Clinical trials, research and biobanks

• Regulation (EU) No 536/2014 — clinical trials
• Regulation (EU) 2016/679 — GDPR, Articles 9 and 27
• Regulation (EU) 2017/745 Article 62 for device investigations
• Regulation (EU) 2025/327 — European Health Data Space

Who has to appoint one

Sponsors established outside the Union running clinical trials in the EU. Regulation 536/2014 requires either an establishment in the Union or a legal representative established there, and the GDPR obligations apply separately to the personal data processed.

Thresholds and exemptions

None. The requirement applies to any trial conducted in the Union, and applications go through the Clinical Trials Information System.

What must appear on the label

Investigational medicinal product labelling per Annex VI, including the trial reference, the sponsor's details and the storage and use instructions, in the language of the member state concerned.

Marketplace fields

Not a marketplace matter. What gates access is the CTIS application, the ethics committee opinion and the national assessment, which run to a defined timetable.

Documentation you must hold

Clinical trial application through CTIS with the protocol, investigator's brochure and investigational medicinal product dossier, the legal representative appointment, insurance or indemnity arrangements, and on the data side the Article 30 record, the Article 9 condition, the transfer mechanism and the data protection impact assessment.

Standards and testing

Good manufacturing practice for the investigational product, good clinical practice for the conduct, and inspections by national authorities.

Language requirements

Patient-facing documents including the informed consent form in the language of the participants, and the application documents per the member state's requirements.

When it applies

Authorisation before the trial starts. Safety reporting deadlines are short: suspected unexpected serious adverse reactions within 7 or 15 days depending on severity.

How long records are kept

The clinical trial master file for at least 25 years after the end of the trial, which is far longer than most retention schedules anticipate.

What happens if you do not comply

Suspension of the trial, refusal of subsequent applications, and criminal exposure in several member states for conducting a trial without authorisation. GDPR fines apply to the data processing.

Who enforces it

National competent authorities and ethics committees, the European Medicines Agency for CTIS, and data protection authorities.

Where the boundary lies

Consent to participate in a trial and consent as a GDPR legal basis are different things, and most authorities treat the research legal basis rather than consent as appropriate for the processing. The 25-year retention is a legal obligation that overrides ordinary minimisation.

Questions we are asked

Do we need a legal representative in the EU?

A sponsor without an establishment in the Union must appoint a legal representative established there under Regulation 536/2014.

Is participant consent the GDPR basis?

Usually not. Ethical consent to participate is distinct from the data protection legal basis, which is typically a task in the public interest or legitimate interests with an Article 9 research condition.