REDCap is software that institutions install and run, so GDPR compliance is a property of your hosting institution's setup, contracts and project configuration, not a feature you receive with the licence.
Free sandbox · No credit card · 21 CFR Part 11 aligned
| Question | REDCap software | Your institution | Your study team | |
|---|---|---|---|---|
| Where is the server? | n/a | Decides | Confirms | |
| Is there a processor contract (Art. 28)? | n/a | Holds | Checks | |
| Security measures (Art. 32) | Features | Configures | Uses roles | |
| DPIA (Art. 35) | n/a | May require | Completes | |
| Breach reporting (Art. 33) | n/a | Process | Reports fast | |
| Transfers outside the EEA | n/a | Policy | Collaborator access |
The direct answer
Controller, processor, host
GDPR attaches duties to roles. The sponsor or institution running the study is typically the controller. Anyone who processes personal data on its behalf is a processor, and Article 28 requires a contract that sets out the processing, security and sub-processor terms. With a commercial hosted EDC, the vendor is the processor and the contract is the vendor's data processing agreement. With REDCap, the picture is different: the software is licensed through the consortium, but the servers belong to a university, hospital or hosting partner. That host is the party running the system for you, and your study's arrangement is with them, usually through an institutional service agreement or internal governance rather than a commercial DPA.
This is why published institutional guidance varies. Imperial College's central REDCap service, for example, asks for a DPIA reference for projects. The University of Verona's policy requires a suspected breach to be reported to the REDCap administrator and the institution's data protection officer within 24 hours. The University of Melbourne gives outside researchers limited-access accounts sponsored by a full-access user. These are local choices, quoted here as examples of the questions to ask, not as rules that apply to your instance. Check your own institution's policy.
The result is a better answer than "yes" or "no": REDCap can sit comfortably inside a well-run GDPR programme, and it can also be deployed badly. For validation and 21 CFR Part 11 questions on the same software, see is REDCap 21 CFR Part 11 compliant?. For the wider European choice, see best EDC for European trials.
Ask your institution
The REDCap column lists what to ask the hosting team, not what REDCap does. The Capture column follows our product documentation.
| GDPR topic | Ask the REDCap host | Capture |
|---|---|---|
| Location of data (Art. 44-49) | Which data centre and country? Are backups, support access and monitoring in the same jurisdiction? | Hosted in the EU (Frankfurt) or the USA (N. Virginia); you choose |
| Processor terms (Art. 28) | Which agreement covers the study: institutional policy, a service-level agreement, a DPA with a hosting partner? | Hosted in the EU (Frankfurt) or the USA (N. Virginia); have your DPO review the contract terms before go-live |
| Security of processing (Art. 32) | Encryption, patching cadence, logging, access reviews, two-factor sign-in. Who verifies? | AES-256 at rest, TLS in transit, role-based access, row-level security, optional two-factor for staff |
| Data minimisation and pseudonymisation | Can identifiers be separated and hidden from analysts? | Site coordinators see names; researchers see coded IDs |
| DPIA (Art. 35) | Does the institution require one per project, and who signs it off? | See the GDPR DPIA template |
| Breach handling (Art. 33) | Who is notified, in what time, and who tells the supervisory authority? | Describe in your data management plan; security reports via the disclosure page |
| External collaborators | Can partners at other institutions or companies get accounts? Under whose policy, and with what training? | Site-level roles and a coordinator portal for each site |
| Erasure and retention | How are records deleted or retained consistent with trial rules? | Clinical data are soft-deleted only, so retention and erasure need a documented decision |
Institutional examples are paraphrased from public university pages found on 13 October 2026 and may have changed. This is not legal advice.
Choose EU hosting in the free sandbox, set roles and read the audit trail. No credit card, every feature.
Fit
REDCap is a strong choice when your university runs a well-resourced service with a named data protection officer, a DPIA route, tested backups, and a team that knows your jurisdiction. In that case your study inherits governance that a small group could not build alone. Ask for the service definition and read it before choosing anything else.
Look elsewhere when the host is uncertain, when your collaborators sit across several countries and institutions with different policies, when a sponsor expects a vendor-signed processor agreement, or when you need a system running quickly without a local build queue. See the multi-site view and the hosting and validation burden. If you want a managed EU-hosted platform instead, see GDPR-compliant clinical trial software and HIPAA vs GDPR for clinical trial data.
Verification plan
Find who runs the instance: your institution, a partner institution or a commercial hosting provider. Ask for the service definition.
Hosting location, processor or service agreement, security overview, backup and retention policy, breach procedure, and the DPIA process.
Record the data categories, special-category data, collaborators and any transfers outside the EEA.
Use your institution's template or the GDPR DPIA template for clinical trials.
If the answers are complete, file them. If not, close the gaps locally or choose a platform whose terms you can obtain in writing, and test it first in a free sandbox.
It depends on the institution that hosts it. REDCap is software that institutions install and run. Public institutional guidance describes it as configurable for GDPR per project, with compliance depending on local implementation. Ask your host and your data protection officer.
There is no single vendor DPA, because the software is hosted by an institution or partner. The arrangement is usually an institutional service agreement or internal governance with the host. Confirm with your host and DPO.
Yes, if your institution hosts it in the EU. The location is a fact about your instance, not about the software. Ask where the servers, backups and support access sit.
Some institutions require one for each project, and GDPR Article 35 requires one for high-risk processing such as large-scale health data. Check your institution's policy.
Policies vary: some institutions allow sponsored or limited accounts, others do not. Check your host's rules and make sure data transfers outside the EEA are covered.
Capture is GDPR ready: EU hosting in Frankfurt or USA hosting in N. Virginia, AES-256 at rest, TLS in transit and role-based access. A DPIA and the final assessment remain your responsibility.
You can rebuild forms by describing them or uploading a data dictionary for AI drafting, which you review. We do not claim automated project import. See the migration guide.
Open the free sandbox, with every feature and no credit card. You pay only when you go live.
Keep exploring
Capture vs REDCap
Head-to-head comparison.
Is REDCap 21 CFR Part 11 compliant?
The Part 11 question.
REDCap hosting and validation burden
What self-hosting involves.
Best EDC for European trials
EU-focused shortlist.
GDPR-compliant clinical trial software
What to look for.
How to migrate from REDCap
Step-by-step move.
Free sandbox, every feature. Check roles, hosting and the audit trail yourself. No credit card.