The Europe General Data Protection Regulation (GDPR), effective from 25th May 2018, has replaced the Data Protection Directive 95/46/EC and has a legal framework that sets procedure for the collection and processing of personal information of individuals within the European Union. All subjects need to provide their informed consent before they can participate in a trial. The informed consent and clinical trials are regulated by the Clinical Trials Directive 2001/20/EC and the new Clinical Trials Regulation 536/2014/EU. Now, Sponsor companies will also have to follow the new GDPR regulation. Hence, it is worthwhile to know what new requirements apply to clinical trials and informed consent under GDPR.

Consider the following while drafting the consent form:

• Consent form must be drafted such that it provides the information in clear and plain language, unambiguous, explicit
• Clearly states the consent is voluntary and the subject is free to withdraw anytime
• Keep consent request separate from your general terms and conditions
• For child consent, in which case age-verification and parental-authorisation issues need to be considered
• Consent form must be specific to each procedure, and only used for those purposes set out in the consent form. When the processing has multiple purposes, consent should be given for all of them
• The clear affirmative consent can be documented by asking subject to actively opt-in by using a tick opt-in box on paper or electronically, selecting from equally prominent yes/no options, signing the consent form.

With GDPR the following rights have been given to the data subject, and the same can be added in the consent forms

• Right to be informed – hall be informed before their personal data are obtained, such as the identity and contact details of the data controller (i.e. the sponsor), the contact details of the data protection officer, the purposes for using, the recipients of the data with whom it will be shared, how long the data will be stored.
• Right to access – can submit subject access requests, which oblige sponsor to provide a copy of any personal data concerning the individual
• Right to rectification – shall have the right to obtain from the controller the rectification of inaccurate personal data concerning him or her without any undue delay
• Right to erasure (right to be forgotten) – shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay
• Right to restriction of processing – shall have the right to obtain from the controller restriction of processing data
• Right to data portability – shall have the right to receive their personal data in a commonly used and machine-readable format, and transmit such data to another organization
• Right to object – shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her
• Rights related to automated decision making including profiling – shall have the right not to be subject to a decision based solely on automated processing, including profiling

GDPR applies to all organisations worldwide that are handling EU citizens data. Penalties under the GDPR are substantial fines of up to €20 million or 4 percent annual global turnover, whichever is the higher. With this new regulation, the current informed consent forms and templates need to be updated. All the elements mentioned above need to be included in the new consent forms, as applicable.