Portability and Accountability Act) requirements. This SOP protects the rights of trial participants, ensures lawful data processing, and maintains global regulatory compliance while safeguarding personal health information (PHI) and personally identifiable information (PII).

Scope

This SOP applies to all clinical trial stakeholders handling subject data, including sponsors, CROs, investigators, data managers, monitors, and IT administrators. It covers electronic and paper systems storing or processing subject data, including EDC, CDMS, eTMF, safety databases, laboratory systems, and ISF. It governs anonymization, pseudonymization, data subject rights, cross-border transfers, breach management, and retention.

Responsibilities

• Principal Investigator (PI): Ensures subject confidentiality and adherence to informed consent privacy clauses.
• Data Manager: Implements anonymization/pseudonymization procedures and maintains subject ID logs separately.
• System Owner: Ensures data systems have privacy-compliant configurations, encryption, and access control.
• Sponsor/CRO: Ensures cross-border transfers comply with GDPR and HIPAA regulations and approves Data Processing Agreements (DPAs).
• QA Officer: Audits systems and verifies compliance with privacy regulations.
• IT Administrator: Maintains encryption, access logs, and breach notification processes.

Accountability

The sponsor is accountable for global compliance with privacy laws. PIs are accountable for local compliance, while CROs are accountable for vendor oversight. QA ensures independent verification through routine audits.

Procedure

1. Data Collection and Consent
Collect only data specified in the protocol and informed consent.
Ensure consent forms describe use, storage, transfer, and retention of data.
Record subject consent in Consent Log (Annexure-1).

2. Anonymization and Pseudonymization
Replace subject identifiers with unique IDs (e.g., Subject-001).
Maintain Subject ID Log separately in a secure, access-controlled location.
Apply pseudonymization for datasets requiring re-identification for safety follow-up.

3. Access Control
Restrict access to subject data based on role and necessity.
Implement multi-factor authentication for systems containing PHI/PII.
Review access logs monthly and document in Access Control Log (Annexure-2).

4. Data Minimization and Retention
Collect only minimum required data per trial objectives.
Retain subject data for 15–25 years based on jurisdiction.
Document retention schedules in Data Retention Log (Annexure-3).

5. Cross-Border Data Transfers
Conduct transfer impact assessments before sending data outside the originating country.
Use Standard Contractual Clauses (SCCs) or equivalent safeguards under GDPR.
Ensure HIPAA compliance for transfers involving PHI from the US.

6. Data Subject Rights
Implement processes for responding to subject rights: access, correction, deletion, restriction, and portability.
Document all requests and responses in Data Subject Rights Log (Annexure-4).

7. Breach Notification
Any data breach must be reported to sponsor and regulator within 72 hours (GDPR) and to affected individuals as per HIPAA.
Record incidents in Breach Log (Annexure-5).
Perform root cause analysis and CAPA implementation.

8. Vendor Oversight
Ensure all vendors sign DPAs covering GDPR/HIPAA compliance.
Verify vendor privacy practices during qualification audits.

9. Archiving
Archive privacy-related records, consent logs, and access records in TMF/ISF.
Ensure archives are access-controlled and retrievable for inspection.

Abbreviations

• SOP: Standard Operating Procedure
• PI: Principal Investigator
• CRO: Clinical Research Organization
• QA: Quality Assurance
• TMF: Trial Master File
• ISF: Investigator Site File
• PHI: Protected Health Information
• PII: Personally Identifiable Information
• GDPR: General Data Protection Regulation
• HIPAA: Health Insurance Portability and Accountability Act
• DPA: Data Processing Agreement
• SCC: Standard Contractual Clauses

Documents

1. Consent Log (Annexure-1)
2. Access Control Log (Annexure-2)
3. Data Retention Log (Annexure-3)
4. Data Subject Rights Log (Annexure-4)
5. Breach Log (Annexure-5)

References

• ICH E6(R2) – Good Clinical Practice
• GDPR – General Data Protection Regulation
• HIPAA – US Health Privacy Rules
• EMA – Data Protection in Clinical Trials
• CDSCO – Patient Privacy Requirements

Version: 1.0

Approval Section

Prepared By	Rajesh Kumar, Data Privacy Officer
Checked By	Sunita Reddy, QA Officer
Approved By	Dr. Anil Sharma, Principal Investigator

Annexures

Annexure-1: Consent Log

Date	Subject ID	Consent Type	Signed By	Witness
10/09/2025	SUBJ-101	Privacy/GDPR	Subject	Ravi Kumar
11/09/2025	SUBJ-102	HIPAA	Subject	Meena Sharma

Annexure-2: Access Control Log

Date	User	System Accessed	Role	Authorized By
12/09/2025	CT-USER-310	EDC	Data Entry	PI
13/09/2025	CT-USER-315	Safety DB	QA Reviewer	Sponsor

Annexure-3: Data Retention Log

Date	Dataset	Retention Period	Storage Location	Reviewed By
14/09/2025	Trial A CRFs	15 years	eTMF	QA Officer
15/09/2025	Trial B Safety DB	25 years	Secure Archive	Sponsor

Annexure-4: Data Subject Rights Log

Date	Subject ID	Request Type	Action Taken	Completed By
16/09/2025	SUBJ-103	Access	Provided copy	Data Manager
17/09/2025	SUBJ-104	Deletion	Executed	System Owner

Annexure-5: Breach Log

Date	System	Description	Action Taken	Reported To
18/09/2025	EDC	Unauthorized access attempt	Account locked	QA + Sponsor
19/09/2025	Safety DB	Phishing attempt detected	Blocked	Regulator

Revision History

Revision Date	Revision No.	Revision Details	Reason for Revision	Approved By
26/08/2025	00	Initial version	New SOP creation	Head, Clinical Research

For more SOPs visit: Pharma SOP