ICF. Where SUSAR data must be transferred to non-EEA regulators — such as the US FDA — sponsors must ensure that an appropriate transfer mechanism is in place under Chapter V GDPR, such as Standard Contractual Clauses (SCCs) or another listed derogation under Article 46 GDPR.
Informed consent documentation must be updated whenever the risk profile of a trial changes materially, and an enrollment pause triggered by adverse events qualifies as exactly such a change. Existing participants must be re-consented if the amended protocol alters the procedures to which they originally agreed. The Informed Consent Form (ICF) serves a dual purpose: it is an ethical instrument under ICH E6(R3) GCP and the primary transparency mechanism required by Article 13 GDPR. The data protection section of the ICF must be updated to disclose the new categories of data collected, any new recipients of safety data (such as a newly convened Data Safety Monitoring Board), revised retention periods, and participant rights under Articles 15 to 22 GDPR. It must also clarify that certain safety data processed for pharmacovigilance purposes are exempt from the right to erasure under Article 17 GDPR.
A voluntary enrollment pause occurs when a sponsor suspends the entry of new participants into a clinical trial, typically following adverse events. Under GDPR, this triggers immediate data protection obligations because the legal basis for processing, the scope of data collected, and the risk profile of the study all change simultaneously. Sponsors must treat the pause as a data-governance event — not merely a clinical one — from the moment it is declared. This means promptly updating Records of Processing Activities (RoPA) under Article 30 GDPR, reassessing the Data Protection Impact Assessment (DPIA) under Article 35 GDPR, and ensuring that all amended procedures are covered by a valid legal basis before they take effect at clinical sites.
Find out how iliomad can help your company.
Only visible in production
iliomad Weekly Digest: AI Governance Failures, UK Regulatory Reform and Healthcare Cybersecurity Surge
This week: ICO becomes the Information Commission, Medicare AI prior-auth failures, FDA pilots accelerate trials, and ransomware hits 3.5 million patient records.
Data transfer compliance in global clinical trials: a sponsor's guide
Understand data transfer compliance obligations for global clinical trials under GDPR, SCCs and local frameworks. A practical guide for sponsors from iliomad.
MR-001 CNIL: what clinical trial sponsors must know about French health data compliance
Understand MR-001 CNIL obligations for clinical trial sponsors in France, from Article 32 security requirements to breach notification and cross-border data transfers.
