On March 10, 2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) issued a joint opinion on the European Commission’s proposed EU Biotech Act – a forthcoming legislative framework expected to materially affect how clinical trials are designed, conducted, and governed in the EU.
The proposal, introduced in December 2025, would amend key EU life sciences legislation, including the EU Clinical Trials Regulation (CTR), and introduce new requirements for the use of advanced technologies such as artificial intelligence (AI) across the medicinal product lifecycle.
Why This Matters for Life Sciences Companies
The joint opinion broadly supports the Commission’s initiative but highlights several areas where clarification is needed to ensure compliance with the GDPR and to provide legal certainty for sponsors, investigators, and trial sites. If adopted largely as proposed, the Biotech Act could significantly reshape data governance expectations for clinical trials in the EU.
Key points of relevance include:
- Greater clarity – but also higher expectations – around clinical trial data processing. The EU regulators support harmonizing GDPR legal bases for processing sensitive personal data in clinical trials, including secondary use for scientific research. However, they call for clearer rules on informed consent under the CTR and the impact of consent withdrawal, which may affect how sponsors structure data reuse strategies and long‑term research programs.
- Clearer allocation of GDPR responsibility. The opinion confirms that sponsors and investigators act as controllers under the GDPR, but urges further clarification on whether they qualify as joint or independent controllers at different stages of a trial. This has direct implications for contractual arrangements, liability allocation, and data subject rights management.
- More precise data retention rules. The EU regulators support limiting the CTR’s 25‑year retention period to data contained in the clinical trial master file, rather than all personal data processed during a trial. This clarification could reduce long‑term data storage burdens and compliance risk for sponsors.
- Formal recognition of electronic informed consent. While the EDPB and EDPS welcome explicit recognition of electronic consent under the CTR, they stress the need to distinguish it from GDPR consent and to ensure accessibility for participants without digital access – an important consideration for trial design and patient engagement strategies.
- New AI‑related obligations for sponsors. The opinion endorses requirements for sponsors to assess patient safety and data integrity risks arising from the use of AI in clinical trials. The EDPB and EDPS also call for clarity on how these obligations align with the EU AI Act, signalling increased scrutiny of AI‑enabled trial tools and analytics.
- Expanded EU‑level support for innovation. The EU regulators encourage additional guidance, regulatory sandboxes, and testing environments to support advanced biotechnology development – potentially offering new opportunities for compliant innovation in the EU.
What’s Next?
The joint opinion will inform the European Parliament’s ongoing review of the proposed Biotech Act. Legislative discussions are expected to continue through 2027, with adoption anticipated in late 2027 or 2028.
Life sciences companies conducting clinical trials in the EU should begin assessing how the proposed framework could affect trial governance models, data strategies, AI deployments, and contractual arrangements with investigators and trial sites.
The Alston & Bird Privacy, Cyber & Data Strategy team is closely monitoring these developments and is available to advise on the Biotech Act’s implications for clinical trials, data protection compliance, and AI‑enabled innovation in the life sciences sector.
