Clinical Trial Sponsors outside the EU - IPRS

(1)and 3

(2)(b) of the GDPR, does the GDPR apply to a clinical trial sponsor based outside of the EU if it is conducting studies in the EU (e.g. in Slovenia)? To begin with, in Slovenia the national legislation implementing the GDPR has not been adopted yet. The national legislation, which regulates clinical trials, does not define the role of the sponsor in the light of data protection rules. In accordance with this legislation, the sponsor is a business entity or an individual who assumes responsibility for initiating, conducting, or financing a clinical trial of a medicinal product. Thus, the sponsor typically acts as a controller of personal data. Article 3 of the GDPR defines the territorial scope of the Regulation on the basis of two main criteria: the “establishment” criterion, as per Article 3

(1), and the “targeting” criterion as per Article 3

(2). Where one of these two criteria is met, the relevant provisions of the GDPR will apply to relevant processing of personal data by the controller or processor concerned. Article 3

(1)of the GDPR provides that the “Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.” In determining the territorial scope of the GDPR, geographical location will be important under Article 3

(1)with regard to the place of establishment of the controller itself or any business presence of a non-EU controller. However, geographical location is not important for the purposes of Article 3

(1)with regard to the place in which processing is carried out, or with regard to the location of the data subjects in question. Therefore, pursuant to Article 3

(1)of the GDPR, the GDPR would apply if the clinical trial sponsor based outside the EU had at the same time an establishment in the EU. The GDPR does not provide a definition of “establishment” for the purpose of Article 3. However, Recital 225 clarifies that an “[e]stablishment implies the effective and real exercise of activities through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.” Article 3

(2)of the GDPR provides that “this Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (

1. a)the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (
2. b)the monitoring of their behaviour as far as their behaviour takes place within the Union.” In our opinion, Article 3

(2)(b) of the GDPR would apply to a clinical trial sponsor based outside the EU if the studies related to a patient - data subject in the EU and, as a cumulative criterion, the studies took place within the territory of the EU. You can find more detailed guidance on territorial scope of the GDPR in the European Data Protection Board (EDPB) Guidelines 3/2018, available at https://edpb.europa.eu/our-work-tools/our-documents/riktlinjer/guidelines-32018-territorial-scope-gdpr-article-3-version_en. Is patient data processed under a clinical trial considered "personal data" even if it is pseudonymized? Yes. In accordance with Article 4

(5)of the GDPR pseudonymisation means “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person”. Recital 26 further explains that “the principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information, should be considered to be information on an identifiable natural person”. Therefore, pseudonymized data are still considered personal data. Only anonymized data are not subject to the GDPR provisions. Kind regards, Mojca Prelesnik, Information Commissioner of the Republic of Slovenia O NAS Informacijski pooblaščenec Dunajska cesta 22 1000 Ljubljana, Slovenija Zemljevid (vir: najdi.si) Telefon: 01 230 97 30 Poštni in varni e-predal: gp.ip(at)ip-rs.si Odgovorna oseba za informacije za medije: dr. Jelena Virant Burnik. Kontakt za medije: Barbara Repovš, mediji@ip-rs.si ali 01 230 97 30 Prijava kršitev (Navodila in obrazci) URADNE URE PON - PET 9.00 - 12.00 POVEZAVE Informacije javnega značaja Priročniki in smernice Obrazci Politika zasebnosti Informacije o obdelavi osebnih podatkov Izjava o dostopnosti Podpora za majhna podjetja Pravice posameznikov Prijava na prejemanje e-novic Informacijski pooblaščenec | 2026