On December 16, 2025, the EU Commission unveiled its proposal for the Biotech Act.  The proposal, which is only the first part of a bigger initiative for regulating biotechnologies, focuses primarily on the health sector.  The Commission took the opportunity to broadly revise the Clinical Trial Regulation (“CTR”) – see our blog post here.  In particular, it sought to better align the CTR requirements with those of the General Data Protection Regulation (“GDPR”).  This blog post provides an overview of those revisions relating to the processing of personal data during clinical trials.

Clarifying The Legal Basis For Processing Personal Data During Clinical Trials

The proposal specifies that sponsors and investigators are required to process personal data for a number of purposes in the context of clinical trials, effectively enabling these processing activities to be based on the sponsors’ and investigators’ legal obligations pursuant to Article 6(1)(c) and 9(2)(i) GDPR.  

The proposal also includes a requirement for these processing activities to be subject to “appropriate technical and organizational measures”, such as the obligation to obtain the patients’ informed consent (to participate in the trial, not as legal basis) and to maintain appropriate confidentiality and security during the trial.  

Clarifying The Modalities Of Processing

The proposal provides a number of clarifications regarding the modalities of the processing activities.  These concern for instance:

  • The obligation for sponsors and investigators to make personal data (including genetic and health data) available to competent national authorities and the Commission as needed;
  • The roles of sponsors and investigators – which are both designated as data controllers of patient data (although the proposal does not explicitly clarify whether this should be a joint or a separate controllership);
  • The retention period of the personal data – to be based on the CTR requirements;
  • The fact that the same controller is allowed to further process personal data collected during a clinical trial for (i) another clinical trial or (ii) other medical research activities.

We expect the above clarifications will have an impact on the way informed consent forms and trial agreements are drafted across various jurisdictions. The proposed changes would also require some Member States to change their current data protection laws.  In this respect, in an effort to further harmonize clinical trial practices throughout the EU, the proposal prevents Member States from maintaining or introducing further conditions for the afore-mentioned processing activities under Art. 9(4) of the GDPR.

*                      *                      *

The Covington team regularly advises the world’s top companies on their most challenging regulatory, compliance, and public policy issues in the EU and other major markets. Please reach out to a member of the team if you need any assistance.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Dan Cooper Dan Cooper

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing…

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing clients in regulatory proceedings before privacy authorities in Europe and counseling them on their global compliance and government affairs strategies. Dan regularly lectures on the topic, and was instrumental in drafting the privacy standards applied in professional sport.

According to Chambers UK, his “level of expertise is second to none, but it’s also equally paired with a keen understanding of our business and direction.” It was noted that “he is very good at calibrating and helping to gauge risk.”

Dan is qualified to practice law in the United States, the United Kingdom, Ireland and Belgium. He has also been appointed to the advisory and expert boards of privacy NGOs and agencies, such as the IAPP’s European Advisory Board, Privacy International and the European security agency, ENISA.

Read more about Dan CooperEmail
Show more Show less
Photo of Kristof Van Quathem Kristof Van Quathem

Kristof Van Quathem advises clients on information technology matters and policy, with a focus on data protection, cybercrime and various EU data-related initiatives, such as the Data Act, the AI Act and EHDS.

Kristof has been specializing in this area for over twenty…

Kristof Van Quathem advises clients on information technology matters and policy, with a focus on data protection, cybercrime and various EU data-related initiatives, such as the Data Act, the AI Act and EHDS.

Kristof has been specializing in this area for over twenty years and developed particular experience in the life science and information technology sectors. He counsels clients on government affairs strategies concerning EU lawmaking and their compliance with applicable regulatory frameworks, and has represented clients in non-contentious and contentious matters before data protection authorities, national courts and the Court of the Justice of the EU.

Kristof is admitted to practice in Belgium.

Read more about Kristof Van QuathemEmail
Show more Show less
Photo of Alix Bertrand Alix Bertrand

Alix advises clients on EU data protection and technology law, with a particular focus on French privacy and data protection requirements. She regularly assists clients in relation to international data transfers, direct marketing rules as well as IT and data protection contracts. Alix…

Alix advises clients on EU data protection and technology law, with a particular focus on French privacy and data protection requirements. She regularly assists clients in relation to international data transfers, direct marketing rules as well as IT and data protection contracts. Alix is a member of the Paris and Brussels Bars.

Read more about Alix BertrandEmail
Show more Show less