Impact of GDPR on clinical trials

The sponsor (data controller) is obliged to inform study participants (data subjects) of GDPR privacy requirements. Data privacy information may be provided as part of the Informed Consent Form, letter to participants, data privacy addendum or in some other format.

Data privacy information should include contact information of the data controller (and the data protection officer), list of all the categories of sensitive personal data that will be collected, explanation of data privacy rights, description of data transfer process and safety measures taken, and retention period information.

During the consenting process the data controller should clearly explain all the rights, rules and risks in relation to the processing of personal data. Consent must be explicit, unambiguous, freely given, but also easy to withdraw. It must be specific to each procedure and used only for those purposes. Although oral consent is sufficient according to GDPR, it is best if the data subject gives a written consent.

GDPR also states that secondary processing of sensitive personal data may still proceed even without the consent of the data subject, but only if it is intended for medical and scientific research purposes that would otherwise be seriously impaired by the consent withdrawal.