EUCROF Code Public Registry

Refers to all activities carried out to design the information and/or Informed Consent Form (ICF) for the study subjects according to the type of study and the applicable regulations.

Development of information for study subjects about study-related data processing

Compliance with the right to information of study subjects

Processing of personal data of study subjects is not envisaged

NA

NA

2021-08-10 13:29:42

2021-08-10 13:29:42

Supplementary patient services that will require processing of the administrative identifying data of the study subjects (e.g., surname, name, postal address, electronic and telephone contact details, bank details, etc.).

Examples of direct-to-patient services are provided in appendix 2 of the Code.

Communication for the delivery of the service.

Providing support to study subjects that is related to the administrative activities that are needed or complementary to the research and are beyond the essential research purpose.

Collection/obtainment, transfer/transmission, storage, de identification (pseudonymisation, anonymization, aggregation, masking, removal of data elements), deletion/destruction.

Depends on the type of service, and will imply combination of minimal health data, e.g., disease name, general information on the individuals’ specific health condition; with identifying data of study subjects, e.g., surname, name, postal address, e-mail address, bank details; transportation services, location, reimbursement costs, etc.

Study subject’s data received to end of service delivery with consequent deletion of identifying data; duration of retention of aggregate data for financial accountability shall be defined by the applicable national laws.

2021-09-01 15:33:17

2026-06-07 12:51:04

Refers to the process of delivering all administration and management services required to maintain a software solution in a fully operational condition according to the terms of the Service Contract to a client. The owner of the source and executable code of the software solution can be a third party, as well as the provider of the IT infrastructure. The applicable usage license conditions shall be included as part of the Service Contract, as well as all conditions of delivery of the software maintenance.

Such software license can be purchased directly by the Sponsor from the IT vendor and used by other CROs according to their Service Contract or purchased by the CRO from the IT vendor who then shall be listed in the sub-processors' list.

Examples of IT platforms are provided in appendix 2 of the Code.

Special note: When a CRO delivers software for class of services (20) Maintenance of Trial Master File, which enables configuring and further operating/managing the TMF, the CRO is subject to the requirements applicable for class of services (16) Provision of IT-managed services.

Establishing tools/mechanisms to perform programmed data flow/processing.

Maintaining integrity, availability and confidentiality of data when processed through the delivered software solution.

Collection/obtainment, storage, deletion/destruction.

• Study subjects: same as for classes of services (4) Data collection and (8) Direct-to-patient services.

• Healthcare professionals: same as for class of services (3) Site selection and contract.

Until termination of consultation and maintenance.

2021-09-02 15:15:39

2026-06-07 13:21:58

Refers to all activities carried out to design the information and/or Informed Consent Form (ICF) for the study subjects according to the type of study and the applicable regulations.

Development of information for study subjects about study-related data processing

Compliance with the right to information of study subjects

Processing of personal data of study subjects is not envisaged

NA

NA

2021-08-10 13:29:42

2021-08-10 13:29:42

Refers to all activities, performed by the CRO, and related to the collection of data required for the purpose of the clinical research. 

• Data collected directly from subjects/proxies.
• Data collection by healthcare professionals through CRF (paper or electronic).
• Data collection from other data sources.

Examples are provided in appendix 2 of the Code. 

Accumulating study databases of health data for conducting research.

Enabling main purpose of research; identification of individuals as study subjects.

Collection/obtainment, transfer/transmission, storage, analysis

Study subjects: data concerning health; photographs and/or video and/or voice recordings not enabling the research subjects to be identified, e.g., masking the face, the eyes, distinctive characteristics, dates pertaining to the conduct of the research, i.e. enrolment date and visit dates; ethnic origin; genetic data strictly necessary to comply with the research objectives or purposes, not enabling the direct or indirect identification; marital status; level of education; socio-professional category; professional life, e.g., occupational exposure; affiliation to social security, (excluding registration number in the national identification directory of natural persons), supplementary insurance (mutual, private insurance); participation in other research or studies, in order to ensure compliance with the inclusion criteria; consumption of tobacco, alcohol and recreational drugs; lifestyles and behaviors, assistance (domestic help, family), physical exercise (intensity, frequency, duration), diet and eating habits, leisure pursuits; lifestyle, e.g., urban, semi-urban, traveler, sedentary; accommodation private house or block of flats, floor, lift, etc.; sex life; vital status, etc.

Pre-screening until study termination/withdrawal or until the study product receives a marketing authorisation or until two years after the final publication of the research results; or where there is no publication, until the final report of the research has been signed.

2021-09-01 15:16:10

2026-06-07 12:05:32

Supplementary patient services that will require processing of the administrative identifying data of the study subjects (e.g., surname, name, postal address, electronic and telephone contact details, bank details, etc.).

Examples of direct-to-patient services are provided in appendix 2 of the Code.

Communication for the delivery of the service.

Providing support to study subjects that is related to the administrative activities that are needed or complementary to the research and are beyond the essential research purpose.

Collection/obtainment, transfer/transmission, storage, de identification (pseudonymisation, anonymization, aggregation, masking, removal of data elements), deletion/destruction.

Depends on the type of service, and will imply combination of minimal health data, e.g., disease name, general information on the individuals’ specific health condition; with identifying data of study subjects, e.g., surname, name, postal address, e-mail address, bank details; transportation services, location, reimbursement costs, etc.

Study subject’s data received to end of service delivery with consequent deletion of identifying data; duration of retention of aggregate data for financial accountability shall be defined by the applicable national laws.

2021-09-01 15:33:17

2026-06-07 12:51:04

Refers to the following activities:

• Development of a Data Management Plan before data management activities start to describe the processes used to manage the data throughout the conduct of the study.
• Process for the development of data collection systems for paper based, electronic and hybrid systems; this covers Electronic Data Capture (EDC) software management from configuration, maintenance and change control during production phase.
• Quality control of the database for paper documents (including defining sample, data and variables to be checked and acceptable threshold as well as actions to be taken according to results).
• Ongoing data cleaning process during the study from the first data captured to the final database locked. This will be done by using program edit checks, data listings review, medical review, quality review and source data verification. This could include reconciliation with external data.
• Data coding process to allow coding medical data received via the medical database per defined coding guidelines; this will include auto encoding and manual encoding process as well as coding reports review.
• Safety Event Database Reconciliation process to reconcile key safety event data variables stored in the study clinical database and in the safety/pharmacovigilance database.
• Data review (interim, final) where quality of the data is evaluated and general decisions are taken to ensure the data transmitted for the analysis will have the appropriate level of quality.
• Database lock and unlock process for interim and final study database to restrict access to the database to avoid non-authorized modification of the clean database before the analyses. This includes extraction of the database in a specific location ensuring proper read only access but also no change happened between the copy of extracted files and the removal of access rights of the database.
• Data transfer process (import and export) including development of transfer specifications to ensure transfers are performed according to specifications with appropriate quality check. Specification may include transfer method, format, frequency, content of the files (names/labels/formats of the variables), test transfer modality, detection of identifiable data including how they will be handled and specific measures to guarantee the security of the transfer of these data.

Data Management class of services may include data engineering (processing data to enable machine to machine data transmission for instance), data science (development of processing algorithms based on artificial Intelligence techniques) and data analyses (restitution of data in a way adapted to their interpretation and support for decision making). A CRO with the appropriate expertise may also offer data anonymisation of personal data of study subjects via secure methods.

Establishing and/or following the established rules for verification of data accuracy, verification proper, data coding, data entry, communication for service delivery.

Verification, control, restoration of data accuracy.

Collection/obtainment, access, analysis, alternation, combining, transfer/transmission, de-identification (pseudonymisation, anonymization, aggregation, masking, removal of data elements),, deletion/destruction, storage

Study subjects: study health data, subject identification code, demographic data.

Setup of study database to database lock/transfer of trial master file, including anonymization of all or part of personal data.

2021-09-01 15:34:35

2026-06-07 12:57:18

Refers to all processes performed in the frame of the financial monitoring of a clinical research program, and in particular the payment of investigational sites: fees and complementary procedures (additional examinations, products etc.).

Arrangement of money transfer, receipt of payment confirmations.

Execution of financial contractual obligations.

Collection/obtainment, transfer/transmission, storage, deletion/destruction, de-identification (pseudonymisation, anonymization, aggregation, masking, removal of data elements).

Healthcare professionals: bank account numbers, contact details, location, position, etc.

End of archiving period for financial accountability.

2021-09-02 14:54:44

2026-06-07 13:03:52

Refers to the process of delivering all administration and management services required to maintain a software solution in a fully operational condition according to the terms of the Service Contract to a client. The owner of the source and executable code of the software solution can be a third party, as well as the provider of the IT infrastructure. The applicable usage license conditions shall be included as part of the Service Contract, as well as all conditions of delivery of the software maintenance.

Such software license can be purchased directly by the Sponsor from the IT vendor and used by other CROs according to their Service Contract or purchased by the CRO from the IT vendor who then shall be listed in the sub-processors' list.

Examples of IT platforms are provided in appendix 2 of the Code.

Special note: When a CRO delivers software for class of services (20) Maintenance of Trial Master File, which enables configuring and further operating/managing the TMF, the CRO is subject to the requirements applicable for class of services (16) Provision of IT-managed services.

Establishing tools/mechanisms to perform programmed data flow/processing.

Maintaining integrity, availability and confidentiality of data when processed through the delivered software solution.

Collection/obtainment, storage, deletion/destruction.

• Study subjects: same as for classes of services (4) Data collection and (8) Direct-to-patient services.

• Healthcare professionals: same as for class of services (3) Site selection and contract.

Until termination of consultation and maintenance.

2021-09-02 15:15:39

2026-06-07 13:21:58

Refers to all processes required to deliver to a client the necessary physical resources to host a software solution, such as secure data centre facilities, including processing capacity, data storage space, internet connectivity, monitoring systems etc. As well as possible virtualisation technologies and/or management resources.

Additional comments and examples are provided in appendix 2 of the Code.

Special notes:

• Applies when a CRO provides and maintains in operational condition the physical sites for hosting the hardware infrastructure of the information system used to process study-related personal data, including health-related data, or/and provides and maintains in operational condition of the hardware infrastructure of the information system used to process study-related personal data, including health-related data.
• When a CRO provides the software for class of services (20) Maintenance of Trial Master File, which enables configuring and further operating/managing the TMF, as well as installs the software on its hosts the hardware provided and maintained by the CRO on its premises, at least until the shipment to the sponsor the CRO is subject to the requirements applicable for classes of services (16) Provision of IT managed services and (17) Provision of physical hosting infrastructure.

Establishing and maintaining secure environment for data use.

Ensuring appropriate technical and organizational measures for data use.

Collection/obtainment, storage, transfer/transmission, deletion/destruction.

• Study subjects: same as for classes of services (4) Data collection and (8) Direct-to-patient services.

• Healthcare professionals: same as for class of services (3) Site selection and contract.

Until completion/termination of service.

2021-09-02 15:23:44

2026-06-07 13:32:46

Refers to the process consisting in providing technical support to users of an IT platform used in the context of one or several clinical studies. This kind of service is usually included in the Service Contract of IT vendors. It can include a shared information system to record and follow every request for support (ticketing system). It requires that personal data from the potential users (investigators, clinical research assistants, clinical nurses etc.) be collected. Because the users may refer to practical cases / situations, patients' data may be exchanged with the hotliners. This may also be the case if the IT platform includes ePRO or eCOA systems and first level support is provided by the IT vendor.

Providing technical support to resolve technical difficulties related to the use of software employed to process personal data.

Ensuring organizational security measures for data use.

Collection/obtainment, storage, transfer/transmission, deletion/destruction, de identification (pseudonymisation, anonymization, aggregation, masking, removing of data elements).

• Study subjects: same as for classes of services (4) Data collection and (8) Direct-to-patient services.

• Healthcare professionals: same as for class of services (3) Site selection and contract.

Until completion/termination of service.

2021-09-02 15:26:37

2026-06-07 13:36:08

Refers to the process consisting in removing / deleting all data of a client from the IT environment of the provider when the contractual relationship terminates. The Service Contract shall include provisions for decommissioning services.

Decommissioning services shall be required for any class of services that envisages the employment of a computer system processing personal data. The Data Processing Agreement shall implement the corresponding requirements for those data falling under the GDPR.

Examples are provided in appendix 2 of the Code.

Removing the concerned personal data from IT environment.

Securely removing all personal data from hosting environment.

Deletion/destruction.

• Study subjects: same as for classes of services (4) Data collection and (8) Direct-to-patient services. 

• Healthcare professionals: same as for class of services (3) Site selection and contract.

Until termination/completion of service.

2021-09-02 15:31:10

2026-06-07 13:39:53

TMF is set of electronic records and/or hardcopies relating to a clinical study, systematized and indexed for easy retrieval and use. The service consists of

• Setup in agreement with the sponsor’s requirements, if any,
• Assigning responsibilities for the filing and maintenance,
• Identifying the study documents that are subject to filing,
• Carrying out ongoing submission and processing of the documents,
• Storage,
• Review for accuracy and compliance with the regulatory and sponsor’s specifications,
• Transfer to the sponsor.

Data collection in accessible format with active access to data.

Essential study documents, including personal data are catalogued in a standard manner, in compliance with ICH GCP and all other applicable standard.

Collection/obtainment, storage, deletion/destruction.

• Study subjects: any pseudonymised personal data processed for the research.
• Healthcare professionals: any personal data processed for the research.

TMF setup to transmission of the TMF to the research sponsor.

2021-09-02 15:38:03

2026-06-07 13:42:25

Refers to services provided by the CRO to support the sponsors or the investigational sites to comply with their obligations after the end of the study. For example, according to GCP and CTR (2014/536), sponsors and investigational sites are required to archive all study related documents (TMF) and study data.

Data storage in accessible format with no active access envisaged.

Maintaining data availability for regulators, future studies, additional authorization submissions.

Collection/obtainment, archival, deletion/destruction, de -identification (pseudonymisation, anonymization, aggregation, masking, removing of data elements).

• Study subjects: any pseudonymised personal data processed for the research.
• Healthcare professionals: any personal data processed for the research.

At least 25 years after the end or cancellation of the research pursuant to Clinical Trials Regulation No 536/2014 or Medical Device Regulation No745/2017 as applicable, or any other duration according to type of studies and per applicable legal/regulatory/standard/contractual requirements.

2021-09-02 15:39:00

2026-06-07 13:45:48