Background
Celcuity is a clinical-stage biotechnology company focused on developing targeted therapies to treat cancer. Founded in 2012 and headquartered in Minneapolis, its teams of drug development scientists, biochemists, and molecular biologists work to address cellular abnormalities that drive tumour growth, with a particular focus on the PI3K/AKT/mTOR (PAM) pathway — a key biological driver across a range of tumour types.
Celcuity had experience in running clinical trials in the US and subsequently engaged The DPO Centre in 2022 ahead of launching its first EU and UK trials. As a sponsor with no European presence, they sought expert DPO support to navigate General Data Protection Regulation (GDPR) and local privacy obligations and were legally required to appoint a UK/EU Representative.
Key Challenges
- Implementing GDPR-specific measures
- Reviewing CTAs and ICFs
- Establishing EU/UK-based data protection governance
Solution
The DPO Centre acts as Celcuity’s EU/UK Representative under the GDPR, providing a direct line of communication with supervisory authorities and data subjects. This allows Celcuity to meet its statutory obligations without needing a physical presence in either region.
A designated Data Protection Officer (DPO) with clinical trial expertise was assigned to deliver strategic and operational support and guide compliance across 14 jurisdictions. This includes completing and maintaining a Record of Processing Activities (RoPA), conducting Data Protection Impact Assessments (DPIAs), implementing technical and organisational measures, and advising on DPO notifications and self-declarations, such as the CNIL MR-001.
To strengthen governance, the DPO introduced a regular cadence of fortnightly data protection meetings and quarterly Data Protection Committee sessions. These bring together cross-functional stakeholders to review key metrics, address emerging risks, and maintain accountability. The DPO manages all administrative elements, allowing Celcuity to maintain oversight without diverting internal resource.
The DPO also provides expert support in reviewing key trial documentation, including site-level Clinical Trial Agreements (CTAs), vendor Data Processing Agreements, and jurisdiction-specific Informed Consent Forms (ICFs). This includes guidance on selecting appropriate lawful bases, incorporating contractual requirements like Standard Contractual Clauses (SCCs), and ensuring all documents meet local regulatory standards, enabling Celcuity to navigate complex legal requirements with confidence as their trial portfolio and treatment pathways grow.
Outcome
Brent Eilefson, General Counsel and Chief Compliance Officer at Celcuity, said: ‘The DPO Centre exceeds expectations in all regards. Their team’s diligence with respect to data protection provides great comfort that we are complying with the complex nuances of data protection legislation in the EU and UK. They have been the data protection solution we’ve relied on since starting our UK- and EU-based clinical trials, with leadership and guidance that has been instrumental in our success to-date. What began as a DPO service has become a trusted business partnership as we continue to expand our clinical trials.’
