Personal data management (GDPR)

Personal data management (GDPR) in clinical studies

The EU General Data Protection Regulation (GDPR) governs how personal data may be processed within the EU.

In clinical studies, it is important that all parties handle personal data in ways that protect the integrity and rights of study participants.

Special consideration must be given when personal data are transferred to organisations outside the EU/EEA, where the GDPR does not apply.

More information about data protection External link. is available on the website of the Swedish Authority for Privacy Protection (IMY).

The support we offer

Clinical Studies Sweden has produced reports and a contract template to support personal data management.

Templates

Clinical Studies Sweden has developed a contract template for personal data management under joint personal data responsibility, it's called 'Instructions for the Joint Personal Data Protection Agreement'.

Instruktioner till Avtal för gemensamt personuppgiftsansvar (In Swedish) pdf, 257 kB. (pdf, 257 kB)

Contract on joint personal data management in clinical research

Clinical Studies Sweden has developed a template for agreements on joint controllership in clinical research. The template facilitates the creation of clear and consistent agreements between research organisations.

The Swedish version of the template should be used when all parties have their main establishment in Sweden. The English version should be used when one or more parties have their main establishment outside Sweden.

• Contract for joint personal data responsibility in clinical research (Swedish version) (In Swedish) docx, 151 kB. (docx, 151 kB)
• Contract on joint personal data responsibility in clinical research (English version) docx, 156 kB. (docx, 156 kB)

Our templates are a complement to existing templates for personal data processing in assistance situations, known as PUB contracts External link., which have been developed by The Swedish Association of Local Authorities and Regions (SALAR), for example.

Advisory reports

Clinical Studies Sweden has produced reports on the interpretation of the GDPR and the processing of personal data when conducting clinical studies.

Third-country transfers in clinical research – an assessment of specific scenarios
The report addresses questions about what constitutes a transfer of personal data to a third country, for which types of processing the General Data Protection Regulation (GDPR) applies, and what obligations this entails for the parties involved. The report was published in 2024.

Report: Tredjelandsöverföring vid klinisk forskning - en utredning avseende specifika scenarion (In Swedish) pdf, 536 kB. (pdf, 536 kB)

Personal data responsibility in clinical research
The report ‘Personuppgiftsansvar vid klinisk forskning’ (Personal data responsibility in clinical research) also includes a guide on how to assess personal data responsibility in different research scenarios.

Report: Personuppgiftsansvar vid klinisk forskning (In Swedish) pdf, 2 MB. (pdf, 2 MB)

Access to healthcare data for research purposes
The report ‘Åtkomst till hälsodata för forskningsändamål’ (Access to healthcare data for research purposes) describes the legal conditions for the disclosure of personal data from the healthcare sector for clinical research.

Report: Åtkomst till hälsodata för forskningsändamål (In Swedish) pdf, 658 kB. (pdf, 658 kB)