Clinical Trial GDPR Readiness Check

Is your organization privacy-ready for conducting clinical trials in the EU?

Take this short assessment to find out how aligned your company is with key GDPR requirements in the clinical research space. It takes only 2–3 minutes and covers essential areas like privacy leadership, data transfers, consent, vendor due diligence, and more. At the end, you’ll receive:

A free summary of your risk level

The option to purchase a personalized Privacy Compliance Report (€97) with specific recommendations tailored to your situation

The opportunity to book a discovery call to discuss your next steps

Start the assessment now and take the first step toward smart, scalable GDPR compliance.

1. Does your company have someone responsible for privacy?
No, we are all clinical team members.
Yes, our legal counsel handles all privacy matters.
Yes, we have a dedicated privacy and/or security lead.

2. Does your company have privacy and security policies, procedures, SOPs, etc.?
No we do not have security or privacy policies, procedures, SOPs.
We have security procedures, but no privacy policies.
Yes, we do have both security and privacy policies, procedures, SOPs.

3. Does your company process personal data from EU/EEA citizens?
No, our company does not do business in EEA.
Yes, our company does business in EEA.
Not yet, but we are considering performing clinical trials in EEA.

4. Does your company implement technical and organizational measures when processing data from European citizens?
No, we receive fully identifiable data (e.g., names, birthdates). Yes, we pseudonymize personal information.
Yes, we apply a range of technical and organizational measures, including documented policies and SOPs.

5. Does your company assess vendors from privacy perspective?
No, we don't think our vendors pose a significant privacy risk.
Yes, we use a basic checklist during onboarding.
Yes, we use a privacy checklist during onboarding and monitor vendors regularly.

6. Does your company get privacy training?
No, our company does not consider privacy as an area to be trained.
Yes, we get privacy trainings from time to time.
Yes, since we do business in EEA, we get at least one training/year.

7. Does your company perform data inventories, data flows and Records of Processing Activities (RoPAs)?
No, we are small or medium company so we do not need to.
Yes, we perform some level of mapping or documentation (e.g., inventory, flows, or RoPAs).
Yes, we conduct full mapping, inventories, and maintain RoPAs as required by law.

8. Do you secure international personal data transfers contractually?
No, we believe our local rules apply when data is processed outside the EEA.
Yes, we use data transfer agreements or Standard Contractual Clauses (SCCs).
Yes, we implement proper transfer mechanisms and conduct regular audits to confirm compliance.

9. Does your company have a formal process for handling data subject requests?
No, we have no defined process.
No, we don’t have a formal process, but we handle requests on a case-by-case basis.
Yes, we have a formal process with clear steps, responsibilities, and deadlines.

10. Do your company or vendors use AI technologies on personal data collected during clinical trials?
Yes, but we don’t assess the risks or have any specific governance measures in place.
Yes, we are exploring or piloting AI tools, and we are beginning to consider governance requirements.
Yes, and we assess risks through privacy and/or AI governance frameworks (e.g., DPIAs, ethical reviews, vendor screening).

First name*

Last name*

Company*

Email address*

Position*

I accept the Privacy Policy, Cookie Policy and Sales, Marketing, and Outreach Privacy Policy.