In Part 3 of our clinical trials blog series, we explore the key GDPR considerations sponsors should address when preparing and localising Informed ConsentAn unambiguous, informed and freely given indication by an individual agreeing to their personal data being processed. Forms (ICFs). We explain the importance of early DPO involvement, and outline practical steps to help sponsors meet compliance obligations whilst avoiding common pitfalls. 

ICFs are a cornerstone of clinical trial documentation, serving as the primary way sponsors communicate with participants about the study and how their personal dataInformation which relates to an identified or identifiable natural person. will be used. Under both the UK GDPRThe UK General Data Protection Regulation. Before leaving the EU, the UK transposed the GDPR into UK law through the Data Protection Act 2018. This became the UK GDPR on 1st January 2021 when the UK formally exited the EU. and EU GDPRRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data (General Data Protection Regulation)., ICFs must include specific transparency information to ensure participants are fully informed and their data rights are protected. 

You’ll learn about: 

• Who should be involved in the ICF process?
• Why data protection needs early attention
• Transparency obligations under the GDPR
• Areas requiring closer scrutiny
• Managing international data transfers
• Why one ICF isn’t always enough

Missed Parts 1 and 2? Catch up here on Clinical Trial Agreements (CTAs) and Data Processing Agreements (DPAs)

With CTAs and DTAs covered, let’s now explore the GDPR requirements around ICFs.

Who should be involved in the ICF processA series of actions or steps taken in order to achieve a particular end.?

Drafting an Informed Consent Form (ICF) isn’t a one-person job. It requires close collaboration between multiple teams. These are the key roles and their responsibilities:

• Sponsor Clinical Operations lead the development and management of ICF templates across the trial 
• Contract Research Organisation (CRO) personnel, such as Clinical Trial Managers and country specialists, help tailor the language for local ethics committees and national requirements 
• Translators localise the ICF into the correct language(s), either in-house or through third-party providers 
• Legal teams may review ICFs alongside broader trial documentation 
• Data Protection Officers (DPOs) ensure the ICF complies with applicable data protection lawAny law, statute, declaration, decree, directive, legislative enactment, order, ordinance, regulation, rule or other binding restriction (as amended, consolidated or re-enacted from time to time) that relates to the protection of individuals with regards to the Processing of personal data. 

Given how many hands are involved, early and structured engagement is essential to avoid delays and reduce risk, especially across multi-jurisdictional trials. 

Why data protection needs early attention

With tight start-up timelines, it can be tempting to streamline the review process. But overlooking key data protection considerations at this stage can cause problems later on, especially if important data protection content is missing or inaccurate. 

Issues that can commonly arise without DPO oversight include: 

• Incomplete or incorrect transparency information 
• Unclear lawful bases, especially in trials operating across multi-jurisdictions 
• Insufficient detail on international transfers and appropriate safeguardsWhen transferring personal data to a third country, organisations must put in place appropriate safeguards to ensure the protection of personal data. Organisations should ensure that data subjects' rights will be respected and that the data subject has access to redress if they don't, and that the GDPR principles will be adhered to whilst the personal data is in the... 
• Processing activities linked to reimbursement or insurance that aren’t clearly explained 

These gaps can lead to non-compliance, ethics committee pushback, or the need for costly re-drafting. 

Transparency obligations under the GDPR

Under Article 13 of the GDPR, participants must be given clear and transparent information about how their data will be used.  

Therefore, ICFs must provide several key details, including but not limited to: 

• Sponsor Representative details
  If the sponsor is outside the EU or UK, the ICF must identify both the appointed GDPR Representative and their contact details. This is distinct from the Legal Representative required for regulatory purposes. Find out more about GDPR Representatives.
• DPO contact information
  This is ideally a dedicated DPO email address that doesn’t require updating with staff changes. e.g. dpo@company.com
• Lawful basis
  This can vary by jurisdiction. Read our blog: How to choose the right lawful basis for clinical trial data processing.
• Categories of recipients
  These could be listed as categories of recipients, such as ‘vendors, agents, or designees engaged by the sponsor to support the trial’ rather than individual recipient legal entities. You should also consider present and future recipients in a commercial context, including collaborators, affiliates, licensees, and successors. 
• International transfers
  The ICF must state whether personal data will be transferred outside the UK or EEA, the mechanism used, such as adequacy or Standard Contractual ClausesStandard Contractual Clauses are legal tools to provide adequate safeguards for data transfers from the EU or the European Economic Area to third countries. (SCCs), and, where relevant, how participants can request a copy of the safeguards in place. 

Areas requiring closer scrutiny

Some aspects of trial conduct raise heightened data protection concerns and must be addressed clearly in the ICF. These include: 

• Reimbursement
  If centrally managed, sponsors must consider whether directly identifiable data is transferred outside the UK or EEA, particularly in jurisdictions like France, where CNIL’s MR001 sets out clear conditions. 
• Insurance
  The ICF should ideally identify the specific insurer and clarify whether they act as an independent controller of the participant’s data. 
• Digital tools
  Apps, tablets, and other digital devices can collect more data than expected, such as device fingerprints and other technical usage data. Sponsors must consider how this risk is managed. 
• Home services
  If nurses or couriers visit participants at their home address, sponsors must outline how this identifiable data is processed and ensure they avoid receiving unnecessary personal information. 
• Future research
  If further studies are planned, the ICF should clarify whether it is intended that the same lawful basis applies or whether additional consent will be solicited at a later date. 

Managing international data transfers

In global trials, cross-border data transfers are a constant challenge due to potential jurisdictional differences and transparency obligations. Therefore, to ensure GDPR compliance, the ICF should clearly explain these important factors:

• Whether the destination country has an adequacy decisionA decision adopted by the European Commission on the basis of Article 45 of the GDPR, which establishes that a third country (i.e. a country not bound by the GDPR) or international organisation ensures an adequate level of protection of personal data. Such a decision takes into account the country's domestic law, its supervisory authorities, and international commitments it has... 
• If not, whether Standard Contractual Clauses (SCCs) are in place and how participants can access them 
• If relying on consent for transfers, whether that consent is informed, freely given, and clearly distinguished from consent to participate in the trial 
• Whether any Article 49 derogations are used, and what risks participants should be made aware of 

When providing this information, sponsors must strike a careful balance between legal accuracyIn data protection terms, the concept of ensuring data is not incorrect or misleading. and participant understanding. 

One ICF isn’t enough

Depending on the nature of the study, clinical trials will require one or more supplementary Informed Consent Forms.
Examples include:

• Pregnant partner ICFs 
• Parental assent forms 
• Genetic or biopsy consent ICFs 

These often involve unique legal, ethical, or national requirements, particularly where secondary data subjects, vulnerable groups, or sensitive data are concerned. Maintaining consistent language across all ICF versions is preferable, but not always possible. In some jurisdictions, regulators and ethics boards expect an ICF to be presented in a format or template specific to that jurisdiction. Sponsors must keep a clear audit trail and ensure every variation aligns with both local expectations and GDPR requirements. 

Key takeaways

Informed Consent Forms (ICFs) play a central role in clinical trials, not only in securing ethical approval but also in meeting GDPR requirements. Beyond communicating study details, the ICF must clearly explain how participants’ personal data will be used, protected, and shared. 

Sponsors should involve their DPOs early in the drafting process to ensure transparency requirements are met and to avoid common pitfalls such as vague lawful bases, incomplete transferThe movement of data from one place to another. This could be, for example, from one data controller to another, or from one jurisdiction to another. information, or missing recipient details. With many trials spanning multiple jurisdictions and requiring several ICF versions, flexibility and clarity are key. 

By aligning ICFs with data protection obligations from the outset, sponsors can reduce regulatory risk, avoid ethics committee delays, and build lasting trust with participants, partners, and regulators. 

Are you worried about compliance gaps in your clinical trial documentation? The DPO Centre has extensive experience in supporting sponsors with practical, expert guidance across every stage of the trial.

Get in touch with our team for more information. 

In case you missed it… 

• Clinical trials part 2: Data protection considerations for vendor Data Processing Agreements
• Clinical trials part 1: Data protection considerations for Clinical Trial Agreements
• Anonymisation part 1: Challenges & considerations for Life Sciences