Data Protection vs Legal Representatives in EU and UK clinical trials

Data Protection Representatives (DPRs) and clinical trial Legal Representatives sound similar but they fulfil different legal requirements and have distinct responsibilities. Both roles may be required when a clinical trial sponsor is not established in the UK or EU. If you are planning trials across both jurisdictions, several separate appointments may be needed, alongside considering whether a Data Protection Officer (DPO) is also required.

This blog explains the difference between a DPR and clinical trial Legal Representative, when each is required, and what sponsors need to consider when planning clinical trials in the EU and UK.

See also our recent webinar EU & UK CLINICAL TRIALS: Are you clear on your data protection and legal representation requirements?

Key takeaway: Data Protection Representatives and Legal Representatives fulfil separate legal requirements and should not be treated as interchangeable. Depending on where your organisation is established and where your trial takes place, you may need both, so representation should be considered early in the trial planning processA series of actions or steps taken in order to achieve a particular end..

• What is a Data Protection Representative?
• What is a Legal Representative?
• Can the DPR and Legal Rep be the same person?
• What are the consequences of not appointing the right representative?
• Comparing privacy and legal roles in clinical trials
• Choosing the right Data Protection and Legal Representatives

What is a Data Protection Representative?

A Data Protection Representative (DPR) is appointed by an organisation that is subject to the EU or UK General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR) but is not established in the relevant jurisdiction. The DPR acts as a local point of contact for Supervisory Authorities, and data subjects on data protection matters.

Article 27 of the EU GDPR requires organisations outside the European Economic Area (EEA) to appoint a representative if they offer goods or services to individuals in the EEA or monitor their behaviour. The UK GDPRThe UK General Data Protection Regulation. Before leaving the EU, the UK transposed the GDPR into UK law through the Data Protection Act 2018. This became the UK GDPR on 1st January 2021 when the UK formally exited the EU. contains a comparable requirement for organisations outside the UK.

Clinical trials typically involve processing participants’ personal dataInformation which relates to an identified or identifiable natural person., including health information and other special category dataTypes of personal data listed in Article 9(1) GDPR that are considered sensitive and thus require extra protection. Article 9(1) lists data relating to: • racial or ethnic origin • political opinions • religious or philosophical beliefs • trade union membership • genetic data • biometric data • health • sex life • sexual orientation Where these types of personal..., which means sponsors operating from outside the jurisdiction are likely to need a DPR.

Whilst a DPR represents the sponsor on matters relating to its GDPR obligations, they do not manage the sponsor’s wider data protection compliance programme or replace its responsibilities as a controller.

Sponsors should also ensure that any DPR details are appropriately reflected within relevant clinical trial documentation, including Informed Consent Forms (ICFs) and Privacy Notices prior to trial submission.

It is important to remember that EU and UK representation requirements are separate. An EU DPR does not automatically fulfil the UK GDPR requirement, or vice versa. Sponsors conducting trials across both jurisdictions may therefore need separate EU and UK DPRs.

What is a clinical trials Legal Representative?

Under Article 74 of the EU Clinical Trials Regulation (CTR), sponsors that are not established in the EU must appoint an EU-based Legal Representative when conducting an interventional clinical trial, subject to the applicable requirements. Similar representation considerations also apply to relevant studies conducted under the Medical Device Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR).

Unlike a DPR, Legal Representative responsibilities go beyond providing a local address or administrative contact. Under the CTR, Legal Representatives provide regulatory oversight and expertise to support ongoing compliance, making them an important part of the sponsor’s regulatory framework.

Responsibilities can include advising the sponsor on:

• Obligations under the CTR
• Clinical trial application preparation requirements and other regulatory processes
• Inspection readiness requirements
• Regulatory reporting requirements and other obligations that arise during the study

A Legal Representative may also maintain appropriate oversight of activities throughout the trial, support communications with regulators, and help the sponsor respond appropriately to regulatory queries or concerns.

For sponsors conducting clinical trials in both the EU and UK, an EU-based Legal Representative can also fulfil the UK requirement. However, a UK-based Legal Representative cannot fulfil the EU requirement.

Can the DPR and Legal Rep be the same person?

No, the DPR and Legal Representative are separate legal roles with different responsibilities and should not be treated as interchangeable.

The DPR’s remit concerns the sponsor’s obligations under data protection legislation, whereas the Legal Representative has responsibilities relating to the regulatory conduct of the clinical trial. Combining the two roles could also create a conflict of interest.

This distinction does not mean sponsors need to build large internal teams in every jurisdiction in which they operate. Both functions can be outsourced to experienced specialist providers.

Working with providers that collaborate closely can give sponsors access to dedicated privacy and regulatory expertise whilst keeping the respective statutory roles separate. For organisations expanding into the EU or UK for the first time, this can also provide access to specialists who already understand the practical requirements of operating within those jurisdictions.

Sponsors should also distinguish both roles from that of the Data Protection Officer (DPO). A DPO advises and monitors the organisation’s wider data protection compliance, whereas a DPR represents an organisation in a jurisdiction in which it is not established.

Comparing privacy and legal roles in clinical trials

DPRs and Legal Representatives are not the only privacy and legal roles sponsors may encounter when conducting clinical trials.

The table below compares the key roles, including their purpose, responsibilities and who they represent. Understanding where each responsibility sits can help avoid gaps, duplication or confusion when planning your study.

Choosing the right Data Protection and Legal Representatives

Representation requirements are best considered well before you are ready to submit your clinical trial application.

Early preparation gives you time to identify exactly which appointments are required and incorporate them into study timelines and budgets.

When choosing representatives, consider:

• Relevant Life Sciences experience: Clinical trials involve sector-specific regulatory and data protection requirements. Your representatives should understand the environment in which sponsors, CROs, sites, and other vendors operate.
• Knowledge of local requirements: EU-wide legislation does not necessarily mean identical processes in every Member State. Country-specific requirements may also apply, making local regulatory knowledge important.
• Clear separation of responsibilities: Ensure the roles of your DPR, Legal Representative, and DPO are clearly defined and understood.
• Responsiveness: Both representatives can become important communication points when a regulator, Supervisory AuthorityAn authority established by its member state to supervise the compliance of data protection regulation., or individual needs to contact the sponsor.
• Ability to work collaboratively: Representatives should be able to work effectively with the sponsor, CROs, sites, vendors, and other stakeholders throughout the study.
• Ongoing support: Representation is not simply about having a name to include within an application. Choose partners with the expertise and resources to support you when regulatory or data protection issues arise.

Setting up local in-house teams to solely meet representation requirements can add unnecessary cost and complexity. Outsourcing these roles gives sponsors entering the EU or UK access to established local expertise without having to build that capability from scratch.

Planning a clinical trial in the EU or UK? The DPO Centre supports Life Sciences organisations with Data Protection Representative and DPO services, helping sponsors meet their privacy obligations across borders. Contact us to discuss how our specialist team can help you.

For organisations requiring specialist clinical trial Legal Representative support, DLRC Group provides regulatory expertise to help sponsors meet their EU and UK clinical trial requirements.

In case you missed it…

• CNIL MR:001: What clinical trial sponsors need to know
• Privacy compliance vs assurance in clinical trials: Why you need both
• Clinical trials and GDPR: 5 common misconceptions and how to overcome them