Data compliance for clinical research
Sponsors, CROs, investigators: research involving human subjects combines several frameworks — the GDPR, the French Jardé law, the CNIL’s reference methodologies (MR-001 to MR-008), CPP opinions. Our founder, a former member of a French research ethics committee (CPP), knows these requirements from the inside.
What the regulations require of you
Each obligation is cited with its legal reference — so you know exactly where it comes from and what it demands of your organization.
Fit within a CNIL reference methodology or obtain authorization
Each research project relies on one of the CNIL's reference methodologies (MR-001 to MR-008), whose conditions are strict; departing from them requires prior authorization.
Articulate research consent and GDPR legal bases
Consent to participate in the research and the GDPR legal basis for the data processing fall under two distinct regimes — both must be documented separately.
Carry out project DPIAs
The compliance commitment to a reference methodology presupposes an impact assessment; research on sensitive data at scale is subject to one in its own right.
Frame transfers outside the European Union
International sponsors and non-EU processors require a valid transfer framework: adequacy decision or standard contractual clauses, with supplementary measures where needed.
Keep the sponsor's record and contracts
Every study appears in the record of processing, and every provider (CRO, data management, hosting) is bound by a compliant data processing agreement.
What is at stake for your organization
- Choose the right framework: a CNIL reference methodology or a specific authorization.
- Draft the information materials and collect the consent of research participants.
- Carry out the DPIAs for research projects.
- Frame data transfers outside the European Union (international sponsors, processors).
- Articulate pseudonymization, monitoring and participants’ rights.
What triggers the need
- Setting up a new protocol or a data-only study
- A sponsor audit or a requirement from an academic partner
- Building a data warehouse or reusing existing data
- A submission or publication requiring proof of compliance
Sound familiar? Now is the right time to get the subject under control — before it takes control on its own.
The most common mistake
Confusing consent to participate in the research (Jardé law) with the GDPR legal basis for processing the data. They are two distinct regimes — and confusing them weakens both the protocol and its documentation.
What we put in place
- Regulatory qualification of projects (applicable MRs, CNIL formalities)
- Compliant information and consent documents
- DPIAs and record of research processing activities
- Contractual framing of processors and transfers (standard clauses)
- Outsourced DPO for sponsors and CROs
Expertise backed by the NELSE technology
Clinical research: our support relies on the tools developed by NELSE: each processing activity is qualified by written, sourced legal rules, the register stays up to date version after version, and the files handed over can be verified by a third party. The DPO assesses, advises and documents their opinions; your organisation keeps its decisions.
In practice, for you: a protocol is qualified against the reference methodologies and the CPP/ANSM tracks; if the study's scope changes, the qualification is reviewed — and the register of participants' access requests keeps to its one-month deadline.
Discover our softwareYour questions
Which CNIL reference methodology applies to my study?
It depends on the type of research (RIPH 1, 2 or 3, data-only studies, data warehouses). Each MR has strict conditions; departing from them requires an authorization request. The initial qualification of the project is the decisive step — we carry it out with you.
Are GDPR consent and consent to the research the same thing?
No — and it is a frequent confusion. Consent to participate (Jardé law) is not the same as the GDPR legal basis for the processing, which most often rests on public-interest mission or legitimate interest. Digital consent is, moreover, one of our academic research topics.
Can study data be transferred outside the EU?
Yes, provided there is a valid transfer framework: an adequacy decision, standard contractual clauses and supplementary measures where needed. International sponsors must document these transfers precisely.
Let’s secure the compliance of your organization
A free first conversation to review your situation and identify your priorities.
Response within one business day · No obligation