Outsourcing work does not outsource accountability
Clinical research depends on specialised partners. Sponsors may rely on CROs for study management, laboratories for sample analysis, technology providers for data capture and other vendors for participant-facing services. Each relationship introduces practical questions about who processes personal data and on whose behalf.
The starting point is not the vendor's job title or how the contract describes the service. GDPR roles depend on what each party actually decides and does in relation to a particular processing activity.
Follow the purpose and the decisions
A controller determines the purposes and essential means of processing. A processor handles personal data on the controller's behalf and within documented instructions. Organisations may have different roles for different activities; the label 'CRO', 'site' or 'vendor' does not settle the analysis.
Example 1 — Why is the sponsor the controller?
A pharmaceutical company initiates a clinical trial to evaluate the safety and efficacy of an investigational medicinal product. It defines the study objectives, approves the protocol, determines which participant data are required and establishes how those data will be analysed.
The sponsor is the controller for these research processing activities because it determines why personal data are processed and the essential means of that processing.
The sponsor may delegate the operational work, but the underlying decisions about the research remain its responsibility.
Example 2 — Why is the CRO a processor?
The sponsor appoints a CRO to manage the trial, monitor study sites, review data and coordinate reporting.
The CRO processes participant data to perform these activities in accordance with the sponsor's instructions and the study protocol. It may decide how to organise its monitoring teams or which internal procedures to follow, without determining the purposes of the research.
For these activities, the CRO acts as a processor.
However, the same CRO may be an independent controller when processing its employees' personal data for payroll, recruitment or other internal business purposes.
Example 3 — Why is the laboratory a processor?
The study protocol requires blood samples to be analysed for specific biomarkers.
A central laboratory receives coded samples, performs the required tests and returns the results for the study.
When it processes the data solely to provide the agreed services on the sponsor's behalf, the laboratory acts as a processor because the sponsor determines which analyses are needed, what data must be reported and how the results will be used in the study.
If the sponsor contracts the laboratory directly, the laboratory will generally be the sponsor's processor. If the CRO appoints the laboratory to perform part of the processing entrusted to it by the sponsor, the laboratory will generally be a subprocessor.
The laboratory may have a different role for separate processing activities carried out for its own purposes or under independent legal obligations.
Performing a specialised activity does not necessarily mean determining the purpose of the associated personal data processing.
What happens when the CRO contracts the eCRF or eTMF provider?
Technology vendors add another layer to the processing chain.
Example 4 — Electronic Case Report Form (eCRF)
An eCRF is the electronic version of a case report form, used to record protocol-required participant information, such as study visits, laboratory results, adverse events and other clinical observations.
The sponsor appoints a CRO to manage clinical data collection. The CRO contracts an electronic data capture (EDC) provider to host and maintain the eCRF system.
In this arrangement:
The sponsor is the controller, determining the purpose of the data collection and the essential categories of information required by the protocol.
The CRO is the processor, managing data collection on the sponsor’s behalf.
The EDC provider is generally the subprocessor, providing the technical system through which the data are captured, stored and managed.
The fact that the CRO selected and contracted the EDC provider does not automatically make the CRO the controller of the clinical data.
The sponsor must authorise the subprocessing arrangement in accordance with Article 28 GDPR, and appropriate contractual protections must flow down to the technology provider.
Example 5 — Electronic Trial Master File (eTMF)
The Trial Master File (TMF) contains essential documents that allow the conduct of a clinical trial and the quality of the data generated to be evaluated. An eTMF is the electronic system used to organise, manage and archive those records.
Unlike an eCRF, which primarily captures participant-level clinical data, an eTMF generally contains study documentation, such as delegation logs, training records, monitoring reports, correspondence and regulatory documents. These may include personal data of investigators, study personnel and, in some cases, participants.
Suppose the sponsor delegates TMF management to a CRO, which contracts a technology provider to host the eTMF.
For the sponsor-controlled TMF processing:
The sponsor is the controller.
The CRO is the processor, managing the relevant documents on the sponsor’s behalf.
The eTMF provider is generally the subprocessor, hosting and maintaining the system.
The CRO's contractual relationship with the technology provider does not, by itself, change the GDPR roles.
Specific retention, archiving and regulatory responsibilities must nevertheless be assessed, particularly where the CRO or another party has independent legal obligations.
Make contracts reflect reality
Once roles are understood, agreements should address the relevant responsibilities. For controller–processor relationships, Article 28 GDPR sets specific contractual requirements, including instructions, confidentiality, security, subcontracting, assistance and return or deletion of data. International transfer arrangements may be needed in addition.
Where the CRO appoints a subprocessor, the sponsor's authorisation is required, and the CRO must ensure that the relevant data protection obligations are imposed on that subprocessor.
Contracts should connect to operational evidence: vendor qualification, access management, incident handling, system changes and oversight. A detailed DPA cannot compensate for a relationship that nobody has mapped or a subprocessor chain that nobody monitors.
Responsibility follows the data
The phrase captures a practical point: a change of system, supplier or location does not make the data protection questions disappear. Every new recipient or access arrangement should trigger a clear understanding of purpose, role, safeguards and accountability.
A well-managed vendor landscape is not defined by the number of signed agreements. It is defined by whether the sponsor can explain the processing chain, show that responsibilities are appropriate and demonstrate that the agreed protections operate in practice.
Key references: GDPR Articles 4(7)–(8), 24, 26, 28 and 32; EDPB Guidelines 07/2020 on controller and processor concepts; ICH E6(R3) Good Clinical Practice.