IAPP article: How does GDPR apply to clinical trial sponsors outside EEA? Views of EEA DPAs

The authors actually reached out to the DPAs and polled them for the following questions. (written below as they were sent to the DPAs):

  • Does the GDPR apply to a clinical trial sponsor based outside of the EEA if it is conducting clinical studies in the EEA?
    • Answers were mostly YES or “Factual Analysis”
  • Is patient data processed under a clinical trial considered “personal data” even if it is pseudonymized?
    • Received Answers were YES
  • If a clinical trial is being conducted in your jurisdiction, would the sponsor and the principal investigator be considered joint controllers of the personal data of the trial participants (data subjects)?
    • Various views


  • Is the sponsor the data controller while the principal investigator acts as a processor on behalf of the sponsor?
  • Is the principal investigator an independent data controller together with the sponsor?