Processing of Clinical Trial Subject Personal Data. For the purpose of the Data Protection Laws and Guidance, the Sponsor is the Controller and the Participating Organisation is the Processor of Personal Data Processed for the purpose of the Clinical Trial. The Participating Organisation’s Processing of Personal Data, as a Processor of the Sponsor, shall be governed by this Agreement, including the Protocol, which sets out the subject matter, duration, nature and purpose of the Processing, the type of Personal Data and the categories of Data Subjects, and obligations and rights of the Sponsor as Controller. The Participating Organisation is the Controller of Personal Data Processed for purposes other than the Clinical Trial, e.g. the provision of medical care. The Participating Organisation, in its role as Processor of the Personal Data under Clause 6.2.1, agrees to only Process Personal Data for and on behalf of the Sponsor in accordance with the documented instructions of the Sponsor, including with regard to transfers of personal data to a third country or an international organisation. If the Participating Organisation is required by law to otherwise Process the Personal Data, the Participating Organisation shall notify the Sponsor before undertaking the Processing, unless such notification is prohibited on important grounds of public interest in accordance with GDPR Article 28(3)(a). In the case of such prohibition, the Participating Organisation shall notify the Sponsor as soon as possible once the prohibition is lifted, if it is lifted. The Participating Organisation agrees to comply with the obligations applicable to Processors described by Article 28 of the GDPR, as well as those additional obligations required by the Sponsor pursuant to this Agreement, including but not limited to the following: implementing and maintaining appropriate technical and organisational security measures for Personal Data Processed in its systems, in keeping with its obligations as an NHS organisation, thereby providing guarantee to the Sponsor pursuant to GDPR Article 28(1); ensuring that Personnel authorised to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Article 28(3)(b)); taking all measures required by GDPR Article 32 in relation to the security of Processing (GDPR Article 28(3)(c)); subject to Clause 6.2.6 complying with the conditions described in GDPR Article 28(2) and (4) for engaging another Processor (GDPR Article 28(3)...
Processing of Clinical Trial Subject Personal Data. 7.2.1 For the purpose of the Data Protection Laws and Guidance, the Sponsor is the Controller and the Clinical Organisation and CRO are Processors of Personal Data Processed for the purpose of the Clinical Trial. The Sponsor shall ensure that there is a lawful basis for the processing of Personal Data for the purpose of the Clinical Trial, in accordance with GDPR requirements.
