Skip to end of metadata
Go to start of metadata

Frequently Asked Questions


General questions

Everything you need to know about consent

Compliance Ins and Outs




CITI Training

IND Safety Report Submissions

General Data Protection Regulation (GDPR)



General Questions

Start at your Institute and find out if you have protocol navigator services available to assist you in submitting ot IRBO. If you do not, please contact Dr. Gini Guptill in the ORSC: orscprotocolsupport@nih.gov.

Work with your protocol navigator to submit a change in PI to the IRB.

All submissions to the IRBO will occur via NIH iRIS. Your protocol navigator can assist you.

We are adding materials to the website as they are being developed.  All available NIH Policies, Procedures, and SOPs can be found here: Policies & Guidance .

New studies submitted to the IRBO after January 21, 2019 are affected by the changes to the Common Rule. The IRBO will review your submission and ensure the required information is there. Mostly the IC is affected and a template is posted for use: IRB Templates.

Federal and state Right to Try laws generally permit the use of unapproved, experimental drugs and biological products by individuals diagnosed with a life-threatening condition who (1) have exhausted approved treatment options, and (2) are unable to participate in clinical trials involving the product.

However, NIH is a federal research agency. Therefore, it cannot provide an unapproved drug or biological product to an individual unless the subject is enrolled in an NIH protocol. Further, Right to Try laws do not establish a “right” to participate in a clinical trial or protocol, i.e., the laws do not entitle patients to participate in an NIH-sponsored clinical trial.

If you are unable to enroll in an NIH protocol involving an unapproved drug or biological product, the Right to Try Act may provide another option. Interested individuals should speak to their home-based treating physician about the possibility of receiving an unapproved drug or biological product from a source other than the NIH through the Right to Try pathway. The federal Right to Try Act became law on May 30, 2018. More information is available at https://www.congress.gov/bill/115th-congress/senate-bill/204/text.

Please discuss this at the IC level. There is an NIH requirement that the IC hold the IND. Usually there is a regulatory expert that can assist with this. If your IC does not have this expertise, please contact Dr. Gini Guptill in the ORSC: orscprotocolsupport@nih.gov

Protocol templates can be found on the Templates & Forms page.

Consent templates can be found on the Templates & Forms page.

The Clinical Center has Recruitment Services available: Recruitment Services.

Please email: IRB@od.nih.gov or call 301-402-3713.



Everything you need to know about consent

Download this section as a PDF.


The short form consent process is used when the subject is unable to read the long form version of the consent due to a language barrier or illiteracy. An interpreter is utilized for subjects who are unable to understand the language in which the long form consent is written.

Whenever possible, a professional interpreter, who is in-person, should be used or, alternatively, professional translation can be via a phone translation service. Use of a family member for interpretation is not permitted unless a professional medical translator cannot be located.  The reasons for using a family member and the attempts made to locate a professional translator must be documented in the research record. Family members may not have adequate medical knowledge and are not trained as professional medical interpreters.  Additionally, family members may not be impartial or may try to speak for the subject which can limit the subject’s decision-making process. (See also FAQ Question 14 for more information about when an investigator may server as the interpreter.)

When the subject speaks and understands English but is illiterate or blind, the English long form should be used to obtain consent from the subject. The short form consent document should not be used.  The subject may use assistive technology (such as screen readers for sight-impaired individuals) to read the consent, or the consent form should be read to the subject. There must be a witness to the entire oral presentation of the consent. The witness then signs the witness line on the English long form consent.  Subjects who are unable to sign their name can make their mark on the signature line. (e.g. They may make an “X,” or provide a fingerprint.) The consent note in Clinical Records Information System (CRIS)    or the research record should document the process and include a statement that there was a witness to the entire consent process and any special circumstances regarding documentation of consent.

When conducting the consent process with a subject for whom no written language exists, the process is similar to that used with a blind or illiterate subject.  There should be an oral presentation of the English long-form consent by the interpreter.  There must be a witness (who can be the interpreter if they are willing to act as the witness) at the location of the investigator, who is present during the entire oral presentation.  The subject must sign or make their mark on the consent, and the investigator and witness both sign the consent. The administrative block for interpreters must be completed, and there must be a note in CRIS or the research record documenting the consent process used in this circumstance.

If the subject is non-English speaking and illiterate in their own language, the same process for illiterate English speakers would be utilized.  (The short form cannot be used since the illiterate subject is not able to read the short form in their own language.) In such cases, there should be an oral presentation of the English long-form consent by the investigator, using an interpreter.  There must be a witness at the location of the investigator who is present during the entire oral presentation. The witness can be the interpreter if they are willing to act as the witness.  The witness then signs the witness line on the English long form consent.  Subjects who are unable to sign their name can make their mark on the signature line. (e.g., They may make an “X,” or provide a fingerprint.) The administrative block for interpreters must be completed. The consent note in Clinical Records Information System (CRIS) or the research record should document the process and include a statement that there was a witness to the entire consent process and any special circumstances regarding documentation of consent.

For the English long form consent: the investigator obtaining consent and the witness sign the English long form consent document. The interpreter may also act as the witness.



For the short form consent that is in the language that can be read by the subject The subject and the witness sign the short form consent document.  




Confirm that the witness has signed both the short form in the language of the subject and the English long form used as the summary of what is to be said to the subject.

NIH staff members who are federal employees and whose job description involves interpretation services should sign the short and long form consent as the witness when facilitating the short form consent process. Contract staff or volunteers providing interpreter services may sign as witnesses but cannot legally be required to do so. If the interpreter declines to act as the witness, a separate individual must witness the entire short form consent process and sign as the witness. In all cases, the identity of the interpreter will be noted as indicated in Question 9 below.

Before starting the consent process, confirm with the interpreter if they are willing to witness the consent. If the interpreter will not serve as the witness, a separate adult witness must be identified, and the witness must be fluent in both English and the language of the subject. The witness must be present for the entire oral presentation. 

In the vary rare instance that the interpreter is unable or unwilling to act as the witness, and a witness who is fluent in both English and the language of the subject cannot be located, then the witness should verify with the interpreter that the subject understands the information presented, that all questions have been satisfactorily addressed, and that the subject agrees to participate. The witness, or investigator, obtaining informed consent should document this as a note in the record documenting the short form consent procedure.

A phone service interpreter cannot act as a witness since they are not physically present to observe the consent process. Another individual must observe the entire consent process at the site of the investigator and sign as the witness. Information regarding the interpreter should be included in the administrative section of the long form consent document in FAQ Question 9.

Both the English long form and the translated short form includes a section titled NIH ADMINISTRATIVE SECTION TO BE COMPLETED REGARDING THE USE OF AN INTERPRETER which must to be completed when the short form consent process is used. (Note: On the translated short form, this section will be in the subjects preferred language.) This section allows NIH staff to attest that an individual speaking both English and the subject’s preferred language facilitated the consent process and also indicates whether the individual acting as the interpreter also served as the witness to the short form consent process.

If the individual providing interpretation services did not serve as a witness, the interpreter’s name (for on-site interpreters), or ID number (for telephone-based interpreters), should be entered in the designated 2nd field below.

English long form administrative block

Examples of scenarios

  • An NIH staff member who is a federal employee and whose job description involves interpretation services acted as interpreter and signed as witness: The first option is checked and the interpreter signs as the witness.
  • An NIH contract interpreter is used but states they cannot sign as witness: The second option is checked, and the interpreter’s name or ID code is entered on the provided line.  In such cases there must be a separate individual present to observe the entire consent process and who signs as the witness.
  • A telephone translation service (trans-telephonic interpreter service, e.g. “blue phone” service) is used and the consent is obtained in person (person obtaining consent and the subject are co-located):  Since the interpreter is not physically present and cannot serve as witness, the second option is selected, and the name or ID of the interpreter is entered.  In such cases there must be a separate individual present with the investigator to observe the entire consent process and who signs as the witness.

The difference from the earlier examples relates to the location of the individual who will serve as the witness and timing of the investigator and witness signatures. 

  • The subject should be provided with both the short form consent and the long-form English consent prior to the phone discussion.
  • The investigator who is obtaining consent is in the same place as the witness (this may/may not be the interpreter).
  • The investigator, interpreter, and witness (if the interpreter will not/cannot serve as the witness) must all be involved for the duration of the consent process conducted via phone.
  • After completion of the consent process, the following should be completed in real time:
    • The subject signs and dates the short form consent and returns it to the investigator.
    • At the time of the consent process, the investigator and the witness sign and date the long form English consent that was used as the basis of translation.
    • The administrative section on the last page of the long form English consent is completed.
    • The investigator documents the process in a consent note in the subject’s medical chart or research record (in real time after the consent discussion).
  • Upon receipt of the signed and dated short form consent from the subject, the investigator completes the administrative section of the short form, and the same witness signs and dates the short form consent using the current date. (It is not backdated to the date that the consent process was conducted by phone.)
  • The subject is provided with copies of the signed short and long form consent documents.
  • The investigator adds a note to the medical/research record regarding the date the signed short form was received and signed by the witness and indicates when the copies were returned to the subject.

The short form consent process requires that the witness attest, by signature, to the validity of the consent process and the subject’s agreement to participate.  If the witness is unable to sign the required documents, it is not acceptable for the PI to make a notation in the research record on behalf of the witness.

In such scenarios, the acceptable options for obtaining informed consent are to either: 1) translate the full consent into the language of the subject, or 2) if it is urgent to enroll the subject, the short and long form consents could be provided electronically to the witness, who will then sign and return the documents electronically.  Note, that such signatures must be “wet” signatures using a pen, mouse or stylus and not electronic signatures.

If these options are not feasible, then it may not be possible to enroll the subject.

The CRIS documentation of the Informed Consent Progress Note has been updated to include the required fields related to use of interpreters and witnessing the consent process.  Whenever an interpreter facilitates the informed consent process, the PI or investigator who is obtaining consent should complete the check box fields in the progress note and include the name or ID number of the interpreter in the designated field. 

If investigators anticipate enrolling subjects who speak a specific language other than English, the English long form consent should be fully translated into that language and submitted to the IRB for approval.  In this case, an interpreter is also used to facilitate the discussion and answer the subject’s questions, and the investigator obtaining consent and the subject both sign the fully translated long form consent (as they would if the long form was in English).

In this case, since an interpreter is used but a witness is not required on the long form consent, the second box in the administrative section should be checked to indicate that the interpreter facilitated the consent process but did not serve as the witness.

Check “yes” to the question, “Interpreter used during the consent process?” Fill in the name or ID code of the person providing interpretive support. Under additional notes, include a statement that a translated consent long form was used.  See below.

If the investigator is truly fluent in English and the language of the subject, consent may be obtained using the IRB approved translated long form if it exists, and no witness is needed. When the short form process is used because the long form has not been translated into the subject’s language, the bilingual investigator conducts the consent process in the language of the subject and explains all applicable elements of consent using the English long form as the summary of what is said to the subject.  The investigator obtaining consent cannot act as the witness, so the second option in the administrative block noted in FAQ question 9 above is checked, and the investigator’s name is noted on the provided line.  In such cases, there must be a separate individual present to observe the entire consent process who signs as the witness.

If the long form has not been translated into the language of the proposed subject, the subject should not be enrolled until a short form in their language is available. If you need a short form that is in a language which is not available on the IRB website, then you must obtain a translation of the appropriate English short form version.  A resource for obtaining a translation is the NIH Library.   Once you receive the translation, submit the translated short form and the certificate of accuracy to the IRB via iRIS using an amendment form.

The interpreter should ask the subject the embedded question and convey their response to the investigator obtaining consent. The investigator indicates the subject’s response on the long form ICF. Neither the interpreter nor the subject should record the response. This process should also be described in the consent note in CRIS or the research record.

Verbal assent should be obtained from the minor, and the process should be documented in the consent note.  NIH does not have translated short form assent documents. 

When assenting a non-English speaking older minor, if there is a translated long form and the IRB has approved a process that allows older minors to provide their assent on the long form, then the older minor can read and indicate their assent on the translated long form. Otherwise, verbal assent will be obtained and documented as above.

NIH investigators should document the consent process in the subject’s record, and describe the method used for communication with the subject and the specific means by which the subject communicated agreement to participate in the study (e.g., their verbal response and signing of the informed consent document).  Additional FAQs related to documentation of consent in CRIS are available at this internal  link.

The subject should be provided with the consent form in advance of the consent conversation.  After the consent process has been conducted and the investigator has responded to the subject’s questions, the subject signs the consent form noting the current date. The investigator documents the process in CRIS/medical record (or the research record if there is no medical record) in real time on the day of the consent conversation. When the signed/dated consent form is returned to the investigator who conducted the consent discussion, the investigator signs and dates the consent form with the date s/he received the signed the consent from the subject.  The investigator should then record another note in CRIS/research record indicating the updated status and send a copy to medical records (or research record if there is no medical record) and provide a copy of the completed consent form to the subject. The date that the subject signs the consent form is considered their “date on study.” If, after the subject has signed the consent form, specimens and/or data are collected locally for research purposes, no analyses of these specimens and/or data may occur until the investigator has verified that the subject has returned a signed and dated informed consent document, unless the IRB has granted a waiver of documentation of consent.  

If the protocol will include use of a remote consent procedure (e.g., by phone or videoconferencing), the process must be described in the protocol, and IRB approval must be obtained. Otherwise, if the plan to use the remote consent process is only temporary and for a few subjects (e.g., due to the pandemic), a single patient planned deviation request form may be submitted rather than a protocol amendment. If the investigator will be conducting such a process via telehealth, use only an approved synchronous video platform that meets required NIH security and privacy standards. For additional information, please refer to Policy 303 Intramural Program Telehealth Requirements which can be found here

Under the pre-2018 Common Rule regulation (45 CFR 46), unless the research qualified for specific exemptions, prospective consent from the potential subject for recording of their identifiable private information being obtained for recruitment was required, unless waived by the IRB.   For protocols subject to the revised (2018) Common Rule only, an IRB may approve certain screening or recruitment activities, or activities to determine eligibility, prior to obtaining informed consent.  These include:

  • Obtaining information through oral or written communication with the prospective subject, OR
  • Obtaining identifiable private information of identifiable biospecimens by accessing records or stored identifiable biospecimens.

In this event, the PI does not need to request a waiver of consent, but these activities that will occur prior to obtaining informed consent must be clearly described in the IRB approved protocol.  The solicited information should be limited to the minimum necessary for screening, or to determine study eligibility.

For minimal risk research being conducted remotely, the IRB may approve a web-based consent form or approve waiver of documentation of consent with no requirement for oral consent.  When a research study is subject to the Privacy Act, (i.e., will collect identifiable private information about a subject), the prospective subject must be provided with written Privacy Act notification. If an investigator wishes to conduct an oral consent process and receive a waiver of documentation of consent, they must still at least offer to provide the Privacy Act notification in writing. A description of the plan should be included in the consent section of the protocol. When the subject will not be registered as a patient at Clinical Center, please refer to the section labeled Privacy Language for Studies Conducted Outside of the Clinical Center in the  Consent Library on the OHSRP website for the Privacy Act information that should be provided to subjects.



Compliance ins and outs

OHRP has guidance on this topic: Unanticipated Problems Involving Risks & Adverse Events Guidance.  Please refer to Policy 801 and Guidance for Reporting Research Events and Non-compliance. If unsure, please contact your navigator or the IRBO for assistance.



Training

Review instructions for accessing training records by institute, by study, or individually. If you can’t find evidence of their training, you will need to collect the training certificates from each AI and keep it in your regulatory file for the protocol as evidence of their training. Once you know that all the AIs and other KRP have completed their training, then you can “certify” that they have done so. If you cannot certify that all KSP have completed the training, then please leave the checkbox blank and in the text box list the KSP that have not completed their training yet.

You can find these requirements in Policy 103, and additional information can be found in the accompanying guidance on Policy 103.

Log into your CITI account via the NIH portal by clicking here, and then scroll down to Required Training and then click on CITI Training.

Compliance and Training landing page on the IRBO website with identification of where to click for access to CITI training link

After accessing the portal as described in question 1, click on “Records” along the banner at the top of the page.

Box identifies where to click to access personal training records

A list of your completed courses will be displayed.  The list is easiest to view in full screen mode.

Example of a list of courses completed via the CITI NIH Portal

You must be sure that the email used for this account matches your NED AD email in order for your training records to download to iRIS. To find your NED AD email, go to the NIH directory on the NIH home page and click on Staff Directory in the upper right.

NIH home page with Staff Directory link highlighted

Enter your name

NIH Enterprise Directory (NED) page with boxes to identify where to enter name

Towards the bottom of the page that then opens, locate your NIH AD Email and be sure this is the email you use in your NIH CITI portal account.

NIH Enterprise Directory (NED) page with boxes to identify NIH AD Email

Log into your CITI account via the NIH portal by clicking here, and then scroll down to Required Training and then click on CITI Training.

Compliance and Training landing page on the IRBO website with identification of where to click for access to CITI training link

When you open the NIH CITI Portal, do NOT click on Add Institutional Affiliation. (You are all ready affiliated with the correct NIH affiliation since you logged on via this portal.)  Instead, click on “View Courses” to the right of National Institutes of Health

Highlights the location of the View Course button

Click on the button that says “View Courses” to the right of National Institutes of Health

Highlights the location of the View Course button

You will see either a screen with courses listed, or you will see this:

Institutional CITI courses for NIH

If the course you need to complete (e.g. Biomedical 101, Social & Behavioral Educational Modules or Good Clinical Practice Course (US FDA focus)) is not listed, scroll to the bottom of the screen and click on Add a Course.

Highlights the location of the Add a Course button

Pick the course you want to complete.

Indicates the most often required courses in CITI

When you click on a course, it is added under your Active Courses so that you can access the content

Once you complete the course, save your certificate in case a non-NIH sponsor needs to see it. Additionally, you may need to provide if a non-NIH IRB is overseeing your protocol since these entities will not have access to either the NIH CITI portal or to training records in iRIS.

If you have a completion certificate that shows that your training has not expired, but it does not have “National Institutes of Health” at the bottom left (see below), this means that you took the course through an alternate CITI portal that will not download records into iRIS, and you will need to transfer your training records into the correct NIH CITI portal in order to download into iRIS.  (See Q6 for instructions to transfer records)

A CITI course completion certificate. The box indicates the course was taken through the correct NIH CITI portal

First you need to establish an account in the correct NIH CITI portal. See instructions in Question 3 above.

Note that your CITI user ID will appear at the top right in the banner section. If you need to transfer records from another CITI account into the NIH CITI account, you will need this number. Do not confuse this with the numbers that are assigned to specific courses.

Box identifies where to find a user's CITI ID number

You will need to call CITI at 888-529-5929 and provide them with your NIH CITI portal ID and ask them to transfer them in from the non-NIH portal. E.g. If you are new to NIH, you may have completed GCP (US FDA focus) at your prior site, and you can transfer that completion record into the NIH CITI portal.

Log into your CITI account using the NIH CITI portal and follow the instructions in Questions 1 and 2 above.  Six hours after your records have transferred into the NIH CITI database, your training will download to iRIS. 

You can check to see if training has downloaded in iRIS after 6 hours by clicking here and signing into iRIS.  Then follow the instructions in the screen shots below.

Hover your mouse over “My Profile” in the upper right corner.

Indicates the location of the My Profile button

When the dropdown menu appears, click on “My Account”, under “Settings.”

Indicates the location of the My Account option

Under your Profile in the left column select “Training History.”

Indicates the location of the Training History option

A list of your completed training with expiration dates will be displayed.

An example list of completed training

If you still have questions, feel free to email Peg Sanders at margaret.sanders@nih.gov



IND Safety Report Submissions

IND Safety Reports are communications from a Sponsor that relay information about adverse events possibly related to an Investigational New Drug (IND) and do not necessarily reflect an event that occurred at an NIH site or as part of an NIH protocol. These reports are usually sent by email or through a web-based portal and may lack full context of the event. 

The event may have occurred on a different protocol that is using the same investigational product. This may mean that the participants on your trial may also be at risk of experiencing the same adverse event.  The FDA requires Sponsors to notify all participating investigators in a written IND Safety Report of “any adverse experience associated with the use of the drug that is both serious and unexpected” and “any finding from tests in laboratory animals that suggests a significant risk for human subjects.”1  Sponsors are required to “keep each participating investigator informed of new observations discovered by or reported to the sponsor on the drug, particularly with respect to adverse effects and safe use.”2  Additional helpful information can be found in Section II of the 2009 FDA Guidance titled “Adverse Event Reporting to IRBs — Improving Human Subject Protection: Guidance for Clinical Investigators, Sponsors, and IRBs.

1 21 CFR 312.32(c)(1)(i)(A),(B)

2 § 312.55(b

  • In some cases, NIH PIs will receive an IND Safety Report from a study that is not under oversight by the NIH IRB but that is using the same investigational product being used in the NIH study. The event may have occurred on an unrelated study or on the same multisite protocol being conducted at a non-NIH site that is being overseen by a non-NIH IRB.  The NIH PI must evaluate the Safety Report and determine if the event is a possible unanticipated problem (UP) or new information that might affect the willingness of subjects on the NIH study to enroll or remain in the study. If so, the event should be reported in iRIS for the NIH study via a Reportable Event Form (REF). The PI should also consider if a protocol amendment and an updated consent need to be submitted to the IRB for the NIH study based on the circumstances of the event being reported.   For the full definition of an Unanticipated Problem, please refer to OHSRP Policy 801 Reporting Research Events Section 4.10 “Unanticipated Problem Involving Risks to Subjects or Others.” (Refer to Question 5 for details on reporting in iRIS.) 
  • If the event in the IND Safety Report occurred on a protocol for which the NIH IRB has oversight, and it meets the definition of a UP or represents new information that might affect the willingness of a subject to enroll or remain in the study, the event should have been previously reported to the NIH IRB within 7 calendar days of an investigator becoming aware of the event. Only if there is new information from the Sponsor contained in the subsequent Safety Report that would change the PI’s determination of the event or if it has not previously been reported, should the IND Safety report be submitted to the NIH IRB via a REF.  At the time of the original REF submission, the PI should consider if a protocol amendment and an updated consent should also be submitted to the IRB based on the circumstances of the event being reported.  In most cases, when the NIH IRB is the IRB of Record, the amendment will be reviewed concomitantly with the REF. (Refer to Question 5 for details on reporting in iRIS.)

  • For the full definition of an Unanticipated Problem, please refer to the OHSRP Policy 801 Section 4.10: “Unanticipated Problem Involving Risks to Subjects or Others.
  • If the sponsor is requiring a protocol amendment or changes to the consent form as a result of the event, it is likely that the event meets the definition of an Unanticipated Problem or New Information.
  • The FDA Guidance referenced in question 2 above specifically addresses the increasing number of IND Safety Reports and contains examples of when events meet the definition of a UP and when they should be reported to the local IRB.
  • Section IIIA of the FDA Guidance provides information regarding whether an adverse event is an Unanticipated Problem and is titled, “How to Determine If an AE is an Unanticipated Problem that Needs to Be Reported.” This section includes full guidance and examples of events that would be considered Unanticipated Problems.

  • If the event occurred at a site under the purview of the NIH IRB and is a possible UP or new information that might affect the willingness of subjects to enroll or remain in the study, the event should have been reported in iRIS within seven calendar days of the event per OHSRP Policy 801 and before the Sponsor would have issued an IND Safety report.  The subsequent IND Safety report would only need to be submitted to the NIH IRB if the information provided by the Sponsor in the report changes the PI’s previous determination of the event or if the event had not been previously reported to the IRB.
  • If the event occurred on a protocol under the oversight of a non-NIH IRB, “New Information” should be selected in section 1.17 even if the PI determined that the event is a UP (See Question 4). In these cases, submission of the REF to the NIH IRB serves to provide the Board with the new relevant information in order to determine if the new information (e.g. a new risk was discovered with the investigational product being used on a different protocol) should be added to the NIH consent form and protocol that uses the same investigational product.

  • If the event occurred on a study overseen by a non-NIH IRB, only submit the IND Safety Report to the NIH IRB if the event meets the definition of a UP or represents new information that might affect the willingness of a subject to enroll or remain in the study. In that case, the event should be reported to the NIH IRB as New Information. (See question 5 regarding submitting REFs in iRIS.)
  • If the event occurred on a protocol overseen by the NIH IRB, the event should have already been submitted to the IRB within seven calendar days if it is a possible UP or relevant new information. The subsequent IND Safety report would only need to be submitted to the NIH IRB if the information provided by the Sponsor if the report changes the PI’s previous determination of the event or if the event had not been previously reported to the IRB.
  • In either case, OHSRP Policy 801 can be provided to the Sponsor and you may also reference the FDA Guidance. The Sponsor may request that investigators keep a log of the PI’s review and subsequent written assessment of IND Safety Reports provided by the Sponsor.

The guidelines for an IDE are the same, and the report should be submitted to the IRB if the event is a UP or New Information. (FDA Guidance Section IV: Reporting AEs To IRBs in Clinical Trials of Devices Under the IDE Regulations)



General Data Protection Regulation (GDPR) FAQs

The GDPR, which became effective May 25, 2018, is an EU regulation that relates to personal data that is collected in the European Economic Area (EEA), which includes 28 EU states as well as Norway, Iceland, Liechtenstein, and Switzerland.  It describes requirements for entities that collect, use and store personal data in the EEA (including study sponsors located in the EEA who will obtain personal data about study subjects located in the United States). It also requires that EEA entities inform subjects of their privacy rights and remedies related to their personal data.  If the entity processes personal data collected from individuals in the EEA, the GDPR may apply even if that entity is not in the EEA. See the next FAQ for information about current stance of the United States (U.S.) on the GDPR’s applicability to U.S. government agencies. 

The GDPR is not a U.S. law. The U.S. Government is not subject to GDPR, e.g., it does not automatically apply, because the U.S. is not part of the EEA. Further, Institutes and Centers do not have the legal authority to agree to follow GDPR and bind NIH to its terms.

There is an absence of an official recognition by the EEA that U.S. laws ensure an adequate level of protection (an “adequacy decision”) under the EEA standards. NIH is unable to use standard, GDPR-approved data protection clauses as they conflict with U.S. law and policy of federal agencies.

Due to uncertainties in the scope and interpretation of the GDPR requirements, the Department of State is advising U.S. government agencies not to sign, or agree to, contractual language that implies that the U.S. government complies with or will comply with the GDPR.

Any NIH investigator who is asked to provide GDPR language to participants on behalf of the sponsor should contact Heather Bridge (heather.bridge@nih.gov), who will facilitate next steps with the Office of the General Counsel (OGC). For example, current practice within the NIH Intramural Research Program is to provide a separate GDPR information sheet for participants rather than insert GDPR language into research consents.  Information sheets must be reviewed and approved by OHSRP, working with OGC, and approved by the IRB before being provided to subjects. Further, NIH investigators should not promise to or answer questions about the EU GDPR on behalf of the Sponsor. Instead, NIH investigators should refer the subject to the Sponsor’s point of contact or webpage that explains the rights of “data subjects,” which will be included in the above-referenced information sheet. 

Personal data under GDPR is more broadly defined than under the Common Rule and is explained in the European Union’s webpage “What is personal data?”

There are additional requirements for processing “special categories” of personal data.  Special categories of personal data comprise the following (and include data often collected for research purposes):

  • Racial or ethnic origin
  • Data concerning health
  • Data concerning a natural person’s sex life or sexual orientation
  • Genetic data
  • Biometric data used for the purpose of uniquely identifying an individual
  • Political opinions, religious or philosophical beliefs, or trade union membership.

Processing1 covers a wide range of operations performed on personal data, including by manual or automated means. It includes the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.

[1] Data “processing” as defined on the European Commission (EC) website, EU data protection rules

A controller alone or jointly determines the purposes and means of processing personal data (e.g. acts as a collaborator on a research project) while a processor processes personal data on behalf of the controller (e.g. a fee-for-service lab for a research projects). Both are regulated under the GDPR, but controllers have more responsibilities.

Examples of when the GDPR may apply to non-governmental entities (i.e., not to NIH) include the following if the organization/entity:

  • Monitors the behavior of individuals in the EEA
    • Conducting research with participants located in the EEA could involve activities that fall into this category (e.g. a US-based sponsor serves as a lead site for a multi-site protocol with sites in the EEA)
  • Offers goods or services to individuals in the EEA (irrespective of whether connected to payment) and could include examples related to research such as the following:
    • Clinical Trial Agreement between a US based sponsor and an EEA study site
    • US based sponsor provides investigational product (IP) to EEA study sites
  • Is established in the EEA and acts as a data controller or processor