EU GDPR Representative Service
Sponsors of clinical studies established outside the European Union, and recruiting patients in the European Economic Area (EEA), in accordance with GDPR Article 27 (Representatives of data controllers not established in the Union), must appoint a Data Protection Representative (DPR) in one of the Member States of the European Union. It could be a legal entity controlled by the sponsor (subsidiary) or provided by a service.
The DPR and DPO are different roles: a DPR is an entity that can easily be reached, in place of the controller, by a Supervisory Authority in case of a control, a complaint from an individual or a litigation, while the DPO is an independant advisor and monitor of the controller’s compliance.
To prevent any conflict of obligation or interest:
- The same legal entity or physical person cannot be acting as DPO and DPR of the same sponsor. This could impede the independence of the DPO.
- The same legal entity cannot be acting as a processor (CRO) and DPR for the same Sponsor, as a conflict may arise in case of enforcement proceedings imposed to the sponsor via the CRO.
References:
- European Data Protection Board (EDPB) Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) Version 2.1 – Chapter 4
GDPR Code of Conduct For Service Providers in Clinical Research Version 1 Final – 12 September 2024 § 4.5.2
A link to our independent partner, provider of the EU GDPR DPR service will be soon published.
Stay tuned, or contact us if you need more information about the DPR service.
You can put your trust in us to meet your need for compliance in personal data protection and privacy in the health area:
Do you have a specific question related to data protection in the heath area? Ask us your question, and we will be happy to answer it at no cost to you.
Would you like to be put in touch with a member of our customer or partner network, to receive confidential feedback on our services?
Would you like to know more about our company: our working methods, tools and knowledge base, our ability to meet your needs and projects?
All the terms of our discussions are regulated by our personal data protection and privacy policy.
