For sponsors established outside the European Union or the United Kingdom, the conclusion of a clinical trial often prompts a reassessment of data protection obligations. A common assumption is that GDPR compliance obligations fall away once the study has completed. In practice, the position is more nuanced.

The starting point is that the GDPR adopts a broad definition of “processing”. Processing includes not only the collection and active use of data, but also its storage, organisation, retrieval and deletion. As a result, the retention of clinical trial data in archive form continues to constitute processing for the purposes of GDPR.

This does not, however, mean that GDPR obligations remain unchanged following completion of a study. It is important to distinguish between regulatory requirements and data protection requirements. Clinical trial regulations often require sponsors to retain data for extended periods. Those requirements operate independently of GDPR. Regulatory retention obligations determine how long data must be kept; GDPR governs the conditions under which that data is processed during the retention period. There is no requirement under GDPR to maintain particular compliance structures, such as a DPO or an EU Representative, for the full duration of regulatory archiving, but national rules relating to clinical trials may do this.

The key question is whether the retained data continues to constitute personal data. Where data has been fully anonymised, such that individuals are no longer identifiable, GDPR no longer applies. In contrast, data that is pseudonymised (or coded) remains personal data for the purposes of GDPR, as re-identification remains possible. In the clinical trial context, data is often retained in pseudonymised rather than fully anonymised form.

The requirement to appoint a DPO is set out in Article 37 GDPR. This requirement arises where an organisation’s core activities involve large-scale processing of special category data, including health data. During the active phase of a clinical trial, this threshold is frequently met. However, once a study has been completed and data is retained solely for regulatory purposes, the nature of the processing may change. In particular, it may no longer be appropriate to characterise the processing as large-scale or as part of the organisation’s core activities. In those circumstances, the GDPR obligation to appoint a DPO may no longer apply; however national rules relating to clinical trials may impose additional requirements.

The position in relation to EU (and UK) Representatives is governed by Article 27 GDPR. This requirement applies where a non-EU/UK organisation processes personal data of individuals in the EU or the UK. It is not dependent on the lifecycle of a particular study. There is a limited exemption, but it is only available where all of the conditions in Article 27(2) are satisfied, namely that processing is occasional, does not involve large-scale special category data, and is unlikely to result in a risk to individuals. Importantly, this assessment is undertaken at the level of the organisation’s overall processing activities rather than by reference to a single trial.

In practice, even after a study has concluded, sponsors may continue to retain data in a structured and systematic manner. This may make it difficult to satisfy the Article 27(2) exemption. Accordingly, the requirement to maintain an EU or UK Representative may continue notwithstanding the completion of the trial.

The analysis therefore turns not on whether the trial has ended, but on the nature of any ongoing processing. Where retained data has been fully anonymised, GDPR will fall away. Where it remains personal data, GDPR obligations may continue, albeit often in a reduced form compared to the active trial phase.

For non-EU sponsors, the post-trial phase should be viewed as a transition point. A focused review of ongoing data holdings and processing activities will typically determine whether existing GDPR arrangements remain appropriate or can be adjusted to reflect the reduced scope of processing.

Key takeaways

• The end of a clinical trial does not, in itself, bring GDPR obligations to an end.
• The retention of data in archive form continues to constitute “processing” under GDPR.
• Regulatory requirements to retain clinical trial data are separate from GDPR obligations but may require that specific GDPR roles must be maintained.
• The critical question is whether retained data still constitutes personal data. Fully anonymised data falls outside GDPR; pseudonymised (coded) data does not.
• The requirement to appoint a Data Protection Officer depends on whether ongoing processing remains large-scale and part of the organisation’s core activities.
• The requirement to appoint an EU or UK Representative depends on whether the organisation continues to process personal data of EU or UK data subjects and whether the Article 27(2) exemption can be satisfied at organisational level.
• A post-trial review of ongoing processing activities is essential to determine whether existing GDPR arrangements remain appropriate.

If you are planning a clinical trial, either as sponsor or CRO, and would like to discuss how best to comply with your GDPR requirements, please contact us.