Many European universities run REDCap well. This guide is for the ones that cannot get an instance, need regulated trial controls, or want ePRO and eConsent in the same system, and it starts from the data protection questions your office will ask.
Free sandbox · No credit card · 21 CFR Part 11 aligned
| Hosting | Who validates | Best for | |
|---|---|---|---|
| Your institution's REDCap | Your IT | Your institution | Surveys, registries, low-risk studies |
| Third-party hosted REDCap | Provider | Check with provider | No local instance |
| Commercial EDC | Vendor region | Shared | Regulated trials, with budget |
| Capture | EU (Frankfurt) | Shared | Trials needing controls and ePRO/eConsent |
The short answer
Context
REDCap is widely used in academic research. It originated at Vanderbilt and is typically installed and run by a member institution, which means your local IT, security and data protection teams own the hosting, backups and access decisions. For surveys, registries and many observational studies that is a strength: the data stay inside the university's own governance.
The same model creates the common reasons to look elsewhere. A smaller university or a hospital research unit may not have an instance, or the central team may not be able to support a regulated clinical trial. A sponsor-investigator running a medicinal product trial under the EU Clinical Trials Regulation needs an audit trail, access control, signatures and validation evidence that stand up to inspection. A study with diaries and remote consent wants participant-facing features without a separate vendor. See the EU CTR and Annex 11 compliant EDC.
Public sources describe REDCap's compliance with Part 11 or GDPR as depending on how the hosting institution installs, validates and operates it, rather than as a property of the software alone. That is not a criticism; it is a division of responsibility to be clear about. For more detail, read is REDCap 21 CFR Part 11 compliant, REDCap vs EDC for clinical trials and the full Capture vs REDCap comparison. This page adds the GDPR-first view.
GDPR-first checklist
Ask them about your institution's REDCap, a hosted REDCap and Capture alike. Keep the written answers for the DPIA and the study master file. This is a planning aid, not legal advice.
A named region, in writing, including backups. Capture offers Frankfurt (EU).
For a hosted service, a data processing agreement (GDPR Article 28) and a sub-processor list. For a university-run instance, an internal agreement between the project and the central IT.
Health data are special-category data, and large-scale processing often triggers a DPIA. See the GDPR DPIA template.
Capture shows names to site coordinators and coded IDs to researchers; separation is enforced at the database layer.
Field-level, with user, time, old and new value and reason, append-only and hash-chained in Capture. Ask the same of REDCap's host.
Capture offers authenticator-app two-factor sign-in for staff and inactivity timeouts. Ask your host what applies to theirs.
Clinical data are soft-deleted only in Capture, so align retention with your protocol and legal basis.
Capture exports a blank eCRF PDF (cover page, form index, visit-by-form matrix) for submission. See GDPR-compliant clinical trial software.
Routes compared
Statements about REDCap are general and hedged. Check each with your own host.
| Question | Your institution's REDCap | Third-party hosted REDCap | Capture |
|---|---|---|---|
| Who runs the hosting | Your IT or a central research team | An external provider, if one is used | Capture, in Frankfurt (EU) or N. Virginia (US) |
| Time to start | Depends on your institution's request process | Depends on the provider | Sign up and build; the sandbox is free |
| Regulated-trial controls | Depend on your host's validation and configuration | Ask the provider | Field-level append-only audit trail, e-signatures, locked approved forms, Part 11-aligned controls |
| ePRO and eConsent | Check what your instance offers | Ask the provider | In the same study and audit trail |
| Randomization | Check with your host | Ask the provider | Stratified block randomization with caps, in the study |
| Cost model | Software is generally institution-supported; check internal charges | Provider-specific | Free sandbox; pay only when you go live; contact us for specifics |
No pricing or discount claims are made. Validation is a shared responsibility between software, host and sponsor in every column.
Open the free sandbox, create a study on EU hosting, look at roles, change a value with a reason and read the audit trail. Then take the evidence to your data protection office.
If you move
The safest pattern is to switch at a study boundary: a new trial, a new cohort or an extension. Mid-study moves carry risk to data integrity and are covered in how to migrate from REDCap. Capture does not claim an import tool on this page, so plan to archive the REDCap export with its data dictionary and merge at analysis, with a written mapping.
Rebuilding the forms is quicker than it sounds. You can upload a data dictionary, form or protocol and the AI drafts questions, lab tables and visits for your review; nothing is saved until a person approves it. Keep the variable names you need for continuity and record any changes in the data management plan.
Also decide what stays in REDCap. Many universities keep it for surveys and registries and use a regulated EDC for the trials. That split is perfectly reasonable; see EDC for university clinical studies and clinical trial software for European universities for the institutional picture, and REDCap alternatives for a broader list.
Finish current study in REDCap
Export data and dictionary
Build the next study in the sandbox
AI drafts, you approve
DPIA and processor terms
With your data protection office
Ethics submission
Blank eCRF PDF attached
Go live
Pay only from here
It depends on how your institution or provider installs, hosts and operates it. Check data location, processor terms, access controls and your DPIA with your host rather than assuming.
It depends on the study. For regulated trials that need an audit trail, e-signatures, ePRO and eConsent in one system, Capture offers EU (Frankfurt) hosting and Part 11-aligned controls. Evaluate it with the checklist above next to your other options.
In the EU (Frankfurt) or the USA (N. Virginia), chosen at study setup. Data are encrypted with AES-256 at rest and TLS in transit.
No software is GDPR certified. Capture is GDPR ready and offers the controls you need to document in your own DPIA and processor agreement.
Often, for health data at scale. Your data protection office decides. A template is on the GDPR DPIA page linked above.
This page does not claim an import tool. Switch at a study boundary, archive the REDCap export with its data dictionary, and rebuild forms with AI drafting that you review.
Yes. Capture is suitable for Phase 1, 2 and 3 studies.
No. We make no pricing or discount claims. The sandbox is free with every feature; you pay only when you go live. Contact us for specifics.
Keep exploring
Capture vs REDCap
Full head-to-head.
REDCap alternatives
The broader alternatives guide.
Clinical trial software for European universities
Institutional angle.
GDPR-compliant clinical trial software
Controls explained.
GDPR DPIA template
Starting point for the assessment.
How to migrate from REDCap
A migration plan.
Free sandbox, EU hosting available, every feature, no credit card.