No EDC is "GDPR certified". The best one for your European trial is the one whose hosting, processor terms, access controls and audit trail you can check and document. Here is the shortlist method, a category-level comparison and Capture's honest limits.
Free sandbox · No credit card · 21 CFR Part 11 aligned
| Question | Option A | Option B | Option C | |
|---|---|---|---|---|
| Data stored in the EU? | Ask | Ask | Ask | |
| Processor terms and sub-processors in writing | Ask | Ask | Ask | |
| Names hidden from researchers | Ask | Ask | Ask | |
| Field-level audit trail with reasons | Ask | Ask | Ask | |
| Validation evidence you can hold | Ask | Ask | Ask |
The short answer
What changes in Europe
European trials put several overlapping expectations on the system that holds the data. GDPR governs personal data and, because health data is special-category, needs a clear legal basis, minimisation and security. Beyond GDPR, regulators expect computerised systems used in trials to be fit for purpose, validated, access-controlled and auditable; see Annex 11 compliant EDC and Annex 11 vs 21 CFR Part 11 for how those expectations relate. The EU clinical trials regulation adds its own record-keeping duties on the sponsor.
None of these expectations are met by buying software. They are met by the sponsor using a suitable system within documented procedures, which is why the first question for a vendor is what evidence they give you, not what badge they display. The sections below turn that into a shortlist method. For the controls Capture provides, see GDPR-compliant clinical trial software, and for the US side HIPAA vs GDPR in clinical trial data.
One practical point: a university sponsor and a commercial sponsor will weigh these differently. If you run an academic study, clinical trial software for European universities covers the institutional angle. This page is for anyone comparing platforms head to head.
Selection criteria
Score each option on the same sheet and keep the written answers for your study master file and data protection impact assessment.
A named EU region, in writing, including backups. Capture offers Frankfurt.
Ask for the data processing agreement and the sub-processor list; check transfer mechanisms if any processing is outside the EU.
Role-based access with names visible only where needed. Capture shows names to site coordinators and coded IDs to researchers.
Ask whether isolation is at the database layer, not just hidden fields. Capture uses row-level security.
Field-level, with user, time, old and new value and reason, and not editable. See audit trail software.
What documentation helps your own validation, and who holds the validated state. See computer system validation.
Can you export or locate one participant's data, and how do soft-deletion and retention interact with your obligations?
Participant-facing languages and low-connectivity entry; check both explicitly rather than assuming.
Setup fee, term, per-module charges and what triggers a price change, in writing.
Comparison
Neutral descriptions, not feature, hosting or pricing claims. Confirm every point with the vendor and in a hands-on trial.
| Option | Category | Often evaluated for | Verify for a GDPR trial |
|---|---|---|---|
| Capture | Self-serve, all-in-one clinical trial platform | Phase 1 to 3 studies wanting EDC, ePRO, eConsent and randomization in one system with a free sandbox | EU (Frankfurt) hosting is available; confirm offline and language needs; validation is a shared responsibility |
| Castor | Commercial EDC and decentralised platform | Mid-market sponsors and CROs | Hosting region, processor terms, commercial model. See Capture vs Castor |
| REDCap | Institution-hosted research data capture | Academic studies with institutional support | Where your institution hosts it, who validates it. See Capture vs REDCap |
| Medrio | Commercial EDC for sponsors and CROs | Early-phase and small-to-mid-size trials | Hosting region, included modules. See Capture vs Medrio |
| Viedoc | Commercial clinical trial platform | Studies running across many countries | Hosting, language scope and commercial model. See Capture vs Viedoc |
| OpenClinica | EDC with an open-source heritage | Teams wanting configurability and hosting choice | Who hosts and validates. See Capture vs OpenClinica |
No pricing, hosting or feature claims are made about any vendor other than Capture. This is not a ranking.
The free sandbox includes every feature. Create a test study, look at the roles, change a value with a reason and read the audit trail.
Where Capture fits
For a GDPR-minded study the most useful thing to see is who can see what. In Capture, site coordinators see participant names for their site, while researchers see only coded IDs, and the separation is enforced in the database, not only in the screen layout.
| Data | Site coordinator | Researcher | Admin | |
|---|---|---|---|---|
| Participant name | ||||
| Coded ID (001-0042) | ||||
| Clinical form data | ||||
| Audit trail |
Honest limits
Capture does not currently offer offline data entry, so sites with unreliable connectivity need a documented fallback. We also do not claim multilingual participant forms on this page; if your trial needs participant-facing questionnaires and consent in several languages from day one, confirm the current position with us before you shortlist Capture. Capture is not a CRO, a CTMS or a safety database, and it does not replace a sponsor's own quality system.
Equally, if your sponsor or CRO mandates its own EDC, you will use theirs. None of this is about trial phase: Capture is suitable for Phase 1, 2 and 3. For a wider market view, see best EDC software in 2026 and how to choose an EDC system.
How to run the evaluation
Use the same protocol and the same questions with every vendor.
Hosting region, processor terms, roles, audit trail, validation evidence, languages and connectivity.
Data processing agreement, sub-processor list and validation documentation, in writing.
Rebuild the same form in each system and time the build and the first amendment.
Log in as a researcher and as a site user; change a value with a reason and inspect the trail.
Ask for the commercial model in writing, including setup, modules and term.
It depends on your hosting, processor, access control, audit trail and validation requirements. Shortlist on written evidence, then test each system with the same form and roles.
No agency certifies software as GDPR compliant. Check the specific controls: EU hosting, encryption, role-based access to identifiers, audit trail and processor terms.
In the EU (Frankfurt) or the USA (N. Virginia). AES-256 encryption at rest and TLS in transit.
Capture provides controls aligned with those expectations, such as an audit trail, role-based access and electronic signatures. Validated use is a shared responsibility. See the Annex 11 page.
No. Offline entry is not available today, so sites need a connection or a documented paper fallback.
This page makes no multilingual claim. Confirm your language needs with us before shortlisting.
No. It is a selection method with category-level descriptions. Capture is listed honestly alongside other options, which should all be verified with each vendor.
Open the free sandbox, with every feature, no credit card and no time limit. You pay only when you go live.
Keep exploring
GDPR-compliant clinical trial software
The controls Capture provides.
Annex 11 compliant EDC
Computerised system expectations.
Clinical trial software for European universities
The academic sponsor view.
Best EDC software in 2026
The wider market guide.
Capture vs Castor
Head-to-head comparison.
Security
Controls and disclosure.
Free sandbox, every feature. No credit card, pay only when you go live.