The Spanish Data Protection Commissioner (“AEPD”) has recently approved the “Code of conduct regulating the processing of personal data in the field of clinical trials and other clinical research and pharmacovigilance” (“the Code”). The Code has been published in collaboration with Farmaindustria, the association that brings together the majority of pharmaceutical companies established in Spain.

It is the first sectorial code of conduct approved in Spain since the GDPR came into force, as well as the first code approved in the EU in this field. Thus, while the territorial scope is limited to Spain, it aspires to be a benchmark at the European level.

The Code regulates how sponsors of clinical trials and contract research organisations (CRO's) decide to adhere to, and implement GDPR regulations within the scope of clinical trials, as well as during the fulfillment of the obligations imposed by pharmacovigilance regulations, for the detection and prevention of adverse effects of medicines already on the market. 

The Code addresses several aspects in relation to data processing activities in clinical research, and specifically in clinical trials. For example; 

• establishing protocols facilitating the application of the GDPR; 
• providing details on the codification of the data; and
• regulating in detail the responsibility of each participant on the clinical trial.

In respect of pharmacovigilance, it contains among other important aspects, the establishment of protocols for the collection of information on possible adverse reactions, depending on who makes the notification. 

The Code also establishes a mediation procedure, voluntary and free of charge, which allows for an agile response to possible claims made by interested parties against member entities.

The Code is available in Spanish in the AEPD website.