A Data Protection Impact Assessment (DPIA) is required to be completed for high-risk data processing under the UK General Data Protection Regulation.
In line with guidance from the UK Health Research Authority, the DPIA can be conducted at the level of the Quality Management System (i.e. the policies and processes governing how all trials in the trials unit are run) rather than done per trial.
The DPIA can document key points relating to management of participation changes. This includes the approach of collecting only the data that is required for each trial (and no more than that).
The DPIA could also mention the implementation of, and justification for, limitations on trial participants’ rights as ‘data subjects’ (in particular, the limitation on their right to have data about them deleted once it has been collected in the trial).