As discussed in Part 1 of this series, GDPR and CTR obligations often intersect operationally during the clinical trial process, particularly where sponsors, CROs, laboratories, and research sites are required to coordinate data governance, regulatory submissions, and participant protections across jurisdictions.

In practice, regulators are increasingly focused not only on whether sponsors understand these frameworks conceptually, but whether they have implemented operational processes capable of supporting ongoing compliance throughout the trial lifecycle.

For U.S. companies working with European study sites or laboratories, that means heightened scrutiny around lawful basis selection, CTIS coordination, privacy documentation, vendor oversight, cross-border transfers, and broader data governance practices.

Part Two: What U.S. Sponsors Need to Know

The following areas are most likely to impact timing, cost, and compliance:

• GDPR lawful basis
  When processing clinical trial data, regulators expect sponsors to rely on one of several legal bases (public interest, legitimate interest, or scientific research) provided for under Articles 6 and 9 GDPR. It is best to align early on this decision as it drives documentation, contracts, and data flows. GDPR consent is not the recommended legal basis for processing participant data because clinical-trial participants may be in a position of vulnerability or imbalance vis-à-vis the sponsor/investigator, thereby failing to meet the “freely given” condition for consent to be deemed valid under the GDPR.
• CTR informed consent is required
  Clinical trial participants are required to provide informed consent that meets CTR standards for clarity, documentation and voluntariness.
• A centralized application submission process is now mandatory
  The CTR created a single EU application system streamlining authorization and ethics review. Sponsors submitting via national routes alone are no longer compliant.
• GDPR applies broadly—even to non-EU companies
  If EU-based participants or sites are involved, or if participant behavior in the EU is monitored, the GDPR will apply. Most U.S. sponsors must also appoint an EU representative.
• DPIAs and DPOs are increasingly expected
  Most clinical trials require a Data Protection Impact Assessment, and organizations conducting large-scale health data processing are encouraged to appoint a Data Protection Officer. Both play a key role in data governance, shaping how data is handled in practice.
• EU Member State rules still matter
  Member State rules still affect key aspects of trial execution, including rules governing minors, incapacitated adults, human biological samples, and compensation/insurance.

A Practical Framework for Compliance

A proactive, cross-functional approach can help sponsors align GDPR and CTR obligations before operational or regulatory issues arise. Key compliance steps include:

• Reviewing ongoing and planned trials for GDPR applicability and lawful basis alignment
• Updating privacy notices and participant-facing materials to reflect actual data use
• Confirming CTIS submission strategy and internal coordination processes
• Conducting DPIAs and integrate findings into trial design and vendor management
• Validating local law requirements in each Member State
• Aligning CROs, labs, and vendors on data protection and compliance expectations

Early coordination across legal, clinical, privacy, regulatory, and vendor-management teams can also bolster readiness.

To assist legal, clinical, and operational teams with a readiness assessment before launching or expanding a trial in the EU, we’ve created this compliance checklist with recommended actions.

Together, GDPR and CTR compliance increasingly require more than isolated legal analysis. For many sponsors, success depends on building operational processes that align clinical, regulatory, privacy, and data governance considerations from the outset.

For assistance updating your clinical trial templates or conducting a GDPR/CTR compliance review, please contact Stephan Grynwajc at stephan@outsidegc.com.

---

Stephan Grynwajc is admitted to the practice of law in the U.S., Canada, U.K. and in France/the European Union. He has served as a senior in-house attorney for several blue-chip technology corporations (e.g., Intel and Symantec) in France, the U.K. and the U.S., and today, focuses his practice on advising U.S.-based clients on navigating the EU, UK and Canadian legal and regulatory landscape.