Transparency is a legal requirement under GDPR. It is the controller's responsibility to ensure that research participants are informed about how their personal data is being collected and used.
This is usually undertaken through an organisation or trial-specific Privacy Notice or Transparency Notice, which should be provided to research participants before processing their personal data.
It should be transparent, accessible and use plain language. It should include information on:
- The purpose for which a participant's personal data will be used
- how long personal data will be retained
- what a participant's rights are in terms of the processing their personal data
- where the data will be stored
- who will have access to the personal data and in what form, including whether it will be shared with other organisations and if these organisations are in the UK, EU or worldwide
Clinical trials will also provide privacy information in, for example:
- participant information sheets
- informed consent forms
- consultee advice forms
- study websites
- newsletters
- social media
- any other information provided by health care professionals at relevant study visits
It's good practice to keep participants informed about what is happening with their data, and plan for this at start of your study.
You should review the data flow and processing for your application and make sure that it matches the information provided to the participant.
If your privacy and/or patient information does not match the actual processing and flow of your data, your application may be rejected until you can provide a suitable legal basis for processing under GDPR and CLDC.