DPO for Clinical Trials
McCulloch Regulatory Compliance acts as independent, outsourced Data Protection Officer for clinical trial sponsors and contract research organisations. The large-scale processing of health data in a trial renders the appointment mandatory in most cases. The service covers data protection impact assessments, review of informed consent and participant information, review of the trial website and privacy notice, assessment of CRO and vendor compliance, and international transfers, under the UK GDPR and EU GDPR.
EU GDPR
UK GDPRTrials process health data at scale
A clinical trial involves the large-scale processing of special category health data, which is a principal trigger for the mandatory appointment of a Data Protection Officer under Article 37. Data protection law applies in parallel with the Clinical Trials Regulation (EU) No 536/2014: the Regulation governs the conduct of the trial, and the GDPR governs the personal data processed within it.
A participant's consent to take part in a trial is distinct from a lawful basis for processing personal data under the GDPR, and the two should not be conflated. The correct allocation of controller and processor roles, the identification of a lawful basis, and the governance of international transfers are central to this service.
Services
Data protection impact assessment
Art 35Assessing the high-risk processing the trial involves and documenting the mitigating safeguards, ordinarily the first deliverable of the engagement.
Sponsor, CRO and site roles
ControllershipDetermining controller, joint controller, and processor status across the sponsor, CRO, and sites, and documenting the relationships accordingly.
Informed consent and participant information
Arts 13 to 14Reviewing consent forms and participant information sheets for the data protection information required by Articles 13 and 14, distinct from consent to participate in the trial.
Trial website and privacy notice
TransparencyReviewing recruitment sites and trial privacy notices to ensure participants receive clear and complete information regarding the use of their personal data.
Vendor and CRO compliance
Art 28Reviewing CROs, laboratories, and technology vendors, together with the data processing terms that bind them and the sub-processor chain.
International transfers
Chapter VGoverning transfers of trial data from the UK and EEA under Chapter V, using the Standard Contractual Clauses, the UK International Data Transfer Agreement, and transfer risk assessments.
Participant rights
Chapter IIIManaging participant requests and objections consistently with both the GDPR and the integrity of the trial.
Records and breach response
Arts 30, 33 to 34Maintaining the record of processing for the trial, and conducting breach assessment and notification within the 72-hour requirement.
Independence from the CRO
A contract research organisation that processes trial data on the sponsor's instructions has a conflict of interest and cannot provide the independent oversight the role requires. As an external appointment with no role in trial delivery, McCulloch Regulatory Compliance provides that independence, operating alongside the sponsor's regulatory and pharmacovigilance functions rather than across them.
Contacts
