GDPR Data Protection Regulation Effective May 25, 2018

The European Union’s General Data Protection Regulation (GDPR) goes into effect May 25, 2018. The GDPR replaces the existing EU Data Protection Directive. While the regulation is intended to cover EU personal data, non-EU entities may still be impacted by the new requirements.

According to the regulation, EU personal data includes data collected and processed in clinical trials conducted in the EU. It also applies to the processing of personal data by a controller or processor not located in the EU when the data processing is related to (a) offering goods or services to subjects in the EU, or (b) the monitoring of behavior of subjects while in the EU.

The sponsor of a clinical trial is responsible for determining whether the study must comply with the GDPR. If the study is subject to the GDPR, detailed data privacy information must be provided to subjects. This may be included in the consent form, a data privacy addendum, letter to subjects, or other formats as determined by the sponsor (collectively, data privacy notice). In the US, the IRB of record should confirm that the GDPR data privacy requirements have been included in the data privacy notice.

Advarra asks that sponsors and investigators inform the IRB as to whether the GDPR applies to specific clinical trials. If GDPR does apply, Advarra will work with clients to help ensure the required GDPR data privacy information is included in the study consent form or privacy addendum.

Advarra will monitor the evolution of the regulation and provide updates and additional information as appropriate. Advarra provides this update for informational purposes only and not for the purpose of providing legal advice. For clients unsure of whether the GDPR applies to a particular study or scenario, Advarra suggests consulting with legal counsel for support.

Back to Resources