The European Commission Directorate General for Health has published a question and answer document that aims to explain the interplay between the Clinical Trials Regulation (EU) 536/2014 and the General Data Protection Regulation (EU) 2016/679. This document “will be relevant only when the clinical trials Regulation becomes applicable except for question 11 which explains the current situation under the Clinical Trials Directive.” It also “reflects the state of play after the consultation of the European Data Protection Board.”


Q1. What are the general obligations of the Clinical Trials Regulation with regard to personal data?

Q2. Who is responsible for determining the correct legal basis for personal data processing in the context of clinical trial?

Q3. What is the legal basis for processing of personal data of clinical trial subjects in the context of clinical trials (primary use) carried out in accordance with the Clinical Trial Regulation?

Q4. What is the difference between informed consent within the meaning of the clinical trial Regulation and consent within the meaning of the GDPR?

Q5. How to understand the requirements of the GDPR regarding information that should be given to subjects participating in a clinical trial?

Q6. What are the legal consequences of withdrawal of the consent for participation in the clinical trial under the Clinical Trial Regulation?

Q7. What is the meaning of Article 28(2) of the CTR and what are the implications for the use of personal data outside the protocol of the clinical trial (secondary use) within the scope of the GDPR?
Q8. Processing of personal data in the context of emergency clinical trials (Article 35 of the CTR)
Q9. Is a sponsor established in third country subject to EU data protection rules?

Q10. What rules apply to the data transfers outside the EU?

Q11. How should a sponsor proceed in the case of clinical trials authorised under the Clinical trials Directive?