GDPR (Regulation (EU) 2016/679) Audit-Readiness Rubric — Data Protection Law
What this is: relevant to Regscribe's pharma/biotech customers because clinical trial data is, almost by definition, "special category" personal data (health, and often genetic) under EU law. GDPR is a legal data-protection framework — consent, individual rights, breach notification, cross-border transfer — not a generic information-security management system. It is complementary to, and distinct from, ISO 27001 (already covered — see iso27001-rubric.md): ISO 27001 asks "is data secured?"; GDPR asks "do you have the legal right to process this data, have you told people, can they exercise rights over it, and did you tell the regulator fast enough when something went wrong?" A clinical trial sponsor can pass an ISO 27001 audit and still be in breach of GDPR (e.g. no valid Article 9 condition for processing health data, no DPIA, missed the 72-hour breach window). This rubric deliberately does not re-list generic infosec controls (encryption, access control, logging) already scored under ISO 27001 — it only scores GDPR's distinct legal obligations.
Sourcing note: GDPR is a free, public EU regulation — full text used directly from EUR-Lex, CELEX 32016R0679 (eur-lex.europa.eu), no paywall, no paraphrase-only workaround needed (unlike ISO 27001). Practical/interpretive guidance cross-checked against the European Data Protection Board (EDPB, edpb.europa.eu) and the UK Information Commissioner's Office (ICO, ico.org.uk). Real enforcement data below is sourced from the CMS Law GDPR Enforcement Tracker Report — Life Science & Healthcare sector (cms.law) and a specific CNIL (French DPA) decision against IQVIA reported by Ropes & Gray-style industry commentary; see the Gaps/follow-ups section for what is and isn't independently verified. UK-specific enforcement is technically "UK GDPR" (the retained, near-identical post-Brexit version of the same regulation) rather than EU GDPR proper — flagged inline where it applies.
Rubric legend
Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance → Common failure pattern (real enforcement data, where found)
1. Core principles (Article 5)
| # | Requirement | Citation | Evidence of compliance | Common failure pattern |
|---|---|---|---|---|
| 1 | Processing must be lawful, fair, and transparent to the data subject | GDPR Art. 5(1)(a) | Privacy notice/patient information sheet given at consent; documented legal basis per processing activity | IQVIA (CNIL, France, health data warehouses): patient information notices found inaccurate, and pharmacy customers not told their data was transmitted to IQVIA at all — a direct transparency failure |
| 2 | Data collected for specified, explicit, legitimate purposes and not further processed incompatibly with those purposes (purpose limitation) | GDPR Art. 5(1)(b) | Protocol/consent form stating the specific research purpose(s); documented compatibility assessment before any secondary use (e.g. reuse for a different study) | |
| 3 | Data minimization — adequate, relevant, and limited to what is necessary for the purpose | GDPR Art. 5(1)(c) | Data collection fields mapped to protocol objectives, justifying each field collected; CRF (case report form) review evidencing no superfluous fields | Finland online-pharmacy fine (€1.1M): violation of data minimisation — third-party web tools given access to more personal data than necessary |
| 4 | Accuracy — data kept accurate and up to date, with erasure/rectification of inaccurate data without delay | GDPR Art. 5(1)(d) | Data-correction/query-resolution procedure (may overlap with GCP data-management SOPs) | |
| 5 | Storage limitation — kept in identifiable form no longer than necessary for the purpose | GDPR Art. 5(1)(e) | Documented retention schedule per data category, reconciled against the GCP/regulatory retention period that overrides it (see row 15 below) | Spain hospital MRI case (€1.2M): non-compliance with retention/processing principles found where scan data was deleted immediately, preventing patient data retrieval — illustrates that both over-retention and improper deletion can trigger findings |
| 6 | Integrity and confidentiality — appropriate security against unauthorized/unlawful processing, loss, destruction, damage | GDPR Art. 5(1)(f) | Cross-reference to ISO 27001 rubric — this principle is the legal hook for security controls, but the controls themselves are scored there, not duplicated here | UK ransomware case (€3.5M): customer account lacking MFA exploited; UK DNA-data breach case (€2.7M): insufficient technical/organisational measures, delayed detection — both are Art. 5(1)(f)/Art. 32 findings |
| 7 | Accountability — the controller must be able to demonstrate compliance with all of the above, not just achieve it | GDPR Art. 5(2) | The documentation set in Section 6 below, taken as a whole, is the evidence for this principle |
2. Legal basis for processing (Article 6) and special category health/genetic data (Article 9)
| # | Requirement | Citation | Evidence of compliance | Common failure pattern |
|---|---|---|---|---|
| 8 | A valid Article 6 legal basis must be identified and documented for every processing activity (consent, contract, legal obligation, vital interests, public task, or legitimate interests) | GDPR Art. 6(1)(a)-(f) | Legal-basis determination recorded per processing activity, typically inside the ROPA (row 20) | |
| 9 | Processing of health data, genetic data, or biometric data (all directly implicated by clinical trial data) is prohibited by default and requires a specific Article 9(2) condition — most commonly explicit consent (9(2)(a)), or the scientific-research derogation (9(2)(j)) read together with Member State law and appropriate safeguards | GDPR Art. 9(1), Art. 9(2)(a), Art. 9(2)(j) | Explicit, separately-documented consent to the processing of health/genetic data (distinct from GCP/Clinical Trials Regulation informed consent — see note below); or a documented Art. 9(2)(j) scientific-research basis plus the Art. 89(1) safeguards it requires (e.g. pseudonymisation) | |
| 10 | GDPR consent to data processing and GCP/Clinical Trials Regulation informed consent to trial participation are legally distinct instruments — satisfying one does not automatically satisfy the other, and EDPB guidance explicitly warns against conflating them | EDPB guidance on the interplay of the Clinical Trials Regulation and GDPR (2019/2021); GDPR Art. 7 (conditions for consent) | Two distinguishable consent artifacts (or a single form with clearly separated sections) — one for trial participation (GCP), one for data processing (GDPR) — each independently withdrawable | Common EDPB-flagged confusion: sponsors treating a single ICF (informed consent form) as covering both, leaving no valid GDPR basis if a participant withdraws only the data-processing consent |
| 11 | Where a participant's capacity may be impaired by their medical condition, consent may not be "freely given" and the controller should not rely on Art. 9(2)(a) consent as the sole basis — a power-imbalance assessment is required, but patient status alone does not preclude valid consent | EDPB Guidelines on consent; GDPR Art. 4(11), Art. 7(4) | Documented capacity/power-imbalance assessment in the trial's data protection documentation, especially for vulnerable-population studies |
3. Data subject rights (Articles 12-22) — and the erasure/retention tension
| # | Requirement | Citation | Evidence of compliance | Common failure pattern |
|---|---|---|---|---|
| 12 | Data subjects have rights of access (copy of their data), rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection; requests must generally be actioned within one month | GDPR Art. 15 (access), Art. 16 (rectification), Art. 17 (erasure), Art. 18 (restriction), Art. 20 (portability), Art. 21 (objection) | Data subject rights request (DSAR) procedure with a one-month response SLA; log of requests received/actioned | |
| 13 | Clinical-trial-specific nuance: the right to erasure does NOT apply where processing is necessary for compliance with a legal obligation, for reasons of public interest in public health, for scientific research purposes (subject to Art. 89(1) safeguards), or for the establishment/exercise/defence of legal claims — all of which routinely apply to trial data that GCP/GMP/national law requires be retained (commonly 15-25 years for trial master files) | GDPR Art. 17(3)(b), (c), (d), (e) | Written policy explicitly stating that erasure requests on trial data are assessed against, and may be lawfully refused under, Art. 17(3) — with the specific retention obligation (e.g. ICH GCP E6, EU CTR record-retention rules) cited as the basis, communicated back to the data subject | This is the single most consequential nuance for pharma/biotech: a naive "always honour erasure requests" policy would itself be a GCP/regulatory-retention violation. Conversely, refusing erasure with no documented Art. 17(3) basis is a GDPR violation. Both failure directions are real and must be scored explicitly. |
| 14 | Right to restriction of processing (Art. 18) is the practical middle path often used in trials in place of erasure — data is "frozen" (retained but not further processed) pending resolution, satisfying the participant's objection without breaching retention law | GDPR Art. 18 | Documented restriction-of-processing workflow as the default response where Art. 17(3) blocks full erasure | |
| 15 | Right to object (Art. 21) to processing based on legitimate interests or public task; not absolute where compelling legitimate grounds override the individual's interest, or where necessary for legal claims | GDPR Art. 21 | Objection-handling procedure with documented balancing-test outcomes |
4. Key organizational requirements
| # | Requirement | Citation | Evidence of compliance | Common failure pattern |
|---|---|---|---|---|
| 16 | A Data Protection Impact Assessment (DPIA) is mandatory before processing likely to result in high risk to individuals — explicitly including large-scale processing of special category data (health/genetic), which most multi-site clinical trials meet by scale alone | GDPR Art. 35(1), Art. 35(3)(b) | Completed DPIA per trial/study (or per platform, if reused across studies), covering necessity/proportionality assessment, risk identification, and mitigating measures, signed off before processing begins | |
| 17 | A Data Protection Officer (DPO) must be appointed where core activities consist of large-scale processing of special category data — pharmaceutical sponsors running clinical trials routinely meet this threshold given trial scale and health-data sensitivity | GDPR Art. 37(1)(c), Art. 37-39 | DPO appointment letter/contract; DPO contact details published in the privacy notice; evidence of DPO's independent reporting line to senior management | |
| 18 | Records of Processing Activities (ROPA) must be maintained by both controllers and processors, documenting purposes, categories of data/subjects, recipients, transfers, retention periods, and security measures for each processing activity | GDPR Art. 30(1) (controller), Art. 30(2) (processor) | Maintained ROPA register, one entry per processing activity (e.g. per trial, per vendor system), kept current | |
| 19 | Personal data breaches must be notified to the supervisory authority within 72 hours of becoming aware, unless unlikely to result in risk to individuals; where high risk, affected individuals must also be notified without undue delay | GDPR Art. 33 (authority notification, 72hr), Art. 34 (individual notification) | Breach response procedure with a documented 72-hour clock/escalation path; breach register (including near-misses/assessed-as-low-risk incidents with the risk assessment documented); actual notification records where applicable | UK DNA-data breach case (€2.7M) explicitly cited delayed breach detection and inadequate DPA notification as an aggravating factor alongside the underlying security failure — i.e. the notification failure was fined on top of, not instead of, the security failure |
5. Cross-border transfer requirements (Chapter V) — relevant for multinational trials
| # | Requirement | Citation | Evidence of compliance | Common failure pattern |
|---|---|---|---|---|
| 20 | Transfers of personal data outside the EU/EEA require either an adequacy decision (Commission has determined the destination country provides adequate protection), or appropriate safeguards such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules, or a specific Art. 49 derogation | GDPR Art. 44 (general principle), Art. 45 (adequacy), Art. 46 (safeguards incl. SCCs), Art. 47 (BCRs), Art. 49 (derogations) | Transfer mechanism identified and documented for every cross-border data flow in the trial (e.g. sponsor-to-CRO, EU site-to-US central lab); executed SCCs or BCR approval on file; Transfer Impact Assessment (TIA) for SCC-based transfers post-Schrems II | Common industry pattern (not a specific fine found this session, flagged as unverified quantified data): multinational trials routing data through US-based central labs, EDC platforms, or cloud infrastructure without an executed, trial-specific transfer mechanism on file — often assumed covered by a master vendor agreement that doesn't actually name the specific transfer |
| 21 | Where a vendor/processor claims data is "anonymised" and therefore outside GDPR's scope entirely, that claim must be substantiated by rigorous re-identification-risk analysis (not merely asserted in a contract) — pseudonymised data (e.g. coded/keyed patient IDs) remains personal data and stays fully in scope | EDPB/WP29 Opinion 05/2014 on Anonymisation Techniques (WP216); EDPB Guidelines 02/2026 on anonymisation for clinical trial data (recent, post-dates this rubric's other sourcing — flagged) | Documented anonymisation-vs-pseudonymisation determination for every "de-identified" dataset a vendor supplies, with the underlying test/methodology attached, not just a vendor label | IQVIA / CNIL (France), €5M fine: CNIL reclassified two IQVIA health-data warehouses as holding pseudonymous (not anonymous) data because individuals remained re-identifiable via unique identifiers plus publicly available information — triggering the full GDPR regime (security, transparency, authorization) that IQVIA and its pharmacy-customer sponsors had assumed didn't apply. Directly on-point for clinical trial sponsors relying on a vendor's "anonymised" label. |
Documents/evidence typically needed
Privacy notice/patient information sheet (data-processing specific, distinct from the GCP informed consent form); GDPR-specific consent form or consent section; Data Protection Impact Assessment (DPIA) per trial/platform; Records of Processing Activities (ROPA); Data Processing Agreements with vendors/CROs/central labs (Art. 28 processor terms); Standard Contractual Clauses or BCR documentation plus Transfer Impact Assessments for non-EEA transfers; DPO appointment record; breach response procedure and breach register; data subject rights request (DSAR) procedure and log; documented retention schedule reconciling GDPR storage-limitation with GCP/GMP/national trial-record-retention law; anonymisation/pseudonymisation determination records for any vendor-supplied "de-identified" dataset.
Pharma/biotech relevance
Clinical trial data is health data (and often genetic data) by definition, so Article 9's special-category rules apply directly — this is not an edge case for the sector, it's the baseline. Two tensions are specific to this industry and worth flagging prominently in any AI-driven gap analysis: (1) GDPR consent vs. GCP informed consent are different instruments that are routinely conflated in practice (Section 2, row 10); (2) the right to erasure directly conflicts with GCP/GMP/national-law retention mandates, and the correct answer is neither blanket refusal nor blanket compliance but a documented Art. 17(3) assessment (Section 3, row 13). Both are genuine, well-documented friction points in EDPB guidance and industry commentary, not theoretical.
Gaps/follow-ups
- The EDPB Guidelines 02/2026 on anonymisation for clinical trial data are referenced above (row 21) via secondary industry commentary (iliomadhealthdata.com); the primary EDPB text itself was not independently fetched/verified this session — recommend pulling the primary EDPB PDF before this goes into production scoring.
- The specific figures for the IQVIA/CNIL decision (€5M fine, 26 May 2026, four named breaches) come from a single secondary-source (industry blog) summary, not the primary CNIL décision text — flagged as unverified against the primary source; worth confirming against cnil.fr directly given how directly relevant this case is to CRO/vendor oversight for pharma sponsors.
- The CMS Law "Life Science & Healthcare" enforcement figures (265 fines, €32.3M total, per-case amounts for the UK ransomware/DNA-breach/Spain-MRI/Finland-pharmacy cases) come from CMS's own tracker report aggregation, not from re-derivation off primary DPA decision texts — treated as a secondary but reasonably authoritative source (a recognized international law firm's published tracker), consistent with how MHRA-derived secondary aggregation was treated in the GMP/GDP rubric.
- No EU-specific (as opposed to UK) large pharma/biotech GDPR fine was found this session with a verified primary source; the highest-value health-sector cases surfaced (ransomware, DNA breach) are UK cases and technically fall under UK GDPR rather than EU GDPR, though the substantive law is materially identical — noted rather than presented as EU enforcement.
- Unlike the ISO 27001 rubric, a "common failure pattern" column IS populated here, because real, sourced enforcement data was found for GDPR in the health/life-science sector this session — this is a meaningful format difference from
iso27001-rubric.mdand is intentional, not an inconsistency.