Summary
Spain's health data framework for clinical trials integrates GDPR and LOPDGDD, requiring compliance with additional conditions for health data processing. Sponsors must ensure they communicate subject data rights effectively, addressing specific regulatory requirements such as separate privacy notices and the handling of data rights requests.
Spain applies a layered regulatory framework to the processing of health data in clinical research. Sponsors, contract research organisations (CROs) and investigator sites operating in Spain must satisfy both the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (known by its Spanish initialism, LOPDGDD), as well as sector-specific guidance issued by the Agencia Española de Protección de Datos (AEPD), Spain's national supervisory authority under Article 51 GDPR.
A regulatory review conducted in Spain in September 2024 in the context of a genomic research project surfaced several compliance learnings that are broadly applicable to any sponsor running interventional or non-interventional studies with Spanish sites. This article translates those learnings into actionable guidance on subject data rights in clinical trials.
What legal basis applies to health data processing in Spanish clinical research?
Health data processed in clinical research in Spain requires a specific legal basis under Article 9(2) GDPR, most commonly either explicit consent (Article 9(2)(a)) or the scientific research exemption (Article 9(2)(j) read together with Article 89 GDPR). Spain has exercised the national margin permitted by Article 9(4) GDPR: the LOPDGDD, specifically Articles 9 and 12, imposes additional conditions on health data processing that go beyond the GDPR baseline. In practical terms, a sponsor cannot rely on the GDPR alone when operating in Spain.
The LOPDGDD requires that processing of health data for research purposes be proportionate to the aim pursued, that appropriate technical and organisational safeguards be implemented, and that a data protection officer (DPO) be designated where the processing is carried out on a large scale or involves systematic monitoring of data subjects. A DPO, as defined by Article 37 GDPR, is an independently appointed expert responsible for advising the controller on data protection obligations and acting as the contact point for the supervisory authority.
Sponsor organisations should map their Spanish study activities against both instruments before site initiation, because the AEPD has the authority to impose administrative fines of up to EUR 20 million or 4% of global annual turnover under Article 83(5) GDPR, and Spanish courts have confirmed that LOPDGDD breaches attract equivalent national sanctions.
How must subject data rights be communicated and fulfilled at Spanish clinical trial sites?
Subject data rights in clinical trials, which include the rights of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and objection (Article 21 GDPR), must be communicated to trial participants in plain, accessible language before enrolment. In Spain, the AEPD has published specific guidance confirming that information provided in the informed consent form (ICF) does not automatically satisfy the transparency obligations under Articles 13 and 14 GDPR: a separate, standalone privacy notice is required.
The regulatory review identified a recurrent tension between the right to erasure under Article 17 GDPR and the data retention obligations imposed by the EU Clinical Trials Regulation (EU CTR, Regulation (EU) No 536/2014), which requires sponsors to retain clinical trial documentation for a minimum of 25 years following trial completion. Spain's Royal Decree 1090/2015, which regulates clinical trials with medicinal products, mirrors this retention period domestically. The AEPD has confirmed that the research exemption under Article 17(3)(d) GDPR permits a sponsor to decline an erasure request where retention is necessary for scientific research purposes, provided that appropriate safeguards are in place and the refusal is communicated to the data subject within one month under Article 12(3) GDPR.
Sites must therefore have a documented procedure for receiving, logging and responding to data rights requests. Where a site acts as a data processor on behalf of the sponsor, the clinical site agreement (CSA) or investigator site agreement must clearly assign responsibility for routing data subject requests to the sponsor as data controller within a defined timeframe, so that the sponsor's one-month response clock starts immediately.
Focus: The Example of Spain and the AEPD Circular on Research Data
The AEPD has issued interpretive guidance on the application of research exemptions to health data processing, clarifying that the derogations available under Article 89 GDPR are not automatic. Sponsors wishing to rely on the research exemption must demonstrate, in a documented data protection impact assessment (DPIA, as required by Article 35 GDPR), that: (a) the processing cannot reasonably be fulfilled by processing data that does not identify data subjects; (b) pseudonymisation measures are applied to the maximum extent possible; and (c) re-identification controls are in place. The AEPD expects this assessment to be completed before the start of processing and to be kept under review throughout the trial lifecycle.
For genomic and biomarker studies in particular, the AEPD treats genetic data as a category that attracts heightened scrutiny because of its inherent identifiability and its potential to affect third parties such as relatives of the trial participant. Sponsors running precision medicine or genomic studies in Spain should therefore treat the DPIA not as a formality but as a substantive risk management tool.
How do the GDPR and LOPDGDD frameworks compare for clinical trial data rights?
The table below summarises the key differences and additions that the LOPDGDD introduces relative to the GDPR baseline for health research data processing in Spain.
<table><tr><th>Dimension</th><th>GDPR Baseline</th><th>LOPDGDD / Spanish Requirement</th></tr><tr><td>Legal basis for health data</td><td>Article 9(2)(a) or (j)</td><td>LOPDGDD Article 9 adds proportionality and necessity conditions</td></tr><tr><td>Transparency</td><td>Articles 13 and 14</td><td>Separate privacy notice required in addition to ICF</td></tr><tr><td>DPO obligation</td><td>Article 37 (large-scale or systematic)</td><td>Confirmed applicable to health research organisations by AEPD</td></tr><tr><td>Erasure requests</td><td>Article 17(3)(d) research exemption</td><td>Exemption permitted; refusal must be documented and communicated</td></tr><tr><td>DPIA</td><td>Article 35 (high risk)</td><td>AEPD expects DPIA for all genetic / genomic data processing</td></tr><tr><td>Retention period</td><td>No specific clinical trial period in GDPR</td><td>Royal Decree 1090/2015 mirrors EU CTR 25-year minimum</td></tr><tr><td>Supervisory authority</td><td>Member State authority under Article 51</td><td>AEPD; sub-national data protection authorities exist in some regions</td></tr></table>What are the recommended practices for sponsors operating in Spain?
Sponsors managing subject data rights in clinical trials in Spain should adopt the following practices, each grounded in the instruments identified above.
Conduct a Spain-specific DPIA. A generic DPIA prepared for a multi-country study is unlikely to satisfy the AEPD's expectations for studies involving genetic or health data. The DPIA must address the specific risks arising from the Spanish regulatory environment, including the LOPDGDD conditions and any regional authority requirements where applicable.
Prepare a standalone Spanish-language privacy notice. The notice must cover all information required by Articles 13 and 14 GDPR and specifically address how subject data rights can be exercised, the contact details of the DPO and the right to lodge a complaint with the AEPD. Embedding this information solely within the ICF is not considered sufficient by the AEPD.
Assign data rights responsibilities contractually. The investigator site agreement must specify, in clear terms, the procedure for forwarding data subject requests to the sponsor, the timeframe for doing so and the allocation of controller and processor responsibilities in accordance with Article 28 GDPR.
Document responses to erasure requests. Where a sponsor declines an erasure request on research exemption grounds, the refusal must be recorded, reasoned and communicated to the data subject within one month. The trial master file (TMF) should include a dedicated log of data subject requests and outcomes.
Appoint a DPO where required. For sponsors without an establishment in Spain who process health data of Spanish residents, consideration should be given to whether an EU data protection representative under Article 27 GDPR is required in addition to, or in lieu of, a DPO. These are distinct roles: the Article 27 representative acts as the point of contact for supervisory authorities and data subjects in the EU where the controller has no EU establishment.
How iliomad Can Support Your Spanish Clinical Trial Programme
Iliomad's clinical trials data protection practice assists sponsors, CROs and investigator sites in designing compliant data governance frameworks for studies conducted in Spain and across the European Union. Our services include DPIA preparation aligned with AEPD expectations, drafting of investigator site agreements with appropriate data protection clauses, and DPO and Article 27 representative services.
If your study involves health or genetic data processed at Spanish sites, contact iliomad to request a regulatory mapping review or to discuss how we can support your compliance programme from protocol design through to trial closeout.
FAQs
Our frequently questions
Sponsors operating in Spain should adopt the following key practices to ensure compliance with both GDPR and LOPDGDD requirements: (1) Conduct a Spain-specific DPIA before the start of processing, aligned with AEPD expectations; (2) Prepare a standalone Spanish-language privacy notice separate from the informed consent form; (3) Assign data subject rights responsibilities contractually in investigator site agreements, clearly defining routing and response timelines; (4) Document all responses to erasure requests, including any refusals based on the research exemption; and (5) Appoint a Data Protection Officer (DPO) where processing is carried out on a large scale or involves systematic monitoring of data subjects, as required by Article 37 GDPR and the LOPDGDD.
The AEPD clarifies that research exemptions under Article 89 GDPR are not automatic. Sponsors must complete a Data Protection Impact Assessment (DPIA), as required by Article 35 GDPR, before processing begins, demonstrating that: (a) the research cannot reasonably be fulfilled using non-identifying data; (b) pseudonymisation is applied to the maximum extent possible; and (c) re-identification controls are in place. The DPIA must be kept under review throughout the trial lifecycle. For genomic and biomarker studies, the AEPD applies heightened scrutiny due to the inherent identifiability of genetic data and its potential impact on third parties such as the participant's relatives.
Sites must have a documented procedure for receiving, logging, and responding to data subject rights requests. Where a site acts as a data processor on behalf of the sponsor, the Clinical Site Agreement (CSA) or Investigator Site Agreement must clearly assign responsibility for routing data rights requests to the sponsor as data controller. This must occur within a defined timeframe so that the sponsor's one-month response clock — as stipulated by Article 12(3) GDPR — begins immediately upon receipt of the request at site level.
Yes, under specific conditions. The EU Clinical Trials Regulation (No 536/2014) and Spain's Royal Decree 1090/2015 both require clinical trial documentation to be retained for a minimum of 25 years after trial completion. The AEPD has confirmed that the research exemption under Article 17(3)(d) GDPR allows sponsors to decline erasure requests where retention is necessary for scientific research purposes. However, appropriate safeguards must be in place, and the refusal must be communicated to the data subject within one month, as required by Article 12(3) GDPR. All such refusals must be formally documented.
No. The AEPD has confirmed that information provided in the informed consent form (ICF) does not automatically satisfy the transparency obligations under Articles 13 and 14 GDPR. A separate, standalone privacy notice — written in plain and accessible language — is required before participant enrolment. This notice must clearly communicate all applicable subject data rights, including access, rectification, erasure, restriction of processing, data portability, and objection, as defined under Articles 15–21 GDPR.
Health data in Spanish clinical research requires a specific legal basis under Article 9(2) GDPR — most commonly explicit consent (Article 9(2)(a)) or the scientific research exemption (Article 9(2)(j) with Article 89 GDPR). Importantly, Spain's LOPDGDD (Articles 9 and 12) imposes additional conditions beyond the GDPR baseline, meaning sponsors cannot rely on the GDPR alone. Requirements include proportionality of processing, appropriate technical and organisational safeguards, and DPO designation where processing is large-scale or involves systematic monitoring. Non-compliance can result in fines of up to EUR 20 million or 4% of global annual turnover.
These are two distinct roles. A Data Protection Officer (DPO), as defined by Article 37 GDPR, is an independently appointed expert who advises the controller on data protection obligations and liaises with supervisory authorities. An Article 27 GDPR representative, on the other hand, is required specifically for controllers or processors with no establishment in the EU who process personal data of EU residents. The representative serves as the point of contact for supervisory authorities and data subjects within the EU. Sponsors without a Spanish or EU establishment processing health data from Spanish trial participants should assess whether both roles are needed.
Responsibilities must be clearly assigned in the Clinical Site Agreement (CSA) or Investigator Site Agreement. Where a site acts as a data processor on behalf of the sponsor (the data controller), the agreement must specify the procedure for forwarding data subject requests to the sponsor, the timeframe for doing so, and the allocation of controller and processor responsibilities in line with Article 28 GDPR. This ensures the sponsor's one-month response window under Article 12(3) GDPR begins immediately upon receipt of any request.
While Article 35 GDPR mandates a DPIA for high-risk processing, the AEPD expects a DPIA for all genetic and genomic data processing in clinical trials, treating it as a formality-free risk management obligation. The DPIA must demonstrate that: (a) the research cannot reasonably be fulfilled using non-identifying data; (b) pseudonymisation is applied to the maximum extent possible; and (c) re-identification controls are in place. A generic multi-country DPIA is unlikely to satisfy the AEPD — a Spain-specific DPIA addressing LOPDGDD conditions is required and must be completed before processing begins and reviewed throughout the trial.
Yes, under certain conditions. The research exemption in Article 17(3)(d) GDPR allows a sponsor to decline an erasure request where retention is necessary for scientific research purposes. This aligns with the 25-year minimum retention period required by both the EU Clinical Trials Regulation (EU CTR No 536/2014) and Spain's Royal Decree 1090/2015. However, the refusal must be documented, clearly reasoned, and communicated to the data subject within one month, as required by Article 12(3) GDPR. A dedicated log of data subject requests and outcomes should be maintained in the trial master file (TMF).
Yes. The AEPD has confirmed that information included in the informed consent form (ICF) does not automatically satisfy the transparency obligations under Articles 13 and 14 GDPR. A separate, standalone privacy notice in plain and accessible language is required before enrolment. This notice must detail how subject data rights can be exercised, include the DPO's contact details, and inform participants of their right to lodge a complaint with the AEPD.
Health data in Spanish clinical research requires a specific legal basis under Article 9(2) GDPR — most commonly explicit consent (Article 9(2)(a)) or the scientific research exemption (Article 9(2)(j) with Article 89 GDPR). Importantly, Spain's LOPDGDD (Articles 9 and 12) adds conditions beyond the GDPR baseline, requiring that processing be proportionate, that appropriate technical and organisational safeguards be in place, and that a Data Protection Officer (DPO) be designated for large-scale or systematic processing. Sponsors cannot rely on the GDPR alone when operating in Spain.
Find out how iliomad can help your company.
Only visible in production
Weekly Privacy, AI and Clinical Trials Digest: Smart Glasses, GDPR Deadlock, Healthcare Cyber Threats and EU Biotech Act Upheaval
This week: EDPB targets smart glasses makers, EU Digital Omnibus stalls, CTIS faces 70% rebuild, healthcare cyberattacks surge and Italy enforces the EU AI Act.
Medical trials and AI: navigating the GDPR, EHDS and EU AI Act overlap
Legal uncertainty surrounds AI use in medical trials. Learn how GDPR, the EHDS and the EU AI Act interact and what sponsors must do to stay compliant.
AI passports and EHDS: what the CHAIN network means for health AI governance
The EU CHAIN network introduces AI Passports and federated health data models. Learn what this means for GDPR compliance, high-risk AI obligations and clinical sites.
