The European Commission’s proposed Biotech Act, adopted by the Commission on 16 December 2025, includes a significant — and still entirely unenacted — set of amendments to the Clinical Trials Regulation (EU) No 536/2014 (CTR). The provisions most relevant to research administrators concern data protection: they would revise CTR Article 93 to give sponsors and investigators a clearer, harmonised legal basis for processing personal data under the General Data Protection Regulation (GDPR), explicitly name sponsors and investigators as GDPR controllers for clinical-trial-related processing, and open a pathway for reusing clinical trial data across trials and other medical research. None of this is law yet. This page explains what has actually been proposed, what remains genuinely unresolved, and what research administrators should be tracking as the file moves through the EU’s ordinary legislative procedure.
Status: proposed, not adopted
It is worth stating plainly, because coverage of the Biotech Act has occasionally been read as further along than it is: the European Commission adopted its proposal for the Biotech Act on 16 December 2025. A proposal is the start of the EU’s ordinary legislative procedure, not its end. Following a public consultation period running into 2026, the European Parliament and the Council of the EU must each negotiate and adopt their own positions, after which the file moves to trilogue negotiations among the Commission, Parliament, and Council to reconcile those positions into a final text. Industry legal trackers following the file have reported that trilogues were not expected to begin before the final quarter of 2026, and that adoption of the Biotech Act was not expected before the end of 2026 at the earliest — with the CTR amendments taking effect only once the final adopted text is published and enters into application, typically after a further transition period. A companion instrument, sometimes referred to as a follow-up “Biotech Act II” covering industrial and agri-food biotechnology, has also been flagged as a separate, later initiative and should not be confused with this health-sector proposal.
Nothing here has reached the legal-linguistic finalisation and formal signature stage that precedes an EU regulation’s publication in the Official Journal. Research administrators should treat every provision below as a proposal that can still be amended, narrowed, or dropped during Parliament and Council negotiations — not as a compliance deadline to plan against yet.
Why the Commission is revising CTR Article 93
The CTR and the GDPR were negotiated on different tracks and, since the CTR entered into application in January 2022 alongside the Clinical Trials Information System (CTIS), sponsors and investigators operating across EU member states have had to reconcile two overlapping-but-not-identical frameworks. CTR Article 93 already references data protection obligations, but it does not itself supply a harmonised GDPR legal basis for the processing that clinical trials inherently require — screening, eligibility assessment, safety reporting, monitoring, and regulatory submission. In practice this has left sponsors and investigators to construct their own legal-basis analysis, sometimes differently, from one member state to another, which is precisely the kind of fragmentation a directly-applicable EU regulation like the CTR is meant to prevent.
The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) formalised their assessment of the health-sector proposal in a Joint Opinion (Joint Opinion 3/2026, issued 10 March 2026), broadly supporting the aim of harmonising the legal basis while flagging specific points — summarised below — that they said needed more precision before the text is finalised.
What the proposal would actually change
A harmonised GDPR legal basis under Article 93
The proposal would amend CTR Article 93 to specify that sponsors and investigators process personal data for clinical-trial purposes on the basis of a legal obligation — corresponding to GDPR Article 6(1)(c) for personal data generally, and Article 9(2)(i) (public-interest grounds in the area of public health) for the special-category health and genetic data clinical trials routinely involve. Framing the processing as grounded in a legal obligation, rather than requiring each sponsor to separately justify a legal basis such as consent or legitimate interest in every member state, is the mechanism by which the Commission intends to harmonise practice across the EU. The proposal would also prevent individual member states from layering additional national conditions onto this processing under the GDPR’s Article 9(4) allowance for member states to maintain or introduce further conditions for processing genetic, biometric, or health data — a provision that has itself been a recurring source of the very fragmentation the CTR was designed to eliminate.
Sponsors and investigators as GDPR controllers
The proposal would expressly characterise both sponsors and investigators as controllers under the GDPR for the processing tied to clinical trial authorisation and conduct under CTR Article 93 — resolving, in principle, a question that has generated real practical friction: whether a site investigator processing a participant’s data on a multinational sponsor’s protocol is best understood as an independent controller, a processor acting for the sponsor, or a joint controller alongside the sponsor. Commentary on the proposal has noted that, as drafted, it does not fully resolve which of those controllership models applies — sponsor and investigator are each named as a controller, but the proposal has been read as leaving open whether their relationship is one of joint controllership (governed by GDPR Article 26, with a transparent arrangement setting out each party’s respective responsibilities) or separate, independent controllership for distinct processing purposes. The EDPB-EDPS Joint Opinion specifically asked for this to be clarified, and it is one of the more consequential open questions for sponsors and CROs currently drafting or renegotiating clinical trial agreements, data protection agreements, and informed consent language on the assumption that today’s ambiguity will persist for some time yet.
Cross-trial and secondary reuse of clinical trial data
The proposal also addresses a use case the original 2014 CTR did not squarely contemplate: reusing personal data collected in one clinical trial for a further clinical trial, or for other medical research more broadly. As drafted, it would permit controllers to reuse trial data collected under CTR Article 93 for these secondary research purposes, rather than requiring each downstream use to be separately justified from first principles. The EDPB-EDPS Joint Opinion welcomed the intent but pressed for clearer definition of the categories of permitted secondary purposes and the safeguards attached to them, including — per the opinion — an expectation that pseudonymisation be used wherever processing directly identifiable data is not strictly necessary for the secondary purpose. That is a meaningfully different, and administratively lighter, model than requiring a fresh, purpose-specific legal-basis assessment (or fresh consent) for every downstream reuse of trial data, but the categories of permitted reuse and the accompanying safeguards remain, per the current record, still to be settled in the final text.
Informed consent and other safeguards
Alongside the legal-basis change, the proposal frames obtaining participants’ informed consent, maintaining confidentiality, and applying appropriate security measures throughout the trial as continuing procedural and ethical requirements — but notably not as the GDPR legal basis itself, since that role shifts to the Article 6(1)(c)/9(2)(i) legal-obligation framing described above. Sponsors and investigators would also remain obliged to make relevant personal data, including health and genetic data, available to competent national authorities and the European Commission where required for trial oversight.
Why this matters for research administrators now
Even at the proposal stage, this is worth tracking actively rather than waiting for a final text, for three practical reasons. First, institutions running or hosting EU clinical trials frequently negotiate multi-year data management and data protection agreements with sponsors and CROs; knowing that the controllership question is under live regulatory review is directly relevant to how those agreements characterise each party’s role today, and how easily they can be amended if the final text lands differently than the current draft. Second, any institution planning multi-trial data reuse — a common ambition for academic medical centres building research data infrastructure — should treat the current secondary-reuse language as directional, not yet a reliable compliance basis, and should continue to rely on established GDPR mechanisms (explicit consent, the Article 89 research safeguards, or a documented Article 6/Article 9 analysis) in the interim. Third, the EDPB-EDPS Joint Opinion is a genuine signal of where the final text is likely to be pushed — toward more explicit controllership allocation and more concrete pseudonymisation expectations for secondary use — which is useful for institutions doing forward planning even before the legislative text catches up.
What to watch next
- Whether the European Parliament and Council each adopt their negotiating positions on schedule, and whether either substantially narrows the Article 93 amendments during that process.
- Whether trilogue negotiations, expected no earlier than the final quarter of 2026, resolve the joint-versus-separate controllership question the EDPB-EDPS Joint Opinion raised.
- Whether the final text adopts more prescriptive pseudonymisation or purpose-limitation language for cross-trial data reuse than the current proposal contains.
- The transition period the final regulation sets before the CTR amendments enter into application — EU regulations of this kind have historically allowed sponsors and member states a runway of a year or more after formal adoption.
CASRAI will continue to track this file and update this page as the proposal moves through Parliament and Council review; check back rather than treating the current provisions as final.
