Concise, user-friendly guide to clinical-trial data rules
The healthcare and life-sciences landscape is constantly evolving as organisations strive to harness rapid technological advances, write Louisa Muldowney (pictured) and Caroline Keaveny of William Fry.
In parallel, a growing body of innovation and data-driven legislation at both the national and EU levels is emerging to regulate the sector.
Clear and timely guidance is essential for industry players working to keep pace with this dynamic environment.
There have been two noteworthy developments for stakeholders navigating this space.
The National Clinical Trials Oversight Group (NCTOG), established by the Minister for Health to increase the number of clinical trials of investigational medicinal products in Ireland, has published welcome guidelines relating to responsibilities for Data Protection Impact Assessments (DPIAs) during clinical trials.
NCTOG aims to position Ireland as a high-performing country in clinical-trials activity by identifying and addressing challenges to starting clinical trials.
The guidelines on DPIAs follow from the NCTOG's interim recommendations of October last year, which identified that various interpretations regarding data protection arrangements, and, in particular, responsibility for data-protection documentation (such as DPIAs), could cause delays in the clinical-trial sign-off process.
NCTOG has therefore published concise, reader-friendly guidelines that clarify organisations' responsibilities in relation to DPIAs when setting up clinical trials.
The guidelines outline obligations in relation to the following scenarios, whereby DPIAs are required:
- Scenario 1: The sponsor of a clinical trial, as the data controller, is responsible for undertaking the DPIA and for compliance with data-protection laws and regulations, while the trial site (to the extent that it is operating in the capacity of data processor) is not so required.
- Scenario 2: The sponsor and the clinical-trial site are acting as joint controllers. In this instance, both organisations are responsible for undertaking the DPIA and must reach an agreement on how it should be carried out. Similarly, as joint controllers, both organisations would be responsible for ensuring the clinical trial's compliance with data-protection laws and regulations.
It is important to note that the guidance confirms that local/hospital data-protection officers and ethics committees are not responsible for reviewing DPIAs.
However, ethics committees are tasked with reviewing the statement of compliance for the clinical-trial approval process.
Not an impediment
It is also helpful for organisations to be aware that the Data Protection Commission contributed to the work of the NCTOG in a consultative capacity to assist with ensuring that data-protection compliance is not an impediment to clinical trials being conducted in Ireland.
The recent EU Commission consultation on the classification of high-risk AI systems under the AI Act is another important development.
The Commission is seeking input to guide its drafting of guidelines on high-risk AI systems, which it is required to publish in February 2026 in advance of the rules on high-risk AI systems in the AI Act taking effect in August 2026.
The guidelines will address the classification of high-risk AI systems, which are important for product safety under specified EU legislation, and those that are deemed high-risk for their potential impact on human rights.
As several applications of AI in a healthcare setting are contemplated in each of these categories under the AI Act, the consultation is an important opportunity for stakeholders in the healthcare and life sciences sector to seek clarity on real-life applications of AI.
Organisations such as those undertaking clinical trials are encouraged to engage with the consultation to ensure that the commission guidance is practical and informative for the sector.
The consultation is open until 18 July.