Data compliance for clinical research
Sponsors, CROs, investigators: research involving human subjects combines several frameworks — the GDPR, the French Jardé law, the CNIL’s reference methodologies (MR-001 to MR-006), CPP opinions. Our founder, a former member of a French research ethics committee (CPP), knows these requirements from the inside.
What is at stake for your organization
- Choose the right framework: a CNIL reference methodology or a specific authorization.
- Draft the information materials and collect the consent of research participants.
- Carry out the DPIAs for research projects.
- Frame data transfers outside the European Union (international sponsors, processors).
- Articulate pseudonymization, monitoring and participants’ rights.
What triggers the need
- Setting up a new protocol or a data-only study
- A sponsor audit or a requirement from an academic partner
- Building a data warehouse or reusing existing data
- A submission or publication requiring proof of compliance
Sound familiar? Now is the right time to get the subject under control — before it takes control on its own.
The most common mistake
Confusing consent to participate in the research (Jardé law) with the GDPR legal basis for processing the data. They are two distinct regimes — and confusing them weakens both the protocol and its documentation.
What we put in place
- Regulatory qualification of projects (applicable MRs, CNIL formalities)
- Compliant information and consent documents
- DPIAs and record of research processing activities
- Contractual framing of processors and transfers (standard clauses)
- Outsourced DPO for sponsors and CROs
Your questions
Which CNIL reference methodology applies to my study?
It depends on the type of research (RIPH 1, 2 or 3, data-only studies, data warehouses). Each MR has strict conditions; departing from them requires an authorization request. The initial qualification of the project is the decisive step — we carry it out with you.
Are GDPR consent and consent to the research the same thing?
No — and it is a frequent confusion. Consent to participate (Jardé law) is not the same as the GDPR legal basis for the processing, which most often rests on public-interest mission or legitimate interest. Digital consent is, moreover, one of our academic research topics.
Can study data be transferred outside the EU?
Yes, provided there is a valid transfer framework: an adequacy decision, standard contractual clauses and supplementary measures where needed. International sponsors must document these transfers precisely.
Let’s secure the compliance of your organization
A free first conversation to review your situation and identify your priorities.
Response within 24 business hours · No obligation