Personal Data
During the conduct of clinical trials, Norwich Clinical Trials Unit (NCTU) may collect, store and process personal data, either directly or indirectly (for example, from pre-existing datasets or other systems).
Domestic and European legislation requires that NCTU has a lawful basis for the collection and processing of personal data. This lawful basis will vary depending on the nature of the underlying study. Often, study participants will give their explicit consent to their data being captured, stored and processed, in which case consent may be the legal basis. In other cases, the lawful basis might be that the study is a task in the public interest.
Our handling of personal data is regulated by the Information Commissioner’s Office (ICO). NCTU is part of the University of East Anglia (UEA) and hence covered by UEA's registration with the ICO. UEA’s registration number is Z8964916. See UEA’s ICO register entry.
In the context of NCTU clinical trials, UEA is a Data Controller. This means that we determine why and how personal data will be collected and used, typically jointly with other agencies (for example, study sponsors or chief investigators).
In the same context, UEA may also be a Data Processor. This means that we are responsible for processing personal data on behalf of a controller. For trials where UEA is not the sole controller, interested parties are advised to also refer to the relevant privacy notices for the other data controllers.
One of our responsibilities as a data controller is to be transparent in our processing of personal data and to tell the subject about the different ways in which we collect and use personal data. NCTU will process your personal data in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. We may update this privacy notice at any time. In addition to these legal requirements, NCTU adheres to ethical and good clinical practice in respect of how personal information is collected, stored and processed.
In addition, study-specific documentation will explicitly address the collection and use of participants’ personal data. Similarly, contracts will explicitly address the issue with third-party and partner organisations. These documents will identify the study-specific lawful basis for the collection and processing of personal data as appropriate.
Further Reading
University of East Anglia
Further information about data protection and the contact details for the UEA Data Protection Officer can be found here:
Data protection: University information
NHS Health Research Authority
Patient information and health and care research
Information Commissioner’s Office