This post is also available in: Español

From a data protection point of view, the use and limits of personal data processing in clinical trials is a major issue. For this reason, the European Commission’s Directorate-General for Health and Food Safety has published a Q&A document on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection Regulation (GDPR). These are our main conclusions:

Legal basis for processing health data: The Commission distinguishes between two processing purposes in the context of clinical trials, each with a different legal base: (i) processing for patient safety purposes (such as safety reporting, archiving and inspections), which is required by the CTR and can thus be covered by a legal obligation; and (ii) processing for scientific research purposes, for which the Commission does not provide a specific legal basis—leaving the decision to the promoters and researchers according to the characteristics of the clinical trial.

Consent: The Commission distinguishes consent for participation in a clinical trial

from consent for the processing of personal data within the context of that clinical trial. If participants withdraw their consent to the processing, the controller must stop the processing and delete the data if there is no other lawful basis such as security purposes.

Further use of research data: The Commission acknowledges that the requirements for further processing (basically, consent to use the data outside the scope of the trial protocol) do not apply when an alternative lawful basis can be invoked. In fact, the Commission stresses that the secondary use of clinical trial data is by default compatible with its original use—in line with the seventeenth additional provision of the Spanish Data Protection and Digital Rights Guarantee Act (Act 3/2018 of December 5, “new LOPD”).

The Commission addresses other relevant issues in the context of clinical trials, such as the specific processing requirements in emergency situations or the fact that GDPR’s restrictions also apply to international transfers of clinical trial data.

Autores: Sergi Gálvez y Jorge Monclús

This post is also available in: Español



72 artículos

Jorge Monclús


42 artículos

Asociado del Área de Propiedad Intelectual y Protección de Datos. Especialista en protección de datos y tecnologías disruptivas. Participa en el asesoramiento recurrente en materia de protección de datos y contratación tecnológica de compañías nacionales e internacionales, especialmente en la configuración jurídica de evaluaciones de impacto, transferencias internacionales de datos personales, contratos de encargo de tratamiento y en el asesoramiento durante violaciones de seguridad. Además de prestar asesoramiento continuado a clientes en los ámbitos mencionados, tiene experiencia en asesorar a empresas de diferentes sectores en la configuración legal de proyectos que implementan tecnologías disruptivas, tales como el Big Data, Internet of Things, artificial intelligence y smart robots.