Pseudonymising Clinical Trial Data: Consent Forms & CRFs – UK GDPR-compliant anonymisation per Medicines for Human Use (Clinical Trials) Regulations 2004
Clinical trial data is a special-category health dataset under the Medicines for Human Use (Clinical Trials) Regulations 2004, identifying participants by name, date of birth, and site identifiers under UK GDPR Article 9. The HRA approves around 6,000 projects per year; DPA 2018 fines reach £17.5 million or 4% of turnover. anonym.legal pseudonymises participant identifiers, preserving trial arm and adverse-event records for regulatory review.
When this applies
This task applies when clinical trial data is prepared for submission to a regulatory sponsor, shared with an independent data monitoring committee, or prepared for academic publication, and the receiving parties require the trial data but not the identities of individual trial participants. Breaches of participant confidentiality can attract fines of up to £17.5 million or 4% of annual global turnover under DPA 2018 s.157.
How anonym.legal handles it
- Upload consent forms, CRFs, and adverse-event narratives to anonym.legal.
- The engine identifies participant name, date of birth, site identifier (where linked to an individual), and any narrative descriptions of adverse events that name the participant.
- Each participant is assigned a consistent subject code pseudonym applied across all linked documents.
- Trial arm assignment, dosing records, efficacy outcome measures, and adverse-event grades and descriptions are preserved.
- Investigator names are pseudonymised; site codes (non-identifying) are preserved.
- A mapping table linking subject codes to participant identities is produced with UK data residency and role-based access control.
What you provide
- Informed consent forms
- Case report forms (CRFs) in PDF or electronic format
- Adverse-event narrative reports
- Site code mapping document (if site codes are identifying)
Limitations & cautions
- Clinical trial participant data may be subject to additional obligations under the MHRA's clinical trials regulations; confirm that pseudonymisation is consistent with the approved trial protocol and ethics approval under the HRA Approval framework.
- The Medicines for Human Use (Clinical Trials) Regulations 2004 framework requires trial data to be retained; pseudonymised copies used for publication do not replace the requirement to retain identified trial master file records.
- Adverse-event narratives describing rare reactions in small sub-populations may retain re-identification risk; apply statistical disclosure control for very small participant groups.
FAQ
Does pseudonymisation of clinical trial data satisfy the ICH E6(R2) GCP guideline requirements for participant confidentiality?
ICH E6(R2) requires that participant confidentiality be maintained. Pseudonymisation supports this obligation when sharing data externally; however, the sponsor's data management plan should explicitly address how pseudonymisation interacts with trial master file obligations. According to the HRA, around 6,000 research projects are approved per year in the UK, all of which generate participant data requiring confidentiality controls.
Can pseudonymised CRFs be included in a clinical trial publication?
Journals increasingly require data sharing with pseudonymised or anonymised participant data. anonym.legal produces pseudonymised CRFs suitable for supplementary materials; confirm with the target journal's data-sharing policy whether pseudonymised or fully anonymised data is required. The ICO's Anonymisation Code of Practice (2012, updated 2021–22) distinguishes anonymisation from pseudonymisation — the latter remains personal data under UK GDPR.
Are site identifiers treated as personal data if they can be linked to an individual?
If a site identifier combined with trial arm and adverse-event profile could re-identify a participant, it is processed as personal data. The engine's configuration allows site code pseudonymisation where identifying, with non-identifying numeric site codes preserved. The 8 Caldicott Principles apply to NHS-sponsored trials: Principle 3 requires use of minimum necessary identifiable data.
What retention period applies to clinical trial records under UK law?
Under the Medicines for Human Use (Clinical Trials) Regulations 2004, essential trial documents must be retained for at least 2 years after the marketing authorisation is granted, or — if no authorisation is sought — at least 2 years after formal discontinuation. The NHS Records Management Code of Practice 2023 may impose longer retention for NHS-sponsored trials where records overlap with patient health records retained for 8 years from treatment.