- Contact The DPO Centre
- +44 (0)203 797 1289
- hello@dpocentre.com
August 17, 2026
Clinical trials involving US sites can introduce a new layer of privacy compliance for international sponsors. Whilst the Health Insurance Portability and Accountability Act (HIPAA) is well known, its practical application is often misunderstood, particularly where responsibilities are shared between investigator sites, sponsors, Clinical Research Organisations (CROs), and technology providers.
June 8, 2026
CNIL MR-001 is the primary data protection framework interventional clinical trials in France where participants give informed consent. Organisations conducting these studies must either apply for direct authorisation from the French data protection authority, the Commission Nationale de l’Informatique et des Libertés (CNIL), or declare that they comply with an applicable Reference Methodology, such as MR-001. This framework has been in place since 2018, but the May 2026 update introduced further complexity to the methodology.
April 27, 2026
Data Protection Impact Assessments (DPIAs) help sponsors identify and address risks to participant data before a clinical trial begins. Under the UK and EU General Data Protection Regulation (GDPR), they are a mandatory requirement for high-risk personal data processing, which includes health information used in clinical research. Getting data protection right is not just a regulatory requirement but a critical part of running an effective and trustworthy trial.
March 30, 2026
Clinical research organisations are increasingly asked to demonstrate privacy assurance through recognised frameworks and certifications. For teams already navigating multiple regulatory requirements, this can quickly feel overwhelming.
Whilst compliance with laws such as the EU and UK General Data Protection Regulation (GDPR) or the US Health Insurance Portability and Accountability Act (HIPAA) remains essential, sponsors, partners, and regulators are now also looking for evidence that privacy and security controls operate effectively in practice.
March 2, 2026
In fast-moving clinical trial set-ups, General Data Protection Regulation (GDPR) governance and compliance can often seem like another layer of operational complexity. However, the challenge is rarely the regulation itself but uncertainty around how to interpret and apply it in practice. When expectations are not fully aligned across sponsors, CROs, and trial teams, this can increase risk and delay study timelines.
October 27, 2025
On 4 September, the Court of Justice of the European Union (CJEU) delivered an important judgement in European Data Protection Board (EDPS) vs Single Resolution Board (SRB), providing fresh clarification on the status of pseudonymised data under the EU General Data Protection Regulation (GDPR).
June 9, 2025
In Part 3 of our clinical trials blog series, we explore the key GDPR considerations sponsors should address when preparing and localising Informed Consent Forms (ICFs). […]
May 12, 2025
Data Processing Agreements (DPAs) are legally required under the EU and UK General Data Protection Regulation (GDPR) whenever clinical trial sponsors use third-party vendors to process […]
April 14, 2025
In this first part of our clinical trials blog series, we explore some of the key data protection considerations that sponsors need to cover in Clinical […]
September 16, 2024
Clinical trial sponsors often face challenges when it comes to selecting the right lawful basis for clinical trial data processing. Key questions include whether the choice […]