Patient rights in clinical trials: data protection explained

What counts as confidential patient data in a clinical trial?

Confidential patient data is health information that is linked to an identifier such as your name, address, or a national health service number. It includes your medical history, test results, and any samples or scans collected during the study^[1]. Under HIPAA rules that apply to US-based research, health information used or disclosed for a study is protected in a similar way once it can be linked back to an individual patient^[2].

Once your care team or a research team records this information for a study, it becomes "research data" that is combined with information from other participants. You can ask the research team which specific parts of your health record will be looked at before you agree to take part. You can also ask whether information from your past medical records, not just data collected specifically for the trial, will be reviewed as part of the study. Knowing this scope in advance helps you judge how much of your personal history will effectively become part of the study record^[1].

Who is the data controller for a trial, and what does that mean for you?

The trial sponsor acts as the data controller because the sponsor decides what information is collected and how it will be used^[1]. In one large UK-based trial, for example, the sponsoring university was named as the data controller. That trial's central coordinating office used the participant's name and health number only to keep track of care and to check the quality of the study^[3].

This means you have one identifiable organisation responsible for your data throughout the study, and you can ask that organisation what it does with your information and why^[3].

What is the legal basis for processing your health data under the GDPR?

Research organisations that are publicly funded must show that using your personal data is in the public interest before they may process it for research. One large trial cited GDPR Article 6(1)(e) (processing necessary for a task carried out in the public interest) together with Article 9(2)(j) (processing of special categories of data, including health data, for research purposes) as its legal basis^[3].

The GDPR also states that the processing of personal data should be designed to serve people, and that the right to data protection is not an absolute right. It has to be balanced against other fundamental rights, in accordance with the principle of proportionality^[4].

At EU level, the Clinical Trials Regulation (EU) No 536/2014 requires the sponsor and investigator to record, process, store, and handle your data so that it can be accurately reported and verified. This must be done while preserving the confidentiality of your records, under Article 47 and Article 56 of the Regulation. This means two EU laws apply to you at the same time: the Clinical Trials Regulation, which governs how the trial is run, and the GDPR, which governs how your personal data is processed^[5]. For participants in the United States, an additional framework applies: HIPAA governs how identifiable health information held by hospitals and research institutions may be used or disclosed for research purposes. It typically requires either a signed authorisation from you or a specific waiver approved by an oversight board^[2].

How is your data pseudonymised or de-identified during a study?

In practice, research teams commonly "code" the personal information collected about you, which means your data is not directly matched to your name in the working study file. This coded, or pseudonymised, information is stored in a secure study file. Your consent form should describe in more detail how your data is protected and, if relevant, how it may be shared^[6].

When scans or other records are shared outside the immediate care team for research purposes, identifiers are typically removed from these documents before sharing^[3]. The people who later analyse the combined research data are generally not able to identify you individually and cannot see your name, address, or contact details^[6]. Under HIPAA, information can also be treated as "de-identified" once specific identifying details, such as names, addresses, and dates directly tied to you, have been removed according to a defined standard. After that point, it is no longer considered protected health information^[2].

Some organisations distribute trial data for further scientific research after a study has been published in a pseudo-anonymised form, as required by data protection legislation. This distinction between "pseudonymised" data, where re-identification remains technically possible under controlled conditions, and fully "anonymised" or "de-identified" data, where it is not, is one of the more important technical points to understand when you read a consent form. Understanding which category your data will fall into can help you judge how strong the practical protection against re-identification is likely to be^[7].

Who can see your identifiable information, and who cannot?

A limited group of people connected to the sponsor and to regulatory bodies may look at your medical and research records, but only to check the accuracy of the data collected in the study. Within the sponsor's organisation, access to information that identifies you is normally restricted to people directly involved in running the study follow-up or in auditing how the data was collected^[3].

Information relevant to your ongoing care, such as details about allergies discovered during a study, may be shared with your usual treating doctor. If genetic material such as DNA is collected as part of the trial, it is against the rules for a researcher to use it for anything outside the scope that was approved for the study and explained to you beforehand^[6]. In studies governed by HIPAA, your authorisation form should also specify which categories of staff or outside parties are permitted to receive your identifiable health information, and for what purpose. Checking this section of the form can tell you whether disclosure is limited to the study team itself or extended to outside laboratories, monitoring bodies, or other collaborators^[2].

Before any study can begin, an independent ethics or review committee examines the plan for protecting participants' safety and rights, including how their data will be handled^[6]. In the US system, this independent oversight role is often filled by an institutional review board, which also reviews the specific plan for using and disclosing protected health information before granting approval^[2].

How long is your trial data kept after the study ends?

Retention periods differ for direct identifiers and for the rest of your research data. In one large trial, the sponsor kept participants' direct identifiers, such as names, for up to one year after the study finished^[3].

Type of data	Retention period	Reason
Direct identifiers (e.g. name)	Up to 1 year after study end	Administrative closure of the study[3]
Direct identifiers, participant under 18	Until the participant turns 21	Statute of limitations for minors[3]
Other personal (research) data	At least 25 years after study end	Compliance with relevant legislation[3]

These specific periods come from one named UK trial and are given here as an illustration. The exact retention period for the study you are asked to join will be stated in your own consent documents, and you can ask the research team directly if it is not clear. Long retention periods for research data are generally intended to allow the results to be checked, reproduced, or reanalysed years after a trial has ended. This is one reason why full erasure of research data on request is not always straightforward^[3].

Can your data be shared with other researchers after the trial ends?

Some trial organisations have formal policies to share study data with other qualified researchers once the main results of the study have been published, while protecting patient privacy and confidentiality. Requests to reuse trial data are typically reviewed for their scientific merit and checked against existing patient consent and applicable legal requirements before any data is released^[7].

If you take part in a trial where this kind of data sharing is planned, the possibility should be explained to you in the information you receive before you consent. This way you know that your (pseudonymised) data could later be used in further research on the same disease area. This kind of secondary use is generally presented as a benefit to future patients, since pooling data from several studies can help researchers answer questions that no single trial was large enough to answer on its own. At the same time, this is precisely why it is worth checking, at the consent stage, whether such secondary sharing is limited to specific disease areas or research partners, or left open-ended^[7].

What rights can you exercise, and what happens if you withdraw?

Participation in a clinical trial is voluntary, and you can choose to leave the study at any point^[6]. The GDPR sets out specific rights of the data subject, including the right of access to your data (Article 15), the right to rectification (Article 16), and the right to erasure, also called the "right to be forgotten" (Article 17)^[8].

You also have a right to be informed about how your data is collected and used (Articles 13 and 14) and a right to object to certain types of processing (Article 21)^[8]. If you want to stop receiving trial-related communications, such as newsletters about the study's progress, you can typically opt out at any time by letter, phone, or email, as explained in one large trial's participant information^[3].

Whether erasure of your data is possible once you withdraw from a trial can depend on how far the study has progressed. Some previously collected data may already be needed to preserve the scientific validity of the trial results. Ask the research team what specifically happens to your data if you decide to withdraw, before you sign the consent form^[5]. In studies covered by HIPAA, withdrawing your authorisation for future use of your health information is also possible, though it generally does not affect information that has already been used or disclosed while your authorisation was in effect. In other words, withdrawal usually stops new collection or use of your data going forward, rather than reversing what has already occurred^[2].

What should you ask the research team before you agree to take part?

• Who is the data controller for this specific study, and how can you contact them?^[1]
• Which parts of your existing health records will be accessed for this study?^[1]
• How will your data be coded or pseudonymised, and who can still see identifying details?^[6]
• How long will your identifiable data and your research data each be kept?^[3]
• Will your (pseudonymised) data be shared with other researchers after the trial, and under what conditions?^[7]
• What happens to your data specifically if you withdraw before the study ends?^[5]
• If the study is based in the United States, what does your HIPAA authorisation form say about who may receive your health information and for how long?^[2]

When should you contact the research team or a data protection contact directly?

Contact the research team directly if the consent form does not clearly state who the data controller is, how long your data will be kept, or whether your data will be shared outside the study^[3]. You should also ask before agreeing to take part if you are unsure which of your existing medical records will be reviewed for the study^[1].

If you want to exercise a specific data protection right, such as access to your data or objection to a particular use of it, ask the research team how to submit that request. Your consent documents should identify a contact point for this purpose^[8]. If you are taking part in a US-based study and have questions about your HIPAA authorisation, the institution's research or privacy office is usually the appropriate contact^[2].

Summary

Your data in a clinical trial is protected by two layers of EU rules working together: the Clinical Trials Regulation, which sets confidentiality obligations for the sponsor and investigator, and the GDPR, which gives you specific rights over your personal data and requires a lawful basis for processing it^[5]. In practice, this means your identifiable information is limited to a small group of people, your working data is usually coded, and clear retention periods apply to both your identifiers and your research records^[8].

Before agreeing to take part in any trial, read the data protection section of your consent documents carefully and ask the research team directly about anything that is not fully clear — particularly who controls your data, how long it is kept, and what happens if you decide to withdraw^[3].

1. [1] Patient data and research leaflet (accessed 2 June 2026) — https://www.hra.nhs.uk/planning-and-improving-research/policies-standards-legislation/data-protection-and-information-governance/gdpr-guidance/templates/template-wording-for-generic-information-document/
2. [2] HIPAA Questions and Answers Relating to Research (accessed 2 June 2026) — https://www.hopkinsmedicine.org/institutional-review-board/hipaa-research/faq-research
3. [3] What about my data privacy? (accessed 2 June 2026) — https://www.recoverytrial.net/uk/study-faq/data-privacy
4. [4] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation) (accessed 2 June 2026) — https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
5. [5] Questions and Answers on the interplay between the Clinical Trials Regulation and the General Data Protection Regulation (accessed 2 June 2026) — https://health.ec.europa.eu/document/download/c3042973-b36d-4094-a1fb-a6fc980f065e_en
6. [6] Clinical Trials (accessed 2 June 2026) — https://my.clevelandclinic.org/clinical-trials
7. [7] Data Sharing – A Vital Part Of EORTC's Remit (accessed 2 June 2026) — https://www.eortc.org/blog/2018/05/07/data-sharing-a-vital-part-of-eortcs-remit/
8. [8] General Data Protection Regulation (GDPR) – Legal Text (accessed 2 June 2026) — https://gdpr-info.eu/