DPO for Clinical Trials | Sponsors and CROs

Clinical trial data sits under two regimes at once. The Clinical Trials Regulation governs how a trial is run, authorized, and archived; GDPR governs the personal data inside it. Sponsors and CROs get into trouble at the seam between them, usually over who is controller and what the lawful basis is.

The short answer: informed consent to take part in a trial is not the GDPR lawful basis for processing the data, the sponsor and the investigator site are usually controllers for different parts of the same trial, and the 25-year archiving obligation has to be documented as a legal obligation rather than treated as a GDPR problem. Getting those three right resolves most of what an inspection or a data subject request will raise.

Engage Compliance acts as the named DPO for clinical trial sponsors, CROs, and the technology companies that sit inside trials, notified to the supervisory authority, with the same senior person on the account throughout.

Key takeaways

Consent under the Clinical Trials Regulation and lawful basis under GDPR are two separate things, and conflating them is the field’s most common error.
Sponsor and site are typically independent controllers for different processing, with the CRO a processor only where it takes no purpose decisions.
Article 58 of the Clinical Trials Regulation requires the trial master file to be archived at least 25 years after the end of the trial.
A DPIA is required in practice for almost every trial, and it has to cover archiving and secondary use, not just the trial.
Non-EU sponsors need a legal representative in the Union under the Clinical Trials Regulation and, separately, a GDPR Article 27 representative.
Engage Compliance takes the sponsor-side DPO appointment, which means owning the controller allocation across sites and CROs rather than reviewing it once at setup.

What the two regimes each govern

Regulation (EU) No 536/2014, the Clinical Trials Regulation, governs authorization, conduct, safety reporting, transparency through the Clinical Trials Information System, and archiving. It is the operating rulebook for the trial.

Regulation (EU) 2016/679, GDPR, governs the personal data. It decides the lawful basis, the rights participants can exercise, the transfer position, and the accountability record.

They intersect but do not defer to each other. The Clinical Trials Regulation says at several points that it applies without prejudice to data protection law, which is a drafting instruction rather than a resolution, and the practical reconciliation was left to the European Data Protection Board’s Opinion 3/2019 on the interplay between the two.

Where sponsors go wrong is treating the trial’s regulatory documentation as if it discharged the data protection obligations. An approved protocol and an ethics opinion say nothing about whether the sponsor has a lawful basis, an Article 30 record, a transfer assessment, or a way to answer an access request.

Who is controller for what

This is the question that decides everything downstream, and it should be answered in writing before the first site is opened.

The sponsor determines why the trial exists, what is measured, what is collected, and what happens to the data afterwards. It is controller for that processing.

The investigator site, usually a hospital or clinic, holds the participant’s medical record and has its own clinical, professional, and regulatory duties that do not come from the sponsor. It is controller for those.

Between them the usual arrangement is independent controllers, each responsible for its own processing, rather than joint controllers under Article 26. Joint control arises where the two genuinely determine purposes and means together, which happens less often than contracts assume. Whichever it is, the position has to be recorded and reflected in the participant information.

The CRO is a processor where it acts strictly on documented instructions. A CRO that selects sites, designs the analysis, or decides on secondary use has taken a purpose decision and is a controller for that part, whatever the contract calls it.

Technology vendors in the trial stack, meaning electronic data capture, ePRO, decentralized trial platforms, wearables, and central labs, are processors under the sponsor or the site depending on who engaged them. Each needs an Article 28 agreement and a place in the record.

Getting this allocation onto paper is the first deliverable of most engagements, and it is usually the artifact that reveals a subprocessor nobody had mapped.

The lawful basis, done properly

Opinion 3/2019 separates trial processing into two groups, and the separation is the useful part.

Reliability and safety purposes, meaning the processing the Clinical Trials Regulation itself compels: safety reporting, inspection readiness, archiving, and disclosure to authorities. The lawful basis here is generally legal obligation under Article 6(1)(c), with the special category condition met by Article 9(2)(i), public interest in the area of public health.

Research purposes, meaning the trial’s own scientific work. The basis here is usually public interest under Article 6(1)(e) or legitimate interests under Article 6(1)(f), with the special category condition met by Article 9(2)(j), scientific research subject to Article 89(1) safeguards. Explicit consent under Article 9(2)(a) remains available, but only where consent is genuinely free, which is questionable where there is an imbalance between the participant and the institution.

The consequence people miss is on rights. If the basis is not consent, withdrawal from the trial does not automatically require erasure of the data already collected, and the participant information should say so rather than implying a right that does not exist. If the basis is consent, withdrawal does bite, and the sponsor has to be able to act on it without breaking the trial’s integrity obligations. Choosing the basis is therefore a design decision about the trial, not a form-filling exercise at the end.

What we do

Named DPO appointment for the sponsor or CRO, notified to the supervisory authority, with contact details in the participant information and the privacy notice.
Controller mapping. A written allocation across sponsor, sites, CRO, and vendors, with the Article 26 or independent-controller position recorded and the contracts checked against it.
Lawful basis analysis per processing purpose, split the way Opinion 3/2019 splits it, with the consequences for participant rights written out.
DPIA covering the trial, the archiving obligation, secondary use, and transfers. Our DPIA services run the same methodology across the rest of the estate.
Article 30 record for trial processing, including the vendor stack and the archive. Built through records of processing services where none exists.
Transfer work. Standard contractual clauses and transfer impact assessments for sites, labs, and platforms outside the EEA, which on a multi-region trial is most of them.
Participant rights handling, with the trial-specific answers on access, erasure, and objection prepared in advance rather than improvised inside the one-month clock.
Archiving position. Documenting the 25-year obligation as the retention basis and keeping the archived set segregated from live systems.
Breach response on the 72-hour clock, coordinated with the safety reporting that runs on its own timetable.
Inspection support, so the data protection documentation is producible when an authority asks alongside the regulatory file.

Sponsors and CROs building a wider health data program usually pair this with DPO for HealthTech, which covers product-side processing outside the trial.

How it works

Scoping. The trial or portfolio, the sites, the vendor stack, the regions, and what already exists. Sponsors with several trials at different stages are scoped as a program, because a per-trial approach duplicates the same analysis.

Appointment. Contract signed, DPO named, notification filed, contact details into the participant information for future trials and into the privacy notice now.

Groundwork. Controller mapping, lawful basis analysis, DPIA, and record, in that order, because each one depends on the previous.

Ongoing. New trials screened as they open, vendor changes assessed, rights requests and breaches handled, annual review of the archive position, standing report to management.

What it costs

Named DPO tiers, billed annually in euros:

DPO Foundation, From €1,000 per month. This fits a sponsor running one trial with no CRO and no transfers outside the EEA. Assessments are scoped as add-ons at this tier, so a trial that needs a DPIA and a transfer assessment carries those on top of the monthly figure.
DPO Partner, From €2,500 per month, which is where most sponsors with an active portfolio land. Assessments sit inside the standing scope at this tier rather than being quoted per trial, and a portfolio generates them continuously.
DPO Complete, From €4,500 per month, for multi-region programs with a large vendor stack.
Enterprise, tailored.

The tier for a trial sponsor is decided by the portfolio, not by headcount. A DPIA is required in practice for almost every trial, and a transfer assessment follows any CRO, laboratory, or eTMF vendor outside the EEA, so a sponsor with more than one trial open generates assessments continuously. The Article 58 archiving obligation runs at least 25 years past the end of the trial, and whoever holds the record has to still be there for it. Scoping is done against the trial portfolio and the archive position, and the comparison against an in-house hire is set out in the outsourced DPO cost guide.

Why Engage Compliance

Experience across 100+ startups and enterprises including Amazon, Coinbase, and Robinhood. You work with a senior DPO directly and it is the same person throughout, which matters on a trial that runs for years and archives for twenty-five.

We are a data protection practice, not a clinical regulatory consultancy, and we say which is which. Protocol design, ethics submissions, and safety reporting sit with your regulatory function or your CRO; the data protection layer sits with us, and the two are coordinated rather than merged. Every engagement carries professional indemnity and cyber insurance.

Sources and references

Regulation (EU) No 536/2014 on clinical trials, Articles 58 and 74, EUR-Lex
Opinion 3/2019 on the interplay between the Clinical Trials Regulation and the GDPR, European Data Protection Board

Same-business-day response
Professional indemnity and cyber insurance
Named DPO notified to the supervisory authority

Book a free intro call

FAQ

Frequently asked questions

Is a participant's consent to join a trial the GDPR lawful basis?

No, and treating it as one is the most common mistake in this field. Informed consent under the Clinical Trials Regulation is an ethical and regulatory safeguard for participation in research on a person. The GDPR lawful basis is a separate question answered under Articles 6 and 9. The European Data Protection Board addressed this directly in Opinion 3/2019: for reliability and safety purposes the basis is generally legal obligation under Article 6(1)(c) together with Article 9(2)(i), and for the research purposes themselves it is usually public interest or legitimate interests together with Article 9(2)(j), or explicit consent where that is genuinely free.

Who is the controller, the sponsor or the site?

It depends on the processing, and the honest answer for most trials is that both are, for different things. The sponsor determines the protocol, the endpoints, and what happens to the trial data, so it is controller for that. The investigator site is controller for the medical record and for its own regulatory and clinical obligations. The two are frequently independent controllers rather than joint controllers, and the arrangement has to be documented either way. A CRO acting strictly on the sponsor's documented instructions is a processor; a CRO that decides purposes for any part of the work is not.

Does a sponsor need a DPO?

Clinical trial data is health data, which is a special category under Article 9, and trial processing is normally large-scale by the standards the guidance applies. That puts most sponsors and CROs inside the Article 37(1)(c) trigger. Sponsors outside the EU that are caught by GDPR extraterritorially reach the same conclusion, and separately need an Article 27 representative.

How long do we have to keep trial data?

Article 58 of the Clinical Trials Regulation requires the sponsor and the investigator to archive the content of the clinical trial master file for at least 25 years after the end of the trial, unless other Union law requires longer. Participants' medical files are archived under national law instead. That retention period sits awkwardly against GDPR storage limitation, and the way to reconcile them is to record the legal obligation as the reason and to keep the archived set separate from anything still in active use.

Is a DPIA required for a clinical trial?

In almost every case, yes. Article 35(3)(b) triggers a DPIA for large-scale processing of special category data, and most national supervisory authority lists name health research explicitly. The assessment should cover the trial itself, the archiving obligation, any secondary use, and the transfer position, rather than being written for the trial and then quietly reused for the data warehouse.

Do we need an EU legal representative as well as a GDPR representative?

They are different appointments under different laws. Article 74 of the Clinical Trials Regulation requires a sponsor not established in the Union to have a legal representative in the Union, responsible for compliance with the sponsor's obligations and the addressee for communications, though member states may accept a contact person instead in defined cases. GDPR Article 27 separately requires a representative for data protection purposes. One appointment does not satisfy the other.

Can we reuse trial data for our own research afterwards?

Sometimes, and it has to be planned before the trial rather than argued afterwards. Article 5(1)(b) treats further processing for scientific research as compatible with the original purpose where Article 89(1) safeguards are in place, and the Clinical Trials Regulation contemplates consent to secondary use being sought at enrolment. Where the secondary use was never disclosed and no safeguards exist, the honest answer is usually no.