On 16 December 2025, the European Commission issued a Proposal for a European Biotech Act. The proposal aims to strengthen the competitiveness of the European Biotechnology sector while simplifying and harmonizing the regulatory framework for Clinical Trials and Data use in Health Research. The proposal contains changes in different fields impacting the Biotech sector, such as AI and Data, Regulatory tools for novel Health Biotechnology products, Biodefense, and Biotech misuse prevention. However, the core changes addressed in the joint opinion are those relating to the sections of the Clinical Trials Regulation (“CTR”) that address Personal Data processing.
While the EDPB and EDPS welcome the general objective of simplification and harmonization, they emphasize that such simplification must not reduce the level of Protection of Personal Data, particularly given the sensitive nature of Health and genetic Data.
Several aspects of the proposal may have a direct operational impact on sponsors, CROs, Research organizations, and Biotechnology companies, and are likely to increase the need for specialized GDPR support:
1. Harmonization of the legal basis for processing Personal Data in Clinical Trials
The proposal seeks to establish a clearer and more harmonized legal basis for the processing of Personal Data by sponsors and investigators under the Clinical Trials Regulation. It aims to establish legal obligation (within the meaning of Art. 6(1)(c) of the GDPR) together with public interest necessity (within the meaning of Arts. 9(2)(i) and 9(2)(j)) as the legal basis for the purposes listed in Art. 93 of the CTR (e.g., recording, processing, handling, and storage of information; submission of applications; research activities in accordance with the protocol; safety operations and reports; archiving; and submission of trial results). It is expected that this will reduce fragmentation between Member States given the addition of a derogation from Art. 9(4) of the GDPR, which currently allows Member States to introduce conditions on the processing of Personal Data. While the EDPB and EDPS support the intended changes, they propose improvements to the CTR text to enhance the clarity, precision, and foreseeability of the legal obligation as required by the GDPR.
2. Clarification of the roles of sponsors, co-sponsors, and investigators as controllers
While the proposal explicitly recognizes sponsors and investigators as controllers for certain processing operations, the EDPB and EDPS call for further clarification regarding whether they act as independent or joint controllers. This is likely to affect how responsibilities are allocated in Clinical Trial agreements, Data Protection arrangements, and Governance models.
In the same vein, the EDPB and EDPS recommend clarifying in the proposal that co-sponsors under Art. 72 CTR should be regarded as joint controllers to enhance legal certainty.
Furthermore, the joint opinion invites legislators not to consider (and therefore not impose GDPR obligations on) investigators as controllers, but rather the Clinical Trial site or institution, as in practice principal investigators act under the authority of the latter.
3. Secondary use of Clinical Trial Data for Scientific Research
The proposal introduces provisions allowing the further processing by the same controller of Personal Data collected in Clinical Trials for other Clinical Trials or Scientific Research with the aim of protecting public Health, improving the standard of care, and fostering the innovation capacity of European medical research.
The joint opinion calls for clarification in the recitals that this provision aims to create a legal basis for the further use of such Personal Data under Art. 6(1)(e) (task carried out in the public interest), except when such Data is processed for another Clinical Trial, in which case Art. 6(1)(c) would apply. Furthermore, such processing should be carried out only where it is necessary, making the addition of this requirement in the provision necessary.
Similarly, the EDPB and EDPS recommend defining more precisely and restrictively the notion of “fostering the innovation capacity of European medical research” to avoid differences in interpretation and potential deviations from the goal related to the public interest.
The opinion also recalls that specific safeguards to be used by controllers when this further processing takes place should be defined, as this is a requirement of EU or Member State law setting the basis for processing in the public interest. In the same vein, the opinion invites reflection on the impact on Data subjects’ rights that using this legal basis entails and calls for additional transparency, robust governance, and confidentiality mechanisms in line with Art. 89 of the GDPR.
4. Reinforced technical and organizational measures
The proposal contains additional safeguards, such as the collection of informed consent, confidentiality rules for records access, and the adaptation of security measures to specific trials. The EDPB and EDPS welcome these additional measures; however, they recommend stronger safeguards, such as systematic pseudonymization, stricter access and integrity controls, encryption, and enhanced security measures, particularly given the sensitivity of Health and Genetic Data used in Clinical Research. Furthermore, they recommend that the proposal should state that such measures must be listed in the protocol.
5. Sharing of Personal Data with competent authorities and the EU Commission
The proposal contains changes to regulate situations where sensitive Personal Data needs to be shared with competent authorities and the Commission for oversight and control purposes. The EDPB recommends clarification regarding the Data minimization principle, to allow such access only when necessary for the performance of their respective tasks and in pseudonymized form when direct identification is not necessary.
6. Retention period of Personal Data, including sensitive Data
The opinion calls for clarification that the retention period of 25 years contained in Art. 58 CTR refers to the Data contained in the Clinical Trial Master File, and not to all Personal Data processed in the context of a Clinical Trial. In addition, since this period is listed as a minimum, controllers should provide additional information to Data subjects, as well as the criteria used to determine a longer period for archiving and the justification for the extension, given that Data should not be kept longer than necessary for the purposes for which it is processed.
7. Transition periods
According to the proposal, the Biotech Act shall apply as of the day of entry into force. However, regarding the new provisions on Data Protection in Clinical Trials, the EDPB and EDPS consider that longer transition periods may be necessary for controllers to comply with their new obligations. Alternatively, a clarification that ongoing authorized Clinical Trials are not covered by the new regulation could be sufficient.
🔎 Other areas covered by the proposal
Application for authorization of a Clinical Trial
Under the proposed Art. 7(1)(d) CTR, each Member State should assess, for its own territory, the application for authorization of a Clinical Trial with respect to compliance with Data Protection law. The EDPB and EDPS note that there is no harmonized procedure for this assessment and invite the co-legislators to consider the possibility of expressly mandating the EDPB to adopt guidance on how such assessments should be performed by Member States.
Collection of informed consent via electronic means
The proposal aims to amend the definition of “informed consent” under Art. 2(21) CTR and would introduce the possibility of providing informed consent remotely through the use of electronic systems, methods, and processes, with it being signed electronically in accordance with Union law or equivalent standards. This is also reflected in amendments to Art. 29(1) CTR, according to which the record of the informed consent procedure may have an electronic form and shall be signed using electronic identification means complying with Regulation (EU) No 910/2014 (“the eIDAS Regulation”) or equivalent standards.
The EDPB and EDPS welcome the possibility for research participants to provide informed consent using electronic means. However, they recall that, in line with Art. 5a(15) of the eIDAS Regulation, the use of European Digital Identity Wallets (“EDIW”) shall be voluntary. Consequently, they recommend modifying the text in that regard. Furthermore, the provision of informed consent should remain possible through other means.
Increased interaction between Data Protection and AI Regulation
The proposal also introduces obligations where AI systems are used in Clinical Trials, including risk assessments and transparency requirements. This will require organizations to align GDPR compliance with the AI Act, thereby creating additional regulatory complexity for research and development projects.
Creation of Regulatory sandboxes and Biotechnology Data initiatives
New Regulatory sandboxes and Data initiatives are expected to facilitate innovation and the development of high-quality Datasets for Biotechnology. However, any processing of Personal Data in these contexts will still require a valid legal basis under the GDPR and appropriate safeguards.
In practice, these changes will require organizations to review how Personal Data processing is documented in Clinical Trial protocols and compliance frameworks. Compliance with such developments is likely to increase the demand for specialized Data Protection expertise in the Life Sciences sector, particularly in relation to:
• GDPR compliance in Clinical Trials
• Appropriate identification of the legal basis for Clinical Data processing
• Qualification of roles (controller / joint controller) and derived obligations
• Governance of Clinical and Research Data, including technical and organizational measures
• Secondary use of Health Data for Scientific Research
• Integration of AI governance with Data Protection frameworks.
At MyData-TRUST, we have Life Sciences, IT, and Legal professionals trained in Data Protection and Privacy who monitor all legislative changes impacting compliance requirements for the conduct of Clinical Research. Contact us to support your organization with GDPR compliance.
Author: Victoria Derumier & Michelle Ayora
