A data processing agreement for clinical trials: what it must say and what to negotiate

The processor acts on the controller documented instructions, including on transfers to third countries, unless law requires otherwise, in which case it tells the controller first where it may. In practice the instructions are the contract, the study configuration and any written change requests. Agree that email or a ticket counts as a written instruction as long as a record is kept, and say who on the sponsor side can give one.

Everyone authorised to process the data is bound by confidentiality, by contract or by statute. For a platform vendor, ask how staff access to customer data is limited and logged. For a study, add the rule that blinded information is never exposed to blinded roles.

The processor must take the measures Article 32 requires. Put these in an annex instead of a sentence, so they can be reviewed and updated: hosting region, encryption at rest and in transit, role-based access, audit logging, backups, incident handling. Our vendor security questionnaire guide lists the questions to put to a vendor before you fill in that annex.

The processor may not engage another processor without the controller prior specific or general written authorisation. With general authorisation it must tell the controller about intended additions or replacements and give a chance to object. The same data protection obligations must be passed down in a contract, and the original processor remains liable to the controller if the sub-processor fails. A usable DPA names the current sub-processors, their purpose and their region, and sets a notice period for changes.

The processor helps the controller answer requests from participants (access, rectification, restriction, erasure where it applies) and helps with the security, breach notification, impact assessment and prior consultation duties in Articles 32 to 36. For breaches, the controller has its own notification window to the supervisory authority, so the DPA should oblige the processor to tell you without undue delay and say how, to whom and what information it will include. Our DPIA template for clinical trials shows where those processor facts feed in.

At the controller choice, the processor deletes or returns all personal data after the services end and deletes existing copies unless Union or member state law requires storage. This is the clause that needs trial-specific thought, covered in its own section below.

The processor must make available the information needed to show compliance and allow for and contribute to audits, including inspections, by the controller or an auditor it mandates. It must also tell the controller if it believes an instruction infringes data protection law. In a regulated trial, add that the vendor will support sponsor audits and regulatory inspections, and say how a remote audit works.

A template may promise deletion within a few weeks of termination. A trial usually has to keep the records much longer. Under the EU Clinical Trials Regulation the sponsor and investigator keep the clinical trial master file for at least 25 years after the end of the trial (check Article 58 and national rules), and good clinical practice expects records to be retrievable for inspection. Decide who holds the archive, in what format, and what the processor does in the meantime. Common answers are a controlled export handed to the sponsor, then a certified deletion, or a defined retention period at the vendor. Whichever you pick, write it down. Our data archiving and retention guide and the database lock checklist help with the export side.

Participant data in an EDC is usually coded, but coded is not anonymous: under the GDPR pseudonymised data is still personal data, and the DPA applies. What the DPA can do is limit exposure by design. Say which roles see names and which see only coded IDs, and keep treatment allocation away from blinded staff. See data pseudonymisation in EDC for the design pattern.

Hosting region, support access and sub-processors are three separate transfer questions. A vendor can host in the EU and still allow a support team in another country to reach data. The DPA should cover all three and name the transfer mechanism, for example standard contractual clauses, for any restricted transfer. If your study has US sites, the HIPAA versus GDPR guide explains why the two regimes need different paper.