Summary
This article addresses the conflict between GDPR obligations and NIH policies when enrolling participants in US federal clinical trials. It outlines the necessity of separate privacy documentation to comply with both US and EU regulations, detailing the role of the NIH's Data Privacy Notice in meeting GDPR requirements while adhering to US law.
When a European sponsor or a sponsor subject to the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) enrols participants at a United States National Institutes of Health (NIH) site, a structural conflict arises: the NIH, as a US federal agency, operates under a distinct legal framework that explicitly prohibits the inclusion of foreign privacy law references inside its Informed Consent Forms (ICFs). This article explains what that conflict looks like in practice, why it matters for site agreement strategy, and how sponsors can resolve it without delaying IRB approval.
What Does GDPR Require From Sponsors Running Trials at Non-EU Sites?
GDPR requires sponsors established in the EU, or sponsors that determine the purposes and means of processing personal data of EU-based individuals, to provide transparent privacy information under Articles 13 and 14 of the GDPR. That obligation does not disappear simply because a trial site is located outside the European Economic Area (EEA). Where a sponsor exports personal data from an EEA site to a US site, the transfer must be covered by an appropriate safeguard such as Standard Contractual Clauses (SCCs, adopted by European Commission Decision 2021/914), and the data subjects must receive information about that transfer.
The practical consequence is that many sponsors instinctively insert GDPR-mandated privacy language directly into the ICF template circulated to all sites globally, including US federal sites such as those operated by the NIH in Bethesda, Maryland. This approach, while administratively convenient, is incompatible with NIH policy.
Article 13 of the GDPR specifies the information that must be provided to data subjects at the point of data collection. Sponsors must provide the identity and contact details of the controller, the purposes and legal basis for processing, the data retention period, the existence of any international transfers and the safeguards applied, and the data subject's rights. These disclosures are mandatory regardless of where the site is physically located.
Why Must GDPR Language Be Removed From NIH Informed Consent Forms?
NIH IRBs require the removal of GDPR and other foreign privacy law references from ICFs because NIH is a US federal agency governed by the US Privacy Act of 1974 and operates under the Common Rule (45 CFR Part 46), not EU law. The NIH Office of Human Subjects Research Protections (OHSRP) has published explicit policy to this effect, available at the NIH IRB Office website (irbo.nih.gov).
The rationale is threefold. First, stating or implying that a US federal agency complies with foreign law creates a legally inaccurate representation. Second, NIH consents must include mandatory language specific to the US framework, notably the NIH Privacy Act Statement and the Certificate of Confidentiality notice under 42 U.S.C. 241(f). Third, HIPAA (the Health Insurance Portability and Accountability Act of 1996) authorisation language, sponsor injury language and GDPR language are all treated as external additions that do not belong in the NIH consent template.
In practice, an IRB review such as the feedback issued in October 2026 for a Phase III oncology study at NIH site 001835 would instruct the sponsor to strip all such language from both the main participant ICF and any sub-population ICFs (for example, a pregnant partner addendum). The IRB's position is not a discretionary preference but a reflection of standing OHSRP policy.
Focus: The NIH OHSRP Data Privacy Notice Process
The OHSRP provides a formal mechanism to address the legitimate GDPR disclosure needs of non-US sponsors without contaminating the NIH ICF. That mechanism is the Data Privacy Notice (DPN), a separate document developed collaboratively between the sponsor and OHSRP.
The DPN serves as the GDPR Article 13 and 14 disclosure vehicle for the sponsor's own processing activities. It contains the sponsor's controller identity, the Data Protection Officer (DPO) contact details required under GDPR Article 37, the legal basis for processing (commonly Article 6(1)(c) for legal obligation and Article 9(2)(j) for scientific research), information about international transfers and applicable safeguards, and the data retention schedule.
Critically, OHSRP policy states that development of a DPN can occur in parallel with IRB review and will not delay IRB approval. This means sponsors need not choose between complying with GDPR and obtaining timely site activation. The two processes run concurrently.
The DPN is provided to research participants separately from the ICF, typically at the same time as consent is sought, so that the participant receives a complete picture of all privacy interests: the NIH's obligations under US law (in the ICF) and the sponsor's obligations under EU law (in the DPN).
How Should the Investigator Site Agreement Address This Split-Document Approach?
The investigator site agreement (ISA), sometimes called the Clinical Trial Agreement (CTA) at site level, is the contractual instrument between the sponsor and the investigative site that governs the conduct of the trial, including data protection responsibilities. When the site is a US federal institution, the ISA must reflect the two-document architecture described above.
The table below summarises which privacy obligations belong in each document for an NIH site engagement.
<table><tr><th>Obligation</th><th>NIH Informed Consent Form (ICF)</th><th>Sponsor Data Privacy Notice (DPN)</th></tr><tr><td>NIH Privacy Act Statement</td><td>Required</td><td>Not applicable</td></tr><tr><td>Certificate of Confidentiality notice (42 U.S.C. 241(f))</td><td>Required</td><td>Not applicable</td></tr><tr><td>GDPR Article 13/14 controller identity</td><td>Not permitted</td><td>Required</td></tr><tr><td>DPO contact details (GDPR Article 37)</td><td>Not permitted</td><td>Required</td></tr><tr><td>International transfer safeguards (SCCs)</td><td>Not permitted</td><td>Required</td></tr><tr><td>Data retention period (GDPR Article 13(2)(a))</td><td>Not permitted</td><td>Required</td></tr><tr><td>HIPAA authorisation language</td><td>Not permitted in NIH ICF</td><td>Handled separately if applicable</td></tr></table>The ISA should include a clause that acknowledges the site's status as a US federal entity and confirms that GDPR compliance for sponsor-controlled processing will be discharged through the DPN rather than through the ICF. It should also specify the sponsor's obligation to submit the DPN to OHSRP for clearance and to make the cleared DPN available at the site before participant enrolment begins.
Furthermore, the ISA should address the data transfer mechanism. Because the NIH site will send identifiable or pseudonymised participant data to the sponsor (typically located in the EU or processing data on behalf of an EU controller), SCCs or another Article 46 GDPR transfer tool must be in place. The ISA is the appropriate vehicle to reference or annex those SCCs, confirming that the transfer is covered and that a Transfer Impact Assessment (TIA) has been conducted to assess US surveillance law risks, particularly in light of the Court of Justice of the European Union judgment in Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (C-311/18, known as Schrems II, 16 July 2020).
Focus: EU Data Protection Authority Expectations for US Federal Site Transfers
EU supervisory authorities, including the Commission Nationale de l'Informatique et des Libertés (CNIL) in France and the Information Commissioner's Office (ICO) in the United Kingdom, have confirmed in published guidance that the existence of a site outside the EEA does not exempt the EU-established sponsor from its controller obligations. The CNIL's reference methodology MR-001 (last updated January 2022) for processing health data in the context of research specifically addresses cross-border transfers and requires that transfer tools be documented in the sponsor's records of processing activities (ROPA) under GDPR Article 30.
Sponsors should therefore ensure that the DPN provided to NIH participants references the applicable SCC module (most commonly Module 1, controller to controller, where the NIH acts as an independent controller for its own research purposes, or Module 2, controller to processor, where the NIH processes data solely on the sponsor's behalf). The choice of module has a direct bearing on the allocation of obligations in the ISA.
Recommended Practice for Sponsors Engaging NIH and US Federal Sites
Sponsors subject to GDPR that plan to include NIH or other US federal sites in a multinational clinical trial should adopt the following approach from protocol design stage onwards.
First, identify any site that is a US federal entity at feasibility. Flag such sites to the data protection and regulatory teams before drafting the global ICF template so that a jurisdiction-specific ICF shell is created without GDPR, HIPAA or sponsor injury language.
Second, initiate the DPN drafting process early. Because OHSRP clearance can run in parallel with IRB review, there is no operational reason to delay. The DPN should be drafted by the sponsor's data protection team and reviewed against the requirements of GDPR Articles 13 and 14 before submission to OHSRP.
Third, ensure the ISA contains an explicit provision acknowledging the split-document model, confirming the DPN as the GDPR disclosure mechanism, and referencing the applicable data transfer tool. Where SCCs are used, annex the completed SCC modules to the ISA or to a separate Data Processing Agreement incorporated by reference.
Fourth, document all of the above in the Trial Master File (TMF). The TMF, as defined by the ICH E6(R3) Good Clinical Practice guideline (adopted by the EMA in 2023), must contain evidence of regulatory and ethics committee submissions, including the cleared DPN and the executed data transfer agreements.
Fifth, brief the site's principal investigator and research coordinator on the two-document architecture so that participants receive both documents consistently at the point of consent.
Following this practice avoids IRB requests for amendment, prevents delays to site activation, and ensures that the sponsor's GDPR obligations are met in a manner that is acceptable to both the EU supervisory authorities and the US federal institutional framework.
iliomad provides specialist data protection support for clinical trial sponsors, including ISA review, DPN drafting and GDPR transfer impact assessments for US and non-EEA sites. Contact our clinical trials data protection team to discuss your site agreement strategy.
FAQs
Our frequently questions
When an NIH site sends identifiable or pseudonymised participant data to an EU-based sponsor or an entity processing data on behalf of an EU controller, the transfer must be covered by an appropriate GDPR Article 46 safeguard — most commonly Standard Contractual Clauses (SCCs) under European Commission Decision 2021/914. The applicable SCC module depends on the NIH's role: Module 1 (controller to controller) applies when the NIH acts as an independent controller for its own research purposes, while Module 2 (controller to processor) applies when the NIH processes data solely on the sponsor's behalf. The Schrems II judgment (Court of Justice of the EU, C-311/18, 16 July 2020) requires sponsors to also conduct a Transfer Impact Assessment (TIA) to evaluate risks posed by US surveillance laws. The CNIL's reference methodology MR-001 further requires that transfer tools be documented in the sponsor's Records of Processing Activities (ROPA) under GDPR Article 30.
Sponsors subject to GDPR should adopt the following approach from the protocol design stage: (1) Identify US federal sites at feasibility and flag them to data protection and regulatory teams before drafting the global ICF template, ensuring a jurisdiction-specific ICF shell is created without GDPR, HIPAA, or sponsor injury language. (2) Initiate DPN drafting early, as OHSRP clearance can run in parallel with IRB review. (3) Ensure the ISA explicitly acknowledges the split-document model and references the applicable data transfer tool, annexing completed SCC modules where applicable. (4) Document everything in the Trial Master File (TMF) in accordance with ICH E6(R3) GCP guidelines, including the cleared DPN and executed data transfer agreements. (5) Brief the site's principal investigator and research coordinator on the two-document architecture to ensure consistent delivery to participants at the point of consent.
The ISA should reflect the two-document architecture required at NIH sites — the NIH ICF (covering US law obligations) and the sponsor's DPN (covering GDPR obligations). Specifically, the ISA should: (1) acknowledge the site's status as a US federal entity and confirm that GDPR compliance for sponsor-controlled processing will be discharged through the DPN rather than the ICF; (2) specify the sponsor's obligation to submit the DPN to OHSRP for clearance and to make the cleared DPN available before enrolment begins; (3) reference or annex the applicable data transfer mechanism, such as SCCs, confirming that a Transfer Impact Assessment (TIA) has been conducted to assess US surveillance law risks in light of the Schrems II ruling (C-311/18). The correct SCC module — Module 1 (controller to controller) or Module 2 (controller to processor) — should be selected based on the NIH's role in the study.
No. GDPR obligations do not disappear simply because a trial site is located outside the European Economic Area (EEA). Sponsors established in the EU, or those that determine the purposes and means of processing personal data of EU-based individuals, must still provide transparent privacy information under GDPR Articles 13 and 14. Where personal data is exported from an EEA site to a US site, the transfer must be covered by an appropriate safeguard — such as Standard Contractual Clauses (SCCs) adopted under European Commission Decision 2021/914 — and data subjects must be informed of that transfer. EU supervisory authorities, including the CNIL and the ICO, have confirmed that the existence of a non-EEA site does not exempt an EU-established sponsor from its controller obligations.
A Data Privacy Notice (DPN) is a separate document developed collaboratively between the sponsor and OHSRP that serves as the GDPR Articles 13 and 14 disclosure vehicle for the sponsor's own processing activities. It contains the sponsor's controller identity, Data Protection Officer (DPO) contact details, the legal basis for processing, information about international data transfers and applicable safeguards, and the data retention schedule. The DPN is provided to research participants separately from the ICF — typically at the same time consent is sought — so participants receive a full picture of their privacy rights under both US and EU law. Crucially, OHSRP policy allows DPN development to run in parallel with IRB review, meaning it will not delay site activation or IRB approval.
NIH is a US federal agency governed by the US Privacy Act of 1974 and the Common Rule (45 CFR Part 46), not EU law. The NIH Office of Human Subjects Research Protections (OHSRP) has an explicit policy requiring the removal of GDPR and other foreign privacy law references from ICFs. Including such language would create a legally inaccurate representation that a US federal agency complies with foreign law. Additionally, NIH consents must include mandatory US-specific language, such as the NIH Privacy Act Statement and the Certificate of Confidentiality notice under 42 U.S.C. 241(f), which are incompatible with GDPR disclosures in the same document.
Sponsors subject to GDPR should follow five key steps: (1) Identify US federal sites at feasibility stage and create a jurisdiction-specific ICF shell without GDPR, HIPAA or sponsor injury language. (2) Initiate DPN drafting early, as OHSRP clearance runs in parallel with IRB review causing no operational delay. (3) Ensure the ISA includes an explicit provision confirming the split-document model, naming the DPN as the GDPR disclosure mechanism, and referencing the applicable data transfer tool with completed SCC modules annexed. (4) Document everything — including the cleared DPN and executed transfer agreements — in the Trial Master File (TMF) per ICH E6(R3). (5) Brief the principal investigator and research coordinator so participants consistently receive both documents at the point of consent.
The choice of SCC module depends on the roles of the parties. Module 1 (controller to controller) applies where the NIH acts as an independent controller for its own research purposes. Module 2 (controller to processor) applies where the NIH processes data solely on the sponsor's behalf. The choice of module directly affects the allocation of obligations in the ISA. Sponsors should also ensure the applicable SCC module is documented in their Records of Processing Activities (ROPA) under GDPR Article 30, as required by EU supervisory authorities such as the CNIL and the ICO.
The ISA should explicitly acknowledge the site's status as a US federal entity and confirm that GDPR compliance for sponsor-controlled processing will be discharged through the Data Privacy Notice (DPN) rather than the ICF. It should specify the sponsor's obligation to submit the DPN to OHSRP for clearance and to make the cleared DPN available at the site before enrolment begins. The ISA should also reference or annex the applicable data transfer mechanism — such as Standard Contractual Clauses (SCCs) — and confirm that a Transfer Impact Assessment (TIA) has been conducted, particularly in light of the Schrems II ruling (C-311/18).
The OHSRP Data Privacy Notice (DPN) is a separate document, developed collaboratively between the sponsor and OHSRP, that serves as the GDPR Articles 13 and 14 disclosure vehicle for the sponsor's own processing activities. It contains the sponsor's controller identity, Data Protection Officer (DPO) contact details, the legal basis for processing, information about international transfers and applicable safeguards, and the data retention schedule. Crucially, DPN development can run in parallel with IRB review and will not delay IRB approval. The DPN is provided to participants separately from the ICF at the point of consent, ensuring they receive complete privacy information under both US and EU law.
NIH IRBs require the removal of GDPR and other foreign privacy law references from ICFs because NIH is a US federal agency governed by the US Privacy Act of 1974 and the Common Rule (45 CFR Part 46), not EU law. Including GDPR language would create a legally inaccurate representation that a US federal agency complies with foreign law. Additionally, NIH consents must include mandatory US-specific language such as the NIH Privacy Act Statement and the Certificate of Confidentiality notice under 42 U.S.C. 241(f). This is a standing OHSRP policy, not a discretionary preference.
GDPR requires sponsors established in the EU, or those determining the purposes and means of processing personal data of EU-based individuals, to provide transparent privacy information under Articles 13 and 14 — regardless of where the trial site is located. When personal data is exported from an EEA site to a US site such as an NIH facility, the transfer must be covered by an appropriate safeguard such as Standard Contractual Clauses (SCCs), and data subjects must receive information about that transfer, including the controller's identity, legal basis for processing, data retention period, and their rights.
Find out how iliomad can help your company.
Only visible in production
Weekly Health and AI Privacy Digest: Cyber Incidents, GDPR Enforcement and Regulatory Shifts (Week of 27 October 2026)
This week: hospital cyber breaches, noyb GDPR complaints against Scale AI, CNIL fines Fnac Darty, FDA approvals, WHO AI roadmap and more. Digest by iliomad.
Healthcare AI Agents, Vendor Breaches and GDPR Reforms: Weekly Privacy and Regulation Digest
This week's digest covers autonomous AI agent risks, a wave of US healthcare vendor breaches, the EU Digital Omnibus GDPR mandate and Swiss voice-biometric enforcement.
Clinical study protocol data protection: a practical guide for sponsors
Learn how to embed GDPR-compliant data protection into your clinical study protocol. Practical guidance on Section 13, DPIAs, transfers and local formalities.
