Decentralized Clinical Trials: Definition, Regulations, and French CNIL Standards

I. Decentralized Clinical Trials

1. Definition

A clinical trial (Art. 2.2.2), according to Regulation 536/2014¹, is a clinical study (Art. 2.2.1), which is an investigation conducted on humans to evaluate the effects of one or more medicinal products. Its objective is to verify the safety and efficacy of medicines before they are marketed. These verifications focus on (Art. 2.2.1):

• Clinical and pharmacological effects (how the medicine acts on the human body);
• Adverse effects (risks and tolerance);
• Absorption, distribution, metabolism, and excretion of the medicine (how it is transformed and eliminated by the body).

To qualify as a clinical trial, at least one of the following criteria must be met (Art. 2.2.2):

• The treatment of participants is predetermined and does not depend on standard medical practices;
• The decision to prescribe the medicine is made at the time of the patient’s inclusion in the trial;
• Additional examinations and follow-ups are conducted beyond routine care.

Clinical trials are essential in evaluating the efficacy and safety of medicines before they are authorized for market release.

In the case of so-called “decentralized” clinical trials, the distinctive feature is that all or part of the procedures typically performed on-site (hospital, clinic, research center) are carried out remotely using digital technologies. This approach presents a particular challenge regarding the regulation of connected technologies. In this context, the European Commission specifies in its recommendations on decentralized elements in clinical trials² – published on December 13, 2022 – that “Clinical trials involving investigational medicinal products are increasingly using procedures performed outside the traditional clinical trial site, a concept generally referred to as decentralization.”

2. Characteristics of Decentralized Clinical Trials

In its recommendations, the European Commission identifies several key characteristics of decentralized trials, which help to better understand how this type of trial is conducted and how it differs from traditional clinical trials:

• The use of digital technologies such as electronic diaries, connected devices, telephone or online consultations.³
• The possibility for participants not to physically visit the site for certain procedures, which are replaced by home or remote assessments.⁴
• The involvement of external service providers who can handle certain tasks outside the usual care centers.⁵
• Remote patient evaluation and management, with adapted and secure medical follow-up.⁶
• Specific data collection, requiring suitable tools and risk management related to data reliability and confidentiality.⁷

II. Decentralized Clinical Trials: A Subject of European Interest

Decentralized clinical trials are a topic of significant interest in Europe, as demonstrated by the recommendations published by the European Commission. These recommendations aim to gradually integrate decentralized elements into clinical trials within the EU, taking into account digital tools and remote procedures.

These decentralized elements include, for example, the use of electronic consent, remote distribution of investigational medicinal products, remote data management, and the conduct of certain clinical procedures at home⁸. The objective is to ensure the safety of participants, protect their rights, and maintain data reliability while facilitating the use of digital technologies in clinical trials⁹. This framework is particularly relevant in light of the lessons learned from the COVID-19 pandemic¹⁰.

In this context, France launched a pilot phase in 2024, initiated by the DGS, DGOS, ANSM, and CNIL¹¹, to support sponsors in designing decentralized clinical research projects. This phase aims to provide targeted support to 20 projects to address the specific challenges encountered in implementing decentralized elements. This initiative is part of an effort to ensure compliance with European recommendations while supporting French stakeholders in adopting these new practices5.

III. An Evolving Framework

The framework for clinical trials is still evolving, particularly regarding the handling of personal data. In May 2018, the CNIL validated two reference methodologies (MR-001 and MR-003)¹² through two deliberations that apply to clinical trials, including those governed by Regulation 536/2014.

Today, the CNIL continues to evolve the framework for clinical trials in response to the challenges posed by new practices, such as decentralized clinical trials. In 2024, it launched a pilot phase, in collaboration with the DGS, DGOS, and ANSM, to support sponsors in designing projects involving decentralized elements. This phase aims to gather practical feedback and address the specific questions of researchers. Ultimately, this pilot phase will enable the CNIL to enrich and adjust its reference methodologies to better integrate the specificities of decentralized clinical trials.

This approach allows the data protection authority to continue addressing research challenges while ensuring a framework adapted to innovations in the field of clinical trials.

IV. Personal Data Protection in Decentralized Clinical Trials

Decentralized clinical trials heavily rely on digital health technologies, involving a significant volume of data collected remotely and in real-time. This large-scale data collection raises major challenges in protecting personal data, particularly health data. In Europe, the processing of this data is governed by the General Data Protection Regulation (GDPR) and, in France, by the Data Protection Act, under the supervision of the CNIL.

Article 9 of the GDPR specifies that health data is part of the special categories of data whose processing is prohibited, except in specific cases, such as when necessary for scientific research purposes and subject to appropriate safeguards. In this context, the CNIL has adopted two reference methodologies (MR-001 and MR-003) to ensure the compliance of clinical trials, including those conducted with decentralized elements.

However, the decentralization of trials presents specific challenges:

• How to ensure the security of platforms used for online consultations?
• How to protect data transmitted via connected medical devices?
• The use of external technical service providers also requires sponsors to rigorously audit these subcontractors to verify their compliance with the GDPR. The CNIL recommends integrating enhanced encryption and strong authentication measures within the framework of the French pilot phase in 2024 to secure the transmission of health data.

Additionally, the issue of electronic consent is central to the debate. Consent must remain free, informed, and specific, which implies providing participants with clear explanations about the collection and use of their data. European recommendations emphasize the importance of transparent digital platforms that allow patients to withdraw their consent at any time without justification.

Furthermore, sponsors must ensure continuous compliance with European regulations regarding the processing of sensitive data. For more information, consult our detailed page on health data compliance.

V. Legal Framework for Decentralized Clinical Trials and Its Evolutions

The legal framework for decentralized clinical trials is still under construction but already rests on a solid legislative foundation. The European Regulation (EU) No 536/2014 on clinical trials of medicinal products for human use is the cornerstone of this framework. It stipulates that all research must be conducted in respect of the fundamental rights of participants and under conditions ensuring safety, confidentiality, and data reliability.

The European recommendations published in December 2022 complement this regulation by adapting its principles to the specificities of decentralized trials. They address, for example, the remote distribution of research products, the conduct of medical examinations at home, and medical supervision without direct contact. France, through its pilot phase launched in 2024 by the DGS, DGOS, ANSM, and CNIL, is experimenting with the application of these recommendations to build a practical and adapted framework.

One of the major challenges in the legal framework for decentralized clinical trials is the legal responsibility of sponsors. In the event of non-compliance or an incident, who is responsible: the sponsor, the technical service provider, or the remote medical investigator? This question is further complicated by the proliferation of digital health technologies and the real-time data collection, which generates new forms of legal risks.

Ultimately, the results of the French pilot phase are likely to influence the evolution of the legislative and regulatory framework, with adjustments to the CNIL’s reference methodologies and potentially to Regulation 536/2014. European and national case law will also play a crucial role in clarifying responsibilities and setting obligations for the various stakeholders. This evolution will help reconcile innovation and legal security for patients wishing to participate in a clinical trial while promoting the development of digital health technologies in Europe.

Additionally, to manage cyber risks, it is essential to integrate best practices for managing cyber crises.

Aumans Avocats: Specialists in IT/Data, Data Protection, and DPO Outsourcing

As a law firm specializing in IT/Data and data protection, we are at your disposal to support you in all your projects. Whether you are a startup, an SME, or a group of companies, our expertise will allow you to navigate the complex landscape of regulations and compliance with confidence. Do not hesitate to contact us to benefit from personalized advice and secure your digital future.

Discover our support offer to ensure your GDPR compliance and benefit from a personalized exchange with a specialized lawyer.

Aumans Avocats: Specialists in IT/Data, Data Protection, and DPO Outsourcing

As a law firm specializing in IT/Data and data protection, we are at your disposal to support you in all your projects. Whether you are a startup, an SME, or a group of companies, our expertise will allow you to navigate the complex landscape of regulations and compliance with confidence. Do not hesitate to contact us to benefit from personalized advice and secure your digital future.Discover our support offer to ensure your GDPR compliance and benefit from a personalized exchange with a specialized lawyer.

Sources :

1. https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=planjo:20140414-044 – Règlement sur les essais cliniques ↩︎
2. https://sante.gouv.fr/IMG/pdf/recommandations_elements_decentralises_essais_cliniques.pdf – Page 1, Pt 1 ↩︎
3. https://sante.gouv.fr/IMG/pdf/recommandations_elements_decentralises_essais_cliniques.pdf – « Clinical trials with medicinal products have already adopted many decentralised elements such as electronic diaries, wearables, phone calls and online appointments. » ↩︎
4. https://sante.gouv.fr/IMG/pdf/recommandations_elements_decentralises_essais_cliniques.pdf – « In clinical trials with decentralised elements, parts of the clinical trial may be conducted outside the traditional patient care centers, with the involvement of service providers. » ↩︎
5. Ibid – « In clinical trials with decentralised elements, parts of the clinical trial may be conducted outside the traditional patient care centers, with the involvement of service providers. » ↩︎
6. Ibid – « General medical rules to protect patient’s/trial participant’s safety should be upheld in trials with decentralised elements especially when patients/trial participants are separated from traditional patient care centers. » ↩︎
7. Ibid – « IT devices / technologies which are developed and utilised should be fit for the purpose of reliable data collection and handling in accordance with the protocol. » ↩︎
8. Ibid – « electronic informed consent, IMP delivery, trial related procedures at home, data management and monitoring in a decentralised clinical trial setting » ↩︎
9. Ibid – « However, the necessary level of trial participant’s safety, protection of their rights and dignity should be ensured. In addition, the reliability of data for publication and submission for regulatory decision-making should be guaranteed » ↩︎
10. Ibid – « The COVID-19 pandemic highlighted the importance and usefulness of digital tools and decentralised procedures in a healthcare setting and in clinical trials » ↩︎
11. https://www.cnil.fr/fr/essais-cliniques-decentralises-lancement-dune-phase-pilote-par-la-dgs-la-dgos-lansm-et-la-cnil ↩︎
12. https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000037187386 – MR-001 https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000037187443 – MR-003 ↩︎