The European Commission’s proposed Biotech Act marks a significant shift in how Data Protection is applied to Clinical Trials in the EU. By amending the Clinical Trials Regulation (CTR), the proposal directly addresses long-standing legal and operational uncertainties created by the fragmented application of the GDPR across Member States.
🇪🇺 A Long-Awaited Harmonization Effort
For years, stakeholders in clinical research have faced divergent national interpretations of fundamental GDPR concepts, particularly the appropriate legal basis for processing and the allocation of Data Protection roles. This has resulted in inconsistent trial setups across countries, even for identical studies, increasing complexity and cost. For instance, several Member States have historically insisted on GDPR consent as the legal basis for all Clinical Trial Data processing, creating a compliance asymmetry that has complicated multinational trial design and, in some cases, discouraged valuable research from being conducted in the EU.
The Biotech Act aims to resolve this by introducing a more harmonized framework. Notably, it rewrites Article 93 of the CTR to clarify key Data Protection aspects, effectively stepping in where soft-law instruments, such as guidance from the European Data Protection Board, have failed to achieve convergence. The proposal, among other changes, aims to establish a single legal basis for the processing of Personal Data by sponsors and investigators, which will significantly improve legal clarity across Europe.
⚖️ A Major Shift in Legal Basis: Research as a Legal Obligation
One of the most impactful changes is the recognition of scientific research in Clinical Trials as falling under the legal obligation and public interest legal bases. The proposal establishes that processing of Personal Data in the context of a Clinical Trial under the CTR is grounded in Article 6(1)(c) GDPR (compliance with a legal obligation), with Article 9(2)(i) (public interest in the area of public health) or Article 9(2)(j) (scientific research) serving as the applicable exception to the prohibition on processing special categories of data, including health and genetic data.
The proposal therefore confirms a two-layered structure under the GDPR: the legal basis for processing under Article 6 and the condition permitting the processing of special categories of Personal Data under Article 9 remain distinct requirements, both of which must be satisfied.
This represents a clear departure from previous restrictive interpretations, where legal obligation was limited to specific obligations such as safety reporting or data retention. The Commission’s approach reflects the reality that once a Clinical Trial is authorized and initiated, sponsors are effectively required to carry out the research and publish results.
Importantly, this position has received support from the EDPB, signaling a notable evolution in regulatory thinking and paving the way for greater legal certainty across the EU.
👥 Clarifying Roles: Only Partially
The proposal also seeks to harmonize the qualification of key actors:
- Sponsors and investigators (including hospitals acting as investigators) are recognized as controllers.
- CROs remain processors.
While this brings welcome clarity, particularly by confirming that hospitals are not processors, the proposal stops short of specifying whether sponsors and investigators are joint or independent controllers. This unresolved point risks perpetuating inconsistencies if not clarified during the legislative process.
The EDPB and EDPS therefore recommend that the respective roles of sponsors and investigators be clarified to ensure a clear allocation of responsibilities. Given that their purposes for processing often overlap, the EDPB is advocating for the legislation to explicitly state that, where sponsors and investigators jointly determine the purposes and means of processing, they should be regarded as joint controllers. This recommendation also extends to co-sponsors under Article 72 of the CTR.
This is an area of significant practical importance for pharmaceutical and Life Sciences companies. If adopted, the clarification may require organizations to review and, where necessary, update contractual arrangements (e.g., Clinical Trial Agreements, Data Processing Agreements) to ensure that responsibilities are allocated appropriately and consistently with the legal roles of sponsors, investigators, and co-sponsors.
🔒 Secondary Use: Progress Undermined by Practical Limitations
The proposal introduces a legal basis for certain secondary research uses without requiring consent, a positive step aligned with innovation objectives.
However, its scope is limited to reuse by the same controller, effectively preventing data sharing across affiliated entities or research partners without reverting to consent or alternative legal constructs.
In practice, this creates data silos, a result that sits uneasily with the realities of modern global research and the increasing reliance on large, shared datasets, particularly in the context of AI-driven innovation. This aspect of the proposal is widely seen as overly restrictive and likely to be revisited during negotiations.
If the possibility to further process Clinical Trial Data is retained in the final text, this would be significant for Clinical Trial sponsors, as it would provide greater clarity on the ability to make further use of Clinical Trial Data in certain cases. It remains to be seen, however, whether the proposed wording of Article 93(6) of the CTR would be sufficient to constitute a proper legal basis for the processing of Personal Data, and what specific safeguards may be required.
🤝 A Bold Move Towards True EU Harmonization
Another key development is the removal of Member States’ ability to impose additional national restrictions under Article 9(4) GDPR.
This would eliminate country-specific requirements such as:
- Prior authorizations (for example, in France).
- Additional procedural obligations (such as the publication of DPIAs in Italy).
The result would be a substantial simplification of the regulatory landscape, enabling a more consistent and predictable framework for conducting and reusing Clinical Trial Data across the EU.
🧭 From Legal Interpretation to Operational Governance
Beyond the legal changes, the discussions highlighted a broader trend: compliance is becoming increasingly operational. With multiple overlapping frameworks, including the CTR, MDR, IVDR, and the forthcoming AI Act, organizations face a constantly evolving regulatory environment.
In this context, structured governance approaches, such as those based on ISO 27001 or ISO 27701, are emerging as essential tools to manage legal uncertainty, ensure scalability, and avoid both over- and under-compliance.
👉 What’s Next?
The Biotech Act is still in draft form. While negotiations are expected to continue throughout 2026, the current momentum suggests that final adoption could occur around 2027. Key aspects of the proposal, particularly those relating to secondary use and role allocation, are likely to be heavily debated by Member States.
Nonetheless, the direction is clear: the EU is moving towards a more harmonized, research-friendly Data Protection framework for Clinical Trials. The challenge will be ensuring that this ambition translates into rules that are not only coherent but also operationally workable, without creating disproportionate compliance burdens in practice.
Authors: Victoria Derumier & Myrto-Amaryllis Lappa
