For sponsors used to thinking of data protection as something the legal team handles after a study is designed, GDPR can come as an unwelcome surprise, because by the time lawyers get involved, some of the hardest questions are already baked into the protocol. Getting the basics right early saves significant pain later.
Six questions to answer before data collection begins
1. What is our lawful basis for processing this data?
Many teams assume that participant consent is always the right legal basis for processing research data. In practice, "public task" or "legitimate interests" routes are often more appropriate and more robust, particularly because consent under GDPR must be freely revocable, which can create real problems for studies that depend on retaining historical data. Knowing which basis applies, and why, is one of the first questions a sponsor should be able to answer.
2. Are we relying on a research exemption — and have we earned it?
UK GDPR includes specific provisions that make health and research data easier to work with than most people expect, most notably Article 89, which allows derogations from several standard processing requirements where research is concerned. But that exemption is conditional, not automatic: Article 89 requires "appropriate safeguards" for the rights of the people the data belongs to, and specifically requires respect for data minimisation. What it does not do is spell out what those safeguards actually have to look like. As one academic analysis of the article puts it, the regulation is silent on the specific measures needed to meet its own requirement, which leaves sponsors and their research ethics advisers to work out, and document, what "appropriate" means for their specific study rather than ticking a predefined box.
3. Are we collecting only what we actually need?
Data minimisation isn't a compliance checkbox, it's a design principle, and it's also the one specific safeguard Article 89 calls out by name. Every field you plan to collect should be traceable back to a research question that needs it. The smaller and more purposeful your dataset, the lower your risk profile, the simpler your governance, and, often overlooked, the easier your analysis becomes.
4. Where will data be stored, and who can access it?
This seems basic, but it is one of the most frequently underspecified areas in sponsor applications. Reviewers and regulators want to see a clear, proportionate plan: where data is held, who has access, what controls are in place, and what happens to it at the end of the study.
5. How long will we keep it, and what is our retention justification?
Retention periods should be defined before a study begins, not decided after it ends. Research data can legitimately be kept for longer than commercial data, but the retention period still needs to be explicitly justified and documented, with a clear plan for secure disposal at the end of it.
6. Does data cross borders — and are those transfers lawful?
Multi-site and multi-country studies add a further layer: where is data processed, where is it stored, and does it cross borders that require additional safeguards? These questions need answering at the design stage, not when a data transfer agreement lands on someone's desk mid-study.
The sponsor's real job
You don't need to become a data protection expert. What you do need is the discipline to ask "have we thought about this?" before a study begins, about lawful basis, minimisation, retention, and international flows, and to bring in independent expertise where the answer isn't obvious. That's particularly true for the research exemption itself: because the law deliberately leaves "appropriate safeguards" undefined, a sponsor who treats Article 89 as a box already ticked, rather than a judgement call that needs making and recording, is the one most likely to be asked to justify it later. The studies that run into trouble are rarely the ones where someone asked too many questions too early.
