General Data Protection Regulation (GDPR)
The EU regime for processing personal data: lawful basis, the data-protection principles, heightened conditions for health data as a special category, security of processing, breach notification, data-subject rights, and restrictions on transfers outside the EU.
What this does not cover
stated in the document's own scope- It governs personal data, not data in general. Recital 26 states that it does not apply to anonymous information, and records about products, batches or equipment that identify no one fall outside it.
- It does not set data-integrity expectations for GxP records; those come from the GMP and GCP frameworks, which run in parallel.
- Under Article 2(2)(d), processing by competent authorities to prevent, investigate, detect or prosecute criminal offences is outside it.
- It applies to controllers and processors outside the EU only where Article 3 brings them in — chiefly by offering goods or services to people in the EU or monitoring their behaviour there.
Always verify against the current published text before relying on it for a submission or inspection.
Overview
The General Data Protection Regulation sets the EU rules for processing personal data — any information relating to an identified or identifiable person. It lays down the principles every processing operation must meet, the lawful bases on which processing may rest, the stricter conditions for special categories of data such as data concerning health and genetic data, the rights of the people the data describe, and the duties of controllers and processors. In a regulated life-sciences organisation it reaches clinical-trial participant data, safety case reports, employee records and contact data for healthcare professionals.
Scope & applicability
Any processing of personal data by an organisation established in the EU, or targeting individuals in the EU. In regulated life sciences it reaches clinical-trial data, pharmacovigilance case records, and employee and healthcare-professional data — running alongside GxP obligations rather than instead of them, which is where the retention-versus-erasure tension arises.
Legal basis & how it acquires force
It is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, published in OJ L 119 of 4 May 2016. As a Regulation it is binding in its entirety and directly applicable in all Member States, without national transposition, and under Article 99 it has applied from 25 May 2018. It repealed Directive 95/46/EC with effect from the same date. Member States keep some room to legislate — Article 9(4), for example, lets them maintain or introduce further conditions for genetic, biometric and health data — so national law has to be read alongside it.
Document structure
| Part | Covers |
|---|---|
| Chapters I–II — General provisions and principles | Material and territorial scope (Articles 2 and 3), definitions (Article 4), the processing principles, lawful bases and the special-category rules in Article 9 |
| Chapter III — Rights of the data subject | Transparency, access, rectification, erasure under Article 17 and its exceptions, restriction, portability and objection |
| Chapter IV — Controller and processor | Processor contracts (Article 28), records of processing (Article 30), breach notification (Articles 33 and 34), impact assessments (Article 35) and data protection officers (Article 37) |
| Chapter V — Transfers to third countries | The conditions under which personal data may leave the EU or go to international organisations |
| Chapters VI–VIII — Supervision, cooperation and remedies | Independent supervisory authorities, the consistency mechanism, and the administrative fines in Article 83 |
| Chapters IX–XI — Specific situations and final provisions | Including Article 89 safeguards for scientific research, and the entry-into-force and repeal provisions |
Key requirements
- Article 5 — the processing principles, including purpose limitation, data minimisation and storage limitation
- Article 6 lawful basis and Article 9 conditions for processing health and other special-category data
- Article 32 — security of processing appropriate to risk, including pseudonymisation and encryption where appropriate
- Article 33 — notification of a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours
- Chapter V — transfers to third countries, and Article 89 safeguards and derogations for scientific research
Implementation tips
- Resolve the retention conflict as policy, not per request: GxP and clinical-trial law impose retention periods that a Article 17 erasure request cannot override, and the lawful basis and retention schedule should state that in advance
- Consent under GDPR and informed consent to participate in a trial are different instruments — conflating them is the most common design error in clinical data protection
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
The Regulation anticipates regulated health activity directly. Article 9(2)(i) allows special-category data to be processed for reasons of public interest in public health, naming high standards of quality and safety of medicinal products and medical devices, where Union or Member State law provides safeguards. Article 89 governs processing for scientific research. Retention obligations in GxP and clinical-trial law interact with Article 17, whose paragraph 3 disapplies the right to erasure where processing is needed to comply with a legal obligation, for public-health reasons or for research under Article 89.
Regulation (EU) 2016/679: frequently asked questions
Quick answers to common questions about Regulation (EU) 2016/679.
How quickly must a personal data breach be notified?
Article 33 requires the controller to notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to individuals. A notification made later must give reasons for the delay.
Can a trial participant require their data to be erased?
Not where an exception in Article 17(3) applies. The right to erasure does not apply to the extent processing is necessary to comply with a legal obligation, for public-health reasons under Article 9(2)(h) and (i), or for research under Article 89(1) where erasure would seriously impair that research.
Is health data treated differently?
Yes. Data concerning health is a special category under Article 9. Its processing is prohibited unless one of the conditions in Article 9(2) applies, such as explicit consent, public interest in public health, or research with appropriate safeguards.
What are the maximum fines under the GDPR?
Article 83 sets two tiers: up to EUR 10 million or 2 % of total worldwide annual turnover, and up to EUR 20 million or 4 %, in each case whichever is higher, depending on which provisions were infringed.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.