Guidance document on how to approach the protection of personal

Official address Domenico Scarlattilaan 6 ● 1083 HS Amsterdam ● The Netherlands

Address for visits and deliveries Refer to www.ema.europa.eu/how-to-find-us

Send us a question Go to www.ema.europa.eu/contact Telephone +31 (0)88 781 6000

An agency of the European Union

18 June 2024

EMA/212507/2021

Guidance document on how to approach the protection of

personal data and commercially confidential information

while using the Clinical Trials Information System (CTIS)

Version 2

This document provides guidance to users on the revised Clinical Trials Information System (CTIS)

transparency rules and on the protection of personal data and commercially confidential information

(CCI) submitted to CTIS, the EU database established in accordance with the requirements of

Regulation (EU) No 536/2014 (CTR). It should be read in conjunction with its Annex I.

A Questions and Answers (Q&A) document is also available to users, see Q&A on the protection of

Commercially Confidential Information and Personal Data while using CTIS.

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 2/28

Document version

Publication date

Changes introduced in the text

Version 1.0

3 May 2023

N/A

Version 1.1

10 July 2023

- new chapter 4 on

management of commercially

confidential information (CCI)

in clinical trial information

submitted to CTIS

- new chapter 5 on GCP

inspection reports

Version 2

18 June 2024

- alignment with revised CTIS

transparency rules, including

removal of chapter 5 (no longer

applicable)

- new sections on the ‘historical

trials’ publication principles

and on transition trials

Principles of protection of

personal data and CCI

remained unchanged compared

to the former versions

Guidance document on how to approach the protection of personal data and commercially confidential information while using the 
Clinical Trials Information System (CTIS) Version 2 
  
Page 3/28 
 
Table of contents 
1. General information ................................................................................ 4 
1.1. Introduction......................................................................................................... 4 
1.2. Scope ................................................................................................................. 5 
1.3. Legal framework .................................................................................................. 5 
2. Rules of clinical trial information in CTIS pertaining to submission and 
publication .................................................................................................. 9 
2.1. Introduction......................................................................................................... 9 
2.2. Clinical trial information submitted to CTIS and disclosure rules ............................... 10 
2.2.1. Submission of structured data ........................................................................... 11 
2.2.2. Submission of documents for ‘for publication’ and ‘not for publication’ .................... 11 
2.3. Publication rules of the so called ‘historical trials’ .................................................... 11 
2.4. Transparency aspects of transition trials ................................................................ 13 
3. Management of personal data in structured data fields and in documents 
submitted to CTIS...................................................................................... 14 
3.1. Introduction....................................................................................................... 14 
3.2. The principles of anonymisation ........................................................................... 15 
3.3. Anonymisation of personal data in the document version ‘for publication’ .................. 16 
3.3.1. Anonymisation of personal data other than those of trial participants in the document 
version ‘for publication’ .............................................................................................. 17 
3.3.2. Anonymisation of personal data of trial participants in the document version ‘for 
publication’ .............................................................................................................. 18 
3.4. Documents not subject to publication: the principles of minimisation and 
pseudonymisation of personal data ............................................................................. 19 
4. Management of commercially confidential information (CCI) in clinical 
trial information submitted to CTIS ........................................................... 21 
4.1. Introduction....................................................................................................... 21 
4.2. Mechanisms available in CTIS to protect CCI.......................................................... 21 
4.3. Redaction of CCI in the document version ‘for publication’ ....................................... 22 
4.4. Relevant expertise and consistent decision-making process on the identification and 
redaction of CCI........................................................................................................ 23 
4.5. Information that may be considered CCI ............................................................... 24 
4.6. Information that may not be considered CCI .......................................................... 25 
4.6.1. Information that is already in the public domain or publicly available ..................... 25 
4.6.2. Information that does not bear any innovative elements ...................................... 26 
4.6.3. Information that would not qualify as commercially confidential ............................ 26 
Annex I: Guidance document on how to approach the protection of personal data 
and commercially confidential information while using the Clinical Trials 
Information System (CTIS)……………………………………………………………..………………..…….see Annex I 
 
 
 
 
 

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 4/28

1. General information

1.1. Introduction

The European Clinical Trials Regulation (EU) No 536/2014

(hereinafter ‘the Clinical Trials Regulation’

or ‘CTR’) repeals Directive 2001/20/EC on clinical trials

(CTs) and establishes a harmonised approach

to the submission, assessment, supervision, and reporting of clinical trials information with the

implementation of consistent rules throughout the European Union (EU)/European Economic Area

(EEA) Member States (MSs).

The Clinical Trials Regulation aims to foster innovation through harmonised content of clinical trial

applications submitted to Member States for assessment, to increase collaboration between the

Member States on the assessment of clinical trial applications, and to increase transparency and

availability of information on clinical trials and their results. Publicly available information foreseen by

the CTR should contribute to protecting public health and fostering the innovation capacity of European

medical research, while recognising the legitimate economic interests of sponsors and protecting

personal data.

In accordance with Recitals 66 and 67 and Articles 80 and 81 of the Clinical Trials Regulation, the

Agency, in collaboration with the Member States and the European Commission (EC), has the

obligation to set up and maintain an EU Portal as a single-entry point for the submission of data and

documents relating to clinical trials, and an EU Database containing the data and documents submitted

via the EU Portal. The EU Clinical Trials Portal and Database are jointly referred to as the EU Portal and

Database (EUPD).

To ensure transparency of clinical trials, the EU Database should be publicly accessible, and data

should be presented in an easily searchable format.

The EU database is a key instrument to ensure transparency of clinical trial information. The database

serves as the source of public information on assessed clinical trial applications, from the time of

decision until the submission of summary results. Access to this information is fundamental to enable

trust in the clinical research conducted in the European Union.

The EUPD and associated workspaces provide MSs, the European Commission, the Agency, sponsors,

and applicants

of a marketing authorisation with an effective network to streamline and facilitate the

preparation of the flow of information for the authorisation and supervision of clinical trials in the

EU/EEA.

The EUPD enables the submission and storing of clinical trial information and is one of the two

components of the Clinical Trials Information System (CTIS), also including the module for submission

of the Annual Safety Reports (ASRs). Throughout the document overall reference is made to the use of

CTIS.

To streamline the use of the already available information stored in other databases managed by the

Agency and to promote consistency and standardisation, CTIS consumes data from the following data

sources:

• Extended EudraVigilance Medicinal Product Dictionary (XEVMPD)

• Organisation Management Service (OMS)

Regulation (EU) No 536/2014 of the European Parliament and of The Council of 16 April 2014 on clinical trials on

medicinal products for human use, and repealing Directive 2001/20/EC.

Directive 2001/20/EC

Note that where this document refers to ‘sponsor users’ or ‘sponsor domain’: this may refer to, respectively as applicable,

users acting on behalf of marketing authorisation applicants/holders and related user domain areas in the system.

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 5/28

• Identity Access Management (IAM)

The interface of CTIS with other EMA data sources is shown in the figure below:

1.2. Scope

The CTR brings an unprecedented level of transparency in terms of publication of clinical trials

information for trials conducted in the EU/EEA. Access to this information, including trial results, is

important to allow prompt recruitment of patients at the site, avoid duplication of efforts and ultimately

foster innovation and promote clinical research in the European Union and the European Economic

Area.

This guidance document aims to help CTIS users to navigate through the system functionalities and

understand the main principles to be followed to enable protection of personal data and commercially

confidential information while using CTIS and publishing clinical trials data and documents. The former

version of this document described those system functionalities that were implemented under the

previous transparency rules. Those functionalities implied the possibility for CTIS users to defer the

publication of certain structured data and/or documents, for a specific timeframe depending on the

trial’s development phase. The principles of protection of personal data and CCI that were described in

the former versions of this document were not affected by this revision.

The following chapters provide information on:

• Description of CTIS structure and components, including a description of the functionalities and

publication rules for clinical trials information submitted to CTIS (chapter 2).

• Principles to be followed enabling protection of personal data as part of the clinical trial

information submitted to CTIS (chapter 3).

• Principles to be followed enabling protection of commercially confidential information (CCI) as part

of the clinical trial information submitted to CTIS (chapter 4).

1.3. Legal framework

The CTR sets out requirements for the protection of personal data, CCI and increased transparency of

clinical trials in the EU/EEA. These requirements apply to information contained in the EU Database.

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 6/28

Data and documents defined in the CTR are submitted via the EU Portal, stored in the EU Database and

subject to the disclosure rules.

Article 81(4) of the CTR states that the EU Database shall be publicly accessible unless, for all or parts

of the data and information contained therein, confidentiality is justified on any of the following

grounds:

a) protecting personal data in accordance with Regulation (EU) 2018/1725

;

b) protecting commercially confidential information, in particular through taking into account the

status of the marketing authorisation for the medicinal product, unless there is an overriding public

interest in disclosure.

c) protecting confidential communication between Member States in relation to the preparation of the

assessment report.

d) ensuring effective supervision of the conduct of a clinical trial by Member States.

Recital 68 of the CTR states that: in general, the data included in a clinical study report should not be

considered commercially confidential once a marketing authorisation has been granted, the procedure

for granting the marketing authorisation has been completed, the application for marketing

authorisation has been withdrawn. In addition, the main characteristics of a clinical trial, the conclusion

on Part I of the assessment report for the authorisation of a clinical trial, the decision on the

authorisation of a clinical trial, the substantial modification of a clinical trial, and the clinical trial results

including reasons for temporary halt and early termination, in general, should not be considered

confidential.

Structured data fields and documents from the clinical trial application dossier can be made public after

the decision on the clinical trial has been taken (Article 81(5) of the CTR), unless there is an overriding

public interest for a particular clinical trial to do so earlier. This applies only in exceptional

circumstances where the general public interest in having information made publicly available may

outweigh considerations for the information to remain confidential (e.g. in case of declared pandemic,

public health emergency). Thus, only applications on which a decision has been issued by a Member

State concerned (MSC) will be made public. This applies to any decision outcome, i.e., authorisation,

authorisation with condition(s) or whether the authorisation is refused.

Information on initial applications which are only for assessment of Part I of the dossier (Article 11

applications) will not be made public until a Part II has been submitted to the MSC and a decision has

been issued by at least one of the MSC(s).

Applications which are not validated, that are lapsed, or those withdrawn by the sponsors before a

decision is issued will not be made public.

In addition, the following provisions related to the protection of personal data and CCI should be also

considered as part of the guidance provided in this document.

Data protection related provisions:

Article 93 of the CTR expressly makes reference to EU data protection legislation i.e., to the now

applicable General Data Protection Regulation (GDPR) with reference to the processing of personal data

carried out in MSs (including processing by regulatory authorities and ethics committees) as well as

sponsors, marketing authorisation applicants or holders and the European Data Protection Regulation

Article 81(4) of Regulation EU (No) 536/2014 refers to Regulation (EU) No 45/2001 replaced by Regulation 2018/1725,

the EUDPR

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 7/28

(EUDPR), which applies to the processing of personal data by the European Commission and the

Agency.

CTR details the need for the protection of personal data as follows:

• Recital 67: No personal data of data subjects participating in a clinical trial should be recorded in

the EU database. The information in the EU database should be public, unless specific reasons

require that a piece of information should not be published, in order to protect the right of the

individual to private life and the right to the protection of personal data, recognised by Articles 7

and 8 of the Charter (…).

• Article 56(1): All clinical trial information shall be recorded, processed, handled, and stored by the

sponsor or investigator, as applicable, in such a way that it can be accurately reported,

interpreted, and verified while the confidentiality of records and the personal data of the subjects

remain protected in accordance with the applicable law on personal data protection.

• Article 56(2): Appropriate technical and organisational measures shall be implemented to protect

information and personal data processed against unauthorised or unlawful access, disclosure,

dissemination, alteration, or destruction or accidental loss, in particular where the processing

involves the transmission over a network.

• Article 81(2): The EU database shall be established to enable cooperation between the competent

authorities of the Member States concerned to the extent that it is necessary for the application of

this Regulation and to search for specific clinical trials. It shall also facilitate the communication

between sponsors and Member States concerned and enable sponsors to refer to previous

submissions of an application for authorisation of a clinical trial or a substantial modification (…).

• Article 81(4): The EU database shall be publicly accessible unless, for all or part of the data and

information contained therein, confidentiality is justified on any of the following grounds:

(a) protecting personal data in accordance with Regulation (EC) No 45/2001.

• Article 81(6): The EU database shall contain personal data only insofar as this is necessary for the

purposes of paragraph 2.

• Article 81(7): No personal data of subjects shall be publicly accessible.

• Article 93(1): Member States shall apply Directive 95/46/EC

to the processing of personal data

carried out in the Member States pursuant to this Regulation.

• Article 93(2): Regulation (EC) No 45/2001

shall apply to the processing of personal data carried

out by the Commission and the Agency pursuant to this Regulation.

Commercially Confidential Information (CCI) related provisions:

• Recital 68 clarifies that, for the purposes of the CTR, in general the data included in a clinical

study report should not be considered commercially confidential once the procedure is finalised.

• For clinical trials intended to be used in a marketing authorisation application in the EU/EEA,

Article 37(4) of the CTR requires that the applicant for a marketing authorisation submits the

clinical study report to the EU database within 30 days after the day the marketing authorisation

has been granted, the procedure for granting marketing authorisation has been completed, or the

applicant has withdrawn the application.

Replaced by Regulation (EU) 2016/679 (GDPR).

Replaced by Regulation (EU) 2018/1725 (EUDPR).

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 8/28

• Article 81(4) of the CTR states that: The EU database shall be publicly accessible unless, for all or

part of the data and information contained therein, confidentiality is justified on any of the

following grounds: ………. (b) protecting commercially confidential information, in particular

through taking into account the status of the marketing authorisation for the medicinal product,

unless there is an overriding public interest in disclosure.

Overriding public interest anticipating the publication of clinical trials information means that the

general public interest in having information made publicly available may outweigh considerations that

the same information should remain confidential. It applies in exceptional circumstances only (e.g. in

case of declared pandemic, public health emergency).

In the context of inspection reports, the CTR sets out the following:

• Article 53(2): The sponsor shall submit to the Member States concerned, through the EU portal,

all inspection reports of third country authorities concerning the clinical trial.

When requested by a Member State concerned, the sponsor shall submit a translation of the

report or of its summary in an official language of the Union indicated in the request.

• Article 78(6): Following an inspection, the Member State under whose responsibility the inspection

has been conducted shall draw up an inspection report. That Member State shall make the

inspection report available to the inspected entity and the sponsor of the relevant clinical trial and

shall submit the inspection report through the EU portal.

• Furthermore, Article 13 of the Commission Implementing Regulation (EU) 2017/556 of 24 March

2017

states (…) The inspection reports submitted through the EU portal shall not contain

personal data of clinical trials' subjects.

• The implementation of the disclosure rules of the Clinical Trials Regulation is without prejudice to

the application of Regulation (EC) No 1049/2001 and citizens’ right to request documents under

that Regulation.

COMMISSION IMPLEMENTING REGULATION (EU) 2017/ 556 - of 24 March 2017 - on the detailed arrangements for the good

clinical practice inspection procedures pursuant to Regulation (EU) No 536 / 2014 of the European Parliament and of the Council

(europa.eu).

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 9/28

2. Rules of clinical trial information in CTIS pertaining to

submission and publication

2.1. Introduction

This chapter describes the type of clinical trial information, including data and documents, submitted to

CTIS and how this information is managed to protect personal data and commercially confidential

information (CCI), while ensuring publication principles are met as per revised CTIS transparency

rules.

Principles of protection of personal data and CCI should be followed while using CTIS, as required in

the CTR. The clinical trial information flow starts in the CTIS secure domain with an initial clinical trial

application submitted by the sponsor, or delegated entities, to ask for authorisation of a clinical trial in

the EU/EEA and the corresponding evaluation performed by the Member States concerned (MSC).

Following the evaluation of the application, a decision is issued by each MSC for the application, on

whether the trial is authorised, authorised with conditions, or not authorised. After a decision has been

issued by the MSC, those data and documents submitted to CTIS for the trial will be made available to

the public, depending to the trial’s development phase and population age, in line with the revised

CTIS transparency rules.

After the authorisation is obtained, the trial may start, and the MSC will supervise the trial running in

their territory. After the initial application, other application types may be submitted by the sponsor for

the same trial such as, substantial modifications to the initial application or the addition of new MSC

which are also subject to the assessment and decision by the relevant MSC.

In addition to the above, non-substantial modifications to the content of the application dossier can be

applied by the sponsor during the trial life cycle up to its completion, as well as notifications to the

MSC by the trial, of events of relevance, such as the occurrence of a serious breach or an urgent safety

measure. The MSC supervise the conduct of the trial in their territory with different means, including

monitoring and assessing safety reports such as Annual Safety Report (ASRs), performing ad hoc

assessments including for safety related matters, performing Good Clinical Practice (GCP) inspections,

and having the possibility to apply corrective measures to request modifications, suspend the trial or

revoke the trial authorisation, for example.

The sequence of events occurring during the trial life cycle might require the collection and processing

of personal data for the purposes set out in Article 81(2) of the Clinical Trials Regulation. Data and

documents provided by the users in CTIS may also contain information that is considered commercially

confidential. As defined in Article 81(4) of the CTR, personal data of trial participants, as well as other

types of personal data, and commercial confidential information should be exempted from publication.

Within CTIS secure domains for sponsors and Member States, users can have access to clinical trial

data and documents for the trials of their concern. These users are clinical trial sponsors or delegated

parties, marketing authorisation applicants/holders, EU/EEA Member States (encompassing responsible

national competent authorities and Ethics Committees), the European Commission and the Agency.

Access to data and documents in CTIS secure domain is managed through the user’s profile.

The image below represents the different domains in CTIS, including sponsors’ and authorities’

domains with secure access and a public domain.

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 10/28

CTIS therefore allows for the submission of required information in the secure domain and provides

users access depending on their user profile, thus protecting personal data and the legitimate

economic interest of sponsors for what concerns CCI. The following sections of this chapter describe

the principles and timelines of public disclosure of those submitted data and documents.

2.2. Clinical trial information submitted to CTIS and disclosure rules

The detailed list of structured data and documents that are, or are not subject to publication is

specified in documents on CTIS application fields and Notifications and Results. Table I and table II of

the Annex I to this document provide a list of the types of data and documents submitted to CTIS that

are subject to publication, in line with the revised CTIS transparency rules. Their disclosure timelines

are also mentioned, which depend on the trial category, on the population age (in case of category 1

trials) and on the trial phase (in case of category 2 trials that are integrated phase 1 and 2). The trial

category is chosen by the sponsor when filling in the ‘form’ section of the application, based on

definitions provided in table V of Annex I.

Exceptions to those disclosure rules apply to all trials submitted before 18 June 2024 (so called

‘historical trials’), which have only their structured data published; moreover, for those trials

documents submitted through part I Non-Substantial Modifications and additional member state

applications are also not published: see section 2.3. of the present document and table IV of Annex I.

A list of structured data fields and documents placeholders that are not subject to publication is

provided in Table VI of Annex I: those type of submitted information will never be made publicly

available (e.g. details of the legal representative, Investigator’s Brochure, IMPD documents,

assessment reports). The partial initial applications are not made public until a decision is issued by at

least one of the MSC. Applications which are not valid, that are lapsed, or those withdrawn by the

sponsors before a decision is issued will not be made public.

Note that only most recent authorised application of any trial (or submitted, in case of Non-Substantial

Modifications), as well as any ‘not authorised’ initial application, is made publicly available. Data and

documents of authorised applications that are then superseded by subsequent authorised modifications

are no longer disclosed, to increase the public’s readability of data; their conclusion and decision dates

that are however subject to publication, for information purposes. Non authorised Substantial

Modifications and Additional member state concerned applications, are not made publicly available:

refer to Table IV of Annex I.

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 11/28

2.2.1. Submission of structured data

There is no equivalent of having a version ‘for publication’ and ‘not for publication’ in the structured

data fields populated by CTIS users, as these fields cannot be redacted. Therefore, sponsors and

Member States users should be mindful of this aspect when populating structured data fields that are

subject to publication (as per Table I of Annex I), to protect personal data and commercially

confidential information.

Of note, the main characteristics of a clinical trial, the conclusions, and the decision on the

authorisation of a clinical trial, the substantial modification of a clinical trial, and the clinical trial results

including reasons for temporary halt and early termination, in general, should not be considered

confidential

2.2.2. Submission of documents for ‘for publication’ and ‘not for publication’

Sponsors should submit high quality documentation to CTIS to enable a proper assessment by the

MSC.

For all those documents that are in scope of publication as per revised CTIS transparency rules (see

Table II of Annex I), users need to provide a document version ‘for publication’, where Personal data

and Commercially Confidential Information should be properly redacted or should not appear. This

version will be published in line with principles and timelines foreseen in the revised transparency

rules. For more information on what can be considered personal data and CCI, as well as on how to

remove them, see chapters 3. Error! Reference source not found.and 0

Please note: any document inadvertently uploaded ‘for publication’ into the relevant CTIS document

upload sections will be published; for example, if an IB is uploaded into the SmPC section of a

Category 2 or 3 trial, this IB will be made public if not corrected by the sponsor before the decision on

the application.

A corresponding version ‘not for publication’ is also to be provided for MSC assessment in case a

redaction of personal data and CCI occurred in the version ‘for publication.’ Submission of both

versions depend on the document type and content, and it may not be required in every instance (for

example: in case of documents where no redaction is needed because there are no personal data or

CCI, e.g. SmPC, providing only the version ‘for publication’ is sufficient). When both versions are

required, these documents should be provided at the same time. In principle, no other alteration of

documents’ content should occur between the document version ‘for publication’ and ‘not for

publication,’ where the difference should be only personal data and commercially confidential

information being redacted.

With respect to those documents that are not subject to publication, note that quality and non-quality

documents need to be submitted as separate documents. This includes the IMPD-Q, Scientific Advice -

Quality and Quality RFI response documents. CTIS user roles depend on maintaining separate quality

documents to ensure only authorised users can view quality information.

2.3. Publication rules of the so called ‘historical trials’

The ‘historical’ trials are trials submitted to CTIS before the 18 June 2024 whether they were

previously fully publicly available or not, and with/without deferrals (i.e. whether the sponsor asked to

defer the disclosure of certain documents uploaded in the placeholders ‘for publication’, see section

1.2. ). Those trials, including subsequent applications submitted on them, are subject to specific

publication rules, designed to avoid unintended disclosure of confidential information contained in

Recital 68 of the Clinical Trials Regulation.

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 12/28

documents which could have been subject to deferrals under the previous transparency rules. This

section and table IV of Annex I summarise those rules, which for technical reasons are applicable to all

historical trials, regardless of whether a deferral was applied in the past.

As of 18 June 2024, for those trials:

• Structured data fields: published in line with the timelines and principles of the revised CTIS

transparency rules (see Annex I, table I).

• Documents: all documents contained in applications submitted to CTIS before 18 June 2024 are

not published

. This applies to all historical trials in the system, and regardless of the previous use

of deferrals or publication status.

As of 18 June 2024, if submitted on historical trials, the following kinds of applications will trigger the

publication of those documents that are in scope of the application and of the revised rules:

• Substantial Modifications (part I and/or part II)

• Non-Substantial Modification part II

• Additional Member State (triggering publication of part II docs only)

It is therefore expected that the sponsor protects CCI and personal data on those documents in scope

of publication, as per table II of Annex I. Note that CTIS considers all documents in scope of that

application, regardless of the fact that their update was in scope of the modification or not.

As of 18 June 2024, if submitted on historical trials, the following kinds of applications will not trigger

the publication of their documents:

• Non-Substantial Modification Part I

• Additional Member State (not triggering publication of part I docs)

Those two types of applications do not foresee the possibility of updating (and therefore redacting)

protocol and protocol synopsis, that are in scope of the application and that would be published under

the revised transparency rules. For this reason, for historical trials, all part I documents belonging to

those applications will never be published (this includes SmPC translations for NSM and protocol

translations for AMSC applications, for technical reasons). Note that the above is only applicable for

historical trials. Part I of NSM and AMSC applications of non-historical trials is published according to

timelines and content defined in the revised transparency rules.

Example: a multinational trial’s application submitted before 18 June 2024 will display the latest

version of its structured data in line with revised transparency rules, while its documents are not

published; as of 18 June, for this trial:

• a SM Part I is submitted with the purpose of updating the IB: protocol and synopsis will be subject

to publication as per revised rules

• a NSM Part I is submitted: structured data will be updated in line with the revised rules, documents

will not be published

• a SM Part II or a NSM Part II is submitted, concerning only one member state: part II documents

are subject to disclosure rules only for that member state (part II documents concerning other

member states will continue not to be disclosed).

Including documents updated as part of an RFI response that is submitted after 18 June 2024, on applications submitted

before this date.

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 13/28

2.4. Transparency aspects of transition trials

Sponsors are encouraged to transition clinical trials from CTD to CTR based on available existing

guidance documents. In particular, the Guidance for the Transition of clinical trials from the Clinical

Trials Directive to the Clinical Trials Regulation

clarifies that the redacted documents to be published

with the administrative transitioning applications are the protocol, subject information sheet and

informed consent form, in addition to submission of the non-redacted documents already approved by

the MSCs. This is valid for all trials’ categories, except for category 1 trials, where it is sufficient to

provide a redacted version of the protocol only, and a redacted version of the subject information

sheet and informed consent form should not be provided, in line with the revised transparency rules

(see Annex I, table I). In place of redacted versions for other parts of the application dossier, a

document referring to the National Competent Authority (NCA) and/or ethics committee who assessed

and gave a positive opinion on the clinical trial under the CTD can be uploaded in CTIS

. At the time of

submission of subsequent modifications, the dossier can then be updated with the documents for

publication falling within the scope of the application and of the revised transparency rules, e.g.,

including patient facing documents, synopsis and recruitment arrangements. For these documents, the

same redaction principles as described in the present document apply.

Guidance for the Transition of clinical trials from the Clinical Trials Directive to the Clinical Trials Regulation

CTCG Best Practice Guide, see CLINICAL TRIALS COORDINATION GROUP (CTCG) ‘key documents list’

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 14/28

3. Management of personal data in structured data fields and

in documents submitted to CTIS

3.1. Introduction

Personal data is any information that relates to an identified or identifiable living individual. Different

pieces of information, which collected together can lead to the identification of a particular person, also

constitute personal data

The protection of personal data processed in CTIS is a joint responsibility of the EMA, the European

Commission, the Member States (including National Competent Authorities and Ethics Committees)

and commercial, non-commercial organisations including academia acting as sponsors of clinical trials

and marketing authorisation applicants/holders. This joint responsibility is documented in the Joint

Controllership Arrangement (JCA) for CTIS

, which includes in its Annex II the EMA Data Protection

Notice regarding personal data processing in the Clinical Trials Information System (CTIS), addressed

to data subjects namely CTIS users, sponsors, principal investigators, trial participants and that

explains the purpose of the processing of personal data, the way CTIS collects, handles and protects

personal data, how the information is evaluated and the rights of data subjects in relation to their

personal data.

The processing of personal data in CTIS, entailing the collection, publication and archiving of clinical

trial information in documents and structured data fields is necessary for the management and

functioning of the Agency and the performance of its tasks carried out in the public interest mandated

by Union law, as joint controller of the CTIS, which includes the EU Portal and Database, for the

effective materialisation of the objectives of the Clinical Trials Regulation. Therefore, this data

processing by the Agency is lawful under Article 5(1)(a) of the EUDPR and justified on the grounds of

public interest.

In addition, the Member States, the European Commission, the commercial, non-commercial

organisation including academia acting as sponsors of clinical trials and marketing authorisation

applicants/holders, are also joint controllers in the CTIS. They are legally obliged to collect and upload

relevant documents in the CTIS. Therefore, the data processing by the Member States and the

European Commission also relies on the lawful ground of public interest under Article 6(1)(e) of the

GDPR and Article 5(1)(a) of the EUDPR, respectively.

In the case of sponsors and marketing authorisation applicants/holders their activities in CTIS and the

related personal data processing is necessary for compliance with their legal obligations under the

Clinical Trials Regulation in accordance with Article 6(1)(c) of the GDPR.

In the context of transparency of clinical trials in CTIS, to protect the rights of trial participants to

private life and the right to the protection of personal data, Article 81(7) of the CTR sets out that no

personal data of trial participants shall be publicly accessible, which is further reinforced by Article

81(4) of the CTR that states that the CTIS shall be publicly accessible except where justified to protect

the confidentiality of personal data.

Personal data, including special categories of personal data of trial participants, should only be

provided in CTIS as strictly necessary to allow for the scientific and regulatory assessment of the

documents submitted to Member States.

https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en

https://www.ema.europa.eu/en/documents/other/joint-controllership-arrangement-regard-clinical-trials-information-

system-ctis_en.pdf

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 15/28

Chapter 2.1 of the EMA Privacy Statement (Annex II of the CTIS JCA

), referring to the personal data

in documents provided by the joint controllers in CTIS, states the following: ‘Should any of these

documents contain personal data, as applicable and as required in light of Article 81(2) of Regulation

(EU) No 536/2014, this can be provided in the version of the documents ‘not for publication’. The

version of the documents ‘for publication’ should not contain personal data. To ensure that no personal

data are made public these data should be anonymised, in the versions of documents ‘for publication’

with a few exceptions: see section 3.3.

3.2. The principles of anonymisation

Anonymisation refers to information which does not relate to an identified or identifiable natural person

or to personal data rendered anonymous in such a manner that the data subject is not or no longer

identifiable (Recital 26 of GDPR and Recital 16 of EUDPR). The processing of such anonymous

information is not subject to the provisions of the GDPR/EUDPR.

To determine whether a natural person is identifiable, account should be taken of all the means likely

to be used, such as singling out, either by the controller or by another person to identify the natural

person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify

the natural person, account should be taken of all objective factors, such as the costs of and the

amount of time required for identification, taking into consideration the available technology at the

time of the processing and technological developments (Recital 26 of GDPR and Recital 16 of EUDPR).

The Article 29 Working Party has issued an Opinion on Anonymisation Techniques

. The Opinion

discusses that the effectiveness of anonymisation techniques should be checked against three criteria:

i. is it still possible to single out an individual,

ii. is it still possible to link records relating to an individual, and

iii. can information be inferred concerning an individual?

The Opinion also recognises that the use of one individual anonymisation technique alone may not

meet with certainty, in every instance, the criteria of effective anonymisation. However, some of the

criteria may be met in whole or in part by a given anonymisation technique, therefore a combination of

techniques should be carefully applied together to enhance the robustness of the outcome.

Combination of anonymisation techniques could be used, for example, in clinical study reports. For

documents part of the CTIS application, which are expected to contain mainly direct identifiers,

redaction would be most likely the anonymisation technique of choice.

An anonymisation report describing the anonymisation techniques used is not expected to be provided

in CTIS, unless specifically requested.

When establishing a process for ensuring an adequate level of anonymisation, the following factors

may be considered:

• the likelihood of re-identification being attempted.

• the likelihood the reidentification would be successful.

• the anonymisation techniques which are available to use

https://www.ema.europa.eu/en/documents/other/joint-controllership-arrangement-regard-clinical-trials-information-

system-ctis_en.pdf

Opinion 05/2014 on Anonymisation Techniques, 0829/14/EN WP216, available : https://ec.europa.eu/justice/article-

29/documentation/opinion-recommendation/files/2014/wp216_en.pdf

Ibid, Executive Summary.

Ibid, Section 5.2.

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 16/28

• the quality of the data after anonymisation has taken place and whether this will meet the needs

of the organisation (and the public) using the anonymised information. For example, once the

anonymisation has been completed, an analysis of the interpretability of the anonymised data and

information could be conducted to ensure they still remain meaningful and having utility for the

public.

3.3. Anonymisation of personal data in the document version ‘for publication’

Personal data of individuals including names and surnames are captured, as applicable, in CTIS

documents in the version ‘not for publication’ and should be anonymised in the document version ‘for

publication’ (see table III of Annex I). However, exceptions applied to this rule, see 3.3.1.

Regarding anonymisation of personal data in documents submitted to CTIS, the following principles

should be taken into account:

• Anonymisation of personal data in the documents submitted to CTIS ‘for publication’ should occur

outside of CTIS and be applied consistently across all documents.

• The publication of documents in CTIS occurs at the time of decision on an application, or later

depending on the trial category (or population age, in case of Category 1 trials), see Table II of

Annex I, in line with the principles defined in the revised CTIS transparency rules.

• Where only one version of a document is provided in CTIS secure domain, namely the version ‘for

publication’ this version will be subject to publication and used for review by the MSC(s), in the

absence of a version ‘not for publication.’

• It is the sole responsibility of CTIS users to ensure the quality, accuracy, and adequacy of

anonymisation applied and that the document versions ‘for publication’ are anonymised in

accordance with the applicable process agreed within their organisation.

• CTIS does not automatically verify if anonymisation has been applied in the version of documents

intended for publication.

• When progressing with the submission of the documents via CTIS, the authorised user confirms

that the recording, storage, and publication of the documents in question are in accordance with

Union data protection legislation. A dedicated template is available for use

• The Agency, as the system administrator, is entitled to delete corrupted, incorrect, or unlawfully

processed data, including removing information from CTIS public domain. This refers to requests

for removal raised by the parties

that uploaded the document in CTIS. Such requests can be

raised by contacting the dedicated EMA service desk

• In addition, EMA can delete incorrect information identified in the public domain, in which case

EMA will inform the party that has provided the document, that an amendment to the published

document is needed. The Agency, or other joint controllers in accordance with the joint

controllership arrangement, can also edit the inaccurate or outdated information contained in the

CTIS secure domain to comply with Union data protection legislation.

• The Agency, the European Commission, the Member States, commercial and non-commercial

organisations, including academia acting as sponsors and/or marketing authorisation

applicants/holders, have joint responsibilities in submitting clinical trial data and documents in

https://health.ec.europa.eu/system/files/2022-09/compliance_reg2016_679_template_en.pdf

Deletion of incorrect/corrupted documentation should not occur on routine basis but rather on justified grounds to

remove corrupted/unlawful information. This should not be seen as an instrument for modification / protection of personal

data or commercial confidential information provided by CTIS users that retain the ultimate responsibility.

https://support.ema.europa.eu/esc?id=emp_taxonomy_topic&topic_id=2111dcb6c39d9d10e68bf1f4e40131ee

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 17/28

accordance with the Clinical Trials Regulation and Union data protection legislation. They also have

joint responsibilities towards the data subjects and should have clear, defined processes in place

to deal with any personal data breaches.

• Other shared aspects of CTIS falling under the joint controllership scheme, such as the handling of

data subjects’ rights, is addressed in a published joint controllership arrangement (JCA) for

CTIS.

In addition to the EMA data protection notice (Annex II of JCA

), Table II in the Annex to this

document should be consulted for a more detailed description of the documents submitted via CTIS

that are subject to publication and Table III of the same Annex for the type of personal data that they

might typically contain.

In the context of anonymising personal data within the CTIS documents ‘for publication,’ it is

paramount to differentiate between:

• Personal data, other than those of trial participants, such as of staff of the sponsor and of the

marketing authorisation applicant/holder, author of a document (even if included as metadata),

principal investigators, etc.

• Personal data of clinical trial participants

The following sections define the two different approaches to be followed for those data, in the

documents that are and that are not subject to publication.

3.3.1. Anonymisation of personal data other than those of trial participants in the document

version ‘for publication’

The anonymisation of personal data of individuals other than those of trial participants in the document

version ‘for publication’ can be achieved by applying redaction as the sole anonymisation technique.

Redactions can be performed by using any available tool which ensures that the redacted information

is irreversibly blacked out by applying a permanent and unremovable overlay and, at the same time,

making the redacted text unreadable and unsearchable in the document.

Redaction of pre-specified identifiers, e.g., names, surnames, telephone numbers, can be done

manually and/or automatically with software functionalities which enable the user to identify the pre-

specified identifiers intended for redaction.

Signatures should never be disclosed in the document version ‘for publication.’ Personal data of the

author of a document, included as part of the metadata of a file, should equally be removed prior to

uploading the document in CTIS secure domain and subsequent publication of the document.

Instructions are available in dedicated CTIS training material, Module 02 – Guide on CTIS common

features

The following exceptions apply to names and surnames that should be disclosed in the document

version ‘for publication’:

• Names and surnames of principal investigators, head of the clinic/institution or other responsible

person of the trial site, which are subject to publication as explained in the revised CTIS

transparency rules.

https://www.ema.europa.eu/en/documents/other/joint-controllership-arrangement-regard-clinical-trials-information-

system-ctis_en.pdf

Section 3 in training module 02: clinical-trials-information-system-ctis-common-features-ctis-training-programme-

module-02_en.pdf (europa.eu)

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 18/28

• On the clinical study report: the full name of the sponsor and coordinating investigator signatories

of the clinical study report and the identities of the principal investigator(s) who conducted the

trial, which are also subject to publication as explained in the revised CTIS transparency rules.

Note: the relevant signatures should, instead, be anonymised.

All contact details (i.e. e-mail addresses and telephone numbers) of the above-mentioned individuals

should be their professional contact details or functional contact details. If applicable (i.e. in the case of

the principal investigator) those details are also published through the relevant structured data fields.

These contact details should, therefore, not be redacted, or otherwise anonymised, in the documents

uploaded in CTIS. Private contact details should not be provided in structured data fields in CTIS and if

included in the documents, they should be redacted in the published documents. Note that the

scientific and public sponsor contact details are also expected to be functional and not containing

personal data (for example: clinicaltrials@companyX.com).

3.3.2. Anonymisation of personal data of trial participants in the document version ‘for

publication’

Personal data of trial participants may only appear, as applicable, in CTIS documents that are not

subject to publication and encompass personal data in a pseudonymised format (e.g., clinical trial

subject ID number) as well as indirect identifiers such as weight, height, age, gender, etc. These

personal data are to be anonymised in any document version ‘for publication’ (see table III of Annex

I).

Protection of personal data of trial participants in the document version ‘for publication’ should be

achieved by using the entire range of available anonymization techniques that might require

modification of the text, as redaction might not be the most suitable anonymisation technique to retain

a meaningful level of data utility in all cases. The following elements should be considered when

applying anonymisation in the documents to be published:

• The choice of anonymisation techniques

In the context of CTIS, no specific anonymisation methodology to protect personal data of clinical trial

participants is prescribed, acknowledging that each anonymisation technique has its own strengths and

weaknesses. The robustness of each anonymisation technique is based upon the anonymisation criteria

and will help in identifying the most suitable technique (or combination of different techniques) to

establish an adequate anonymisation process for a given document or set of documents.

• Data utility

Personal data of trial participants could be present in documents that are not subject to publication

(e.g., notification of serious breaches, unexpected events or urgent safety measures, clinical study

reports ‘not for publication’ version). It should be noted that it is equally important to preserve data

utility in the public version of the documents, as much as possible, whilst ensuring adequate

anonymisation. Besides, a quantitative approach to the measurement of the risk of re-identification

could be favoured. This is particularly important in documents such as the final summary of results.

• The sensitivity of the data

The specificities of the relevant data should be taken into consideration when selecting the most

appropriate anonymisation technique(s). For example, clinical trials conducted on rare diseases and/or

on small populations may carry a high risk of re-identification of trial participants. A thorough risk

assessment should be performed for such scenarios and the anonymisation of personal data should be

adapted to the identified risk. Moreover, such an approach is also applicable to genetic information and

low frequency events (e.g., rare events, extreme values, unusual treatments, pregnancy outcomes).

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 19/28

For a more detailed description of the available anonymisation techniques and their strengths and

weaknesses refer to Article 29 Working Party Opinion on Anonymisation Techniques

. The same

principles will apply to the protection of personal data of trial participants in the documents submitted

to CTIS.

3.4. Documents not subject to publication: the principles of minimisation and

pseudonymisation of personal data

Personal data, if needed during the scientific and regulatory review carried out by the MSC, should be

included in the document version ‘not for publication.’ Examples can be found in section 2 of the Q&A.

This will enable the MSC to have all the necessary information for evaluation. The following principles

should however be followed when including personal data in any document that is uploaded to CTIS.

• Data minimisation

Principles of minimisation should be followed when providing personal data, only as needed in light of

Articles 81(6) referring to 81(2) of the CTR. This also applies also to personal data of the author of a

document, included as part of the metadata of a file, which should be removed prior to uploading the

document in CTIS secure domain. Signatures may also be reduced to a minimum, unless required by

the MSC. Further information is provided in in section 2 of the Q&A.

With regards to personal data of trial participants, the principle of data minimisation should also be

followed, even if those data are pseudonymised in the documents that are not subject to publication in

CTIS secure domain (see below). The use of personal data of trial participants should be proportionate.

The clinical trial documents should include sufficient level of details to permit for the scientific

evaluation and include sufficient data to evaluate the benefit/risk profile of the investigational

medicinal product(s) used.

• Pseudonymisation of data of trial participants

The documents uploaded in CTIS may contain personal data belonging to trial participants, in a

pseudonymised format. Most frequently included one is the clinical trial subject ID number. For the

reasons presented above the clinical trial subject ID number should not be disclosed in the document

version ‘for publication.’ It should be adequately anonymised by employing appropriate anonymisation

techniques.

The pseudonymisation of personal data can reduce the risks to the data subjects concerned (e.g., trial

participants). Pseudonymisation refers to processing of personal data in such a manner that the

personal data can no longer be attributed to a specific data subject without the use of additional

information, provided that such additional information is kept separately and is subject to technical and

organisational measures to ensure that the personal data are not attributed to an identified or

identifiable natural person (Article 4(5) of GDPR and Article 3(6) of the EUDPR).

Practically, pseudonymisation consists of replacing one attribute (typically a unique attribute) in a

record by another. When pseudonymisation is used, the natural person could still be identified

indirectly. Therefore, pseudonymisation reduces the probability to link the data variables belonging to

a single data subject within a pseudonymised dataset with the identity of the data subject contained

within the source records, and when used will not result in an anonymised dataset. Thereby,

pseudonymisation is not an anonymisation technique but a useful security measure.

Opinion 05/2014 on Anonymisation Techniques, 0829/14/EN WP216

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 20/28

Personal data which have undergone pseudonymisation and which could be attributed to a natural

person by the use of additional information, is considered to be information on an identifiable natural

person, therefore data protection rules still apply.

Personal data of trial participants in a pseudonymised format (e.g., clinical trial subject ID number)

and relevant indirect identifiers such as weight, height, age, gender, etc. may be contained in CTIS

documents not subject to publication. A non-exhaustive list of documents that may contain them is

provided below:

• Investigator Brochure

• Paediatric Investigational Plan

• IMPD sections on Safety and Efficacy

• Unexpected event reports and supporting information

• Urgent safety measure reports and supporting information

• Serious Breach Reports and supporting information

• Clinical study reports (version ‘not for publication’)

• Assessment reports

• Inspection reports

Note that the principle of data minimisation should also be followed, as mentioned above.

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 21/28

4. Management of commercially confidential information

(CCI) in clinical trial information submitted to CTIS

4.1. Introduction

This chapter concerns the identification of CCI in the clinical trials information submitted to CTIS and

present the system functionalities that enable its protection.

CCI could be contained in a clinical trial application dossier or provided during the trial life cycle

including in the CSR. For the purpose of this guidance document commercial confidential information

(CCI) means any information which is not in the public domain or publicly available and when its

disclosure may undermine the legitimate economic interest or competitive position of the concerned

entities, e.g., clinical trial sponsors, marketing authorisation applicants/holders or service providers.

Sponsors should use redaction as the method to protect CCI in the document version ‘for publication.’

When identifying potential CCI, sponsors are strongly encouraged to consider whether the information

is already published, for example via the structured data fields in CTIS, or via other publication

sources. In addition, sponsors should consider whether the documents submitted as part of a clinical

trial application, are already in the public domain in connection to other trials registered in CTIS public

website, or via other public sources, and if any redactions had been applied in these published

documents. Consistency should be maintained, and the extent of the redactions should be similar

across published documents. Nonetheless CCI should be available in the document version ‘not for

publication’ as needed for Member State evaluation, and therefore it should not be redacted. It is not

necessary for sponsors to mark/highlight the text that they consider CCI in documents ‘not for

publication’ for awareness of the Regulatory Authorities (see relevant question of the Q&A). The

version of a document ‘not for publication’ should be considered as the original, integral version of the

document containing all information required for the assessment by the MSC.

The identification of the commercially confidential information available in the structured data fields

and in the documents submitted to CTIS is time dependent and should be approached as such by the

CTIS users: more details are provided in section 4.3.

4.2. Mechanisms available in CTIS to protect CCI

In line with the Revised CTIS transparency rules, in order to allow sponsors to protect their

commercially confidential information, CTIS foresees the following means:

• the public disclosure of a limited number of documents that are of key interest to the public, all

listed in Table II of Annex I. All other documents including those that often contain CCI are not

made public, such as the Investigator’s Brochure, IMPD documents, assessment reports, request

for information (RFI) and corresponding responses, financial arrangements and more. An

indicative list of those documents is available in Annex I, Table VI.

• the possibility for sponsors to provide a version ‘for publication’ of those key documents of interest

that would contain CCI redactions: further details are provided in sections to 4.3. to 4.6.

• different timelines for disclosure of structured data and documents depending on the trial

category, on the population age and on the trial category (see table I and II of Annex I)

Trial categories are established in the context of CTIS, to distinguish the system behaviour on

publication of information, essentially depending on the trial phase: table V of Annex I provides a

EMA’s definition of CCI in Policy 0043 has been endorsed by the Court of Justice in its case-law on access to documents.

The definition of CCI in this document is an extrapolation and adaptation of the definition appearing in Policy 0043.

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 22/28

description of those categories. For category one trials certain documents are never subject to

publication (i.e. SmPC, Recruitment arrangements and Subject information and informed consent

form), while others (protocol, relevant patient facing documents and synopsis) are only subject to

publication at the time of results disclosure (for those trials conducted in paediatric population) or 30

months after the end of trial in the EU/EEA (for trials conducted solely on adults). With regards to

structured data, most of data fields of category one trials conducted solely on adults are made publicly

available only 30 months after the end of trial date in EU/EEA, limiting the publication of data for those

trials to only fields of essential public interest. In addition, a specific distinction is made for the

disclosure of certain Investigational Medicinal product (IMP) details of category two trials that are

integrated phase one and two, for which the system foresees the same timeline for disclosure of all

Category one trials (30 months after the end of trial in EU/EEA).

Any document that is not listed in table II of Annex I is not subject to publication (see table VI of the

same Annex for an indicative list).

Sections 4.5. and 4.6. of this document aim to ensure a common understanding of what may be, or

may not be, considered CCI within clinical trial structured data fields and documents provided in a

clinical trial application and throughout the trial life cycle.

4.3. Redaction of CCI in the document version ‘for publication’

The sponsor is responsible to redact any CCI that may be present in the documents ‘for publication’ at

the time of their submission to CTIS. The assessment of what needs to be redacted on each document

is to be performed based on:

• the definition of CCI, as provided in section 4.1. , complemented with information contained in

section 4.5.

• the timeline for disclosure of each document, which vary depending on the trial category and

population age, see section 2.2.

For Category 1 trials’ documents are made publicly available only several

months after the end of the

trial in EU/EEA: any redaction performed at time of submission should concern only those pieces of

information that would still be considered CCI at the time of documents’ disclosure (e.g., of quality

data in the trial protocol).

The application of redactions to protect CCI should be limited to information that meets the provided

definition and should carefully be weighed against the principles of transparency and ease of access to

clinical trial information.

It is expected that as the development plans advance, information on clinical trials which initially was

considered CCI may no longer be considered as such due to technical and scientific advancements in

that research field. This should, therefore, translate into a decreased level of CCI redactions applied

over time in the new and modified documents submitted to CTIS during the trial life cycle, while the

development plan for the medicinal product progresses. Retrospective removal of redactions from the

documents already published is not expected. The latest version of each document type should, with

time, be less and less redacted, as applicable, during the trial life cycle.

Protocol and synopsis documents for category 1 trials are published 30 months after the end of trial in EU/EEA if the trial

is conducted only on adult subjects, while together with results submission if the trial includes paediatric subjects, refer to

table II of Annex I

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 23/28

See an example below for illustrative purposes only:

Redacted documents submitted to CTIS for publication have to remain meaningful to the public,

including potential trial participants and health care professionals

. Sponsors are responsible for the

redactions applied and for maintaining the clinical utility of the relevant redacted documents. In

addition to the scientific and regulatory review of the documentation provided during the lifecycle of a

clinical trial, RMS/MSC might reserve the right to comment, via an RFI, on the extent of the redactions

applied by the sponsor to ensure that the principles of transparency are followed

. When requested by

the RMS/MSC, sponsors should be able to demonstrate why the redaction in the documents is needed,

(as their disclosure might, otherwise, impact their legitimate economic interest or competitive

position).

In the clinical study report (CSR) only minimum amount of redaction to protect CCI is expected: in line

with recital 68 of the CTR

, CSR content should in principle not be considered CCI at the end of the

marketing authorisation process

. Further details on redaction of CSR are provided in section 4.6.3.

4.4. Relevant expertise and consistent decision-making process on the identification and

redaction of CCI

The following elements should be considered when identifying CCI in the clinical trial information

submitted to CTIS:

• involve in the CCI identification process experts with relevant scientific and technical skills, and

• to follow a consistent decision-making process.

It is envisaged that incorporating these two elements into the CCI identification strategy would not

only significantly reduce the need for applying redactions in the CTIS documents but would also

increase the efficiency during the process of reviewing the documents to identify those pieces of

information which may be considered CCI.

According to the definition provided in section 4.1 a piece of information can be considered CCI if it

meets simultaneously two criteria: (1) not being in the public domain or publicly available and (2) its

disclosure would undermine the legitimate economic interests or competitive position of the concerned

entities, e.g., sponsor, marketing authorisation applicants/holders or service providers.

Based on this, in order to facilitate the identification of CCI a 2-step approach is suggested below:

Clinical Trials Regulation (EU) No 536/2014, Questions & Answers,

Article 94 (2)(a) of the Regulation (EU) No 536/2014 refers to application of penalties including non-compliance with the

provisions laid down in the Regulation on submission of information intended to be made publicly available to the EU

database. This is also specified in the ACT EU Questions and answers on the protection of Commercially Confidential

Information and Personal Data while using CTIS

For the purposes of this Regulation, in general the data included in a clinical study report should not be considered

commercially confidential once a marketing authorisation has been granted, the procedure for granting the marketing

authorisation has been completed, the application for marketing authorisation has been withdrawn.

https://www.ema.europa.eu/en/documents/regulatory-procedural-guideline/external-guidance-implementation-

european-medicines-agency-policy-publication-clinical-data_en-1.pdf

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 24/28

First step: rule out the possibility that the particular piece of information is available in the public

domain (for further guidance please see section 4.5.1), or otherwise made publicly available. In case

the information is already available in the public domain, it cannot constitute CCI, therefore no

redaction should be implemented and the second step below is no longer applicable.

and

Second step: in case the information is not available in the public domain, it can be determined, in

collaboration with experienced professionals having a relevant expertise in the clinical research area,

whether the disclosure of the piece of information may undermine the legitimate economic interest or

competitive position of the sponsor, marketing authorisation applicant/holder or service providers.

If step 2 is also confirmed, the relevant portion of information can be considered CCI and be redacted

from the documents.

Medical writing can also play an important role in reducing the need for redactions. It is expected that

embedding a CCI identification and tracking strategy during the drafting of the CTIS related

documentation would limit the unnecessary dissemination of commercially confidential information in

documents where these pieces of information are not essential, required, or relevant.

This strategy can be further complemented by using document templates which specifically indicate

which information is required to be included in the documents according to the legislation, scientific

guidelines and regulatory guidance for clinical trials: Table III of Annex I provides an overview of the

available templates. As a complementary approach, tagging those pieces of information which are

considered CCI at the time the clinical trial documents are written would facilitate the preparation of

the redacted document versions meant to be published.

4.5. Information that may be considered CCI

It is recommended that where sponsors or marketing authorisation applicants/holders, identify a

portion of information such as a word or figure, part of a sentence, part of a paragraph that they wish

to include amongst the redactions to protect CCI, they should consider whether that portion of

information meets the definition of CCI. If the information is CCI, the extent of the redactions should

be limited to the word(s), figure(s), and specific sentences/elements in the text that, in the CTIS user’s

view, can be considered CCI. In case only some sentences within the text or some specific figures

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 25/28

within the tables are claimed to be CCI, the users should not redact entire pages, sub-sections of a

document or full tables, which for instance is accepted instead in respect of quality-related information.

In order to facilitate the identification of CCI, a short list of specific types of pieces of information that

may carry commercially confidential value is presented below. CTIS users should not redact these

types of information automatically in the documentation submitted for publication in CTIS, yet they

should assess whether the information is CCI on a case-by-case basis.

The list of elements that may be considered CCI at the time of submission of a CTA and during the trial

life cycle including submission of results/CSRs, includes as indicative examples:

• The names, address and contact details of manufacturers or suppliers of the active substance or

the excipients and finished product as well as of investigational medical devices, unless disclosure

is required as per current pharmaceutical legislation (e.g., for some biological products).

• The excipients' quantitative composition of the investigational/authorised product.

• Detailed information on the synthesis or manufacture of the active substance.

• Detailed descriptions of the manufacturing and control processes for the investigational/authorised

final product.

• Information related to future development plans for indications other than the one under

investigation and not yet disclosed in the public domain.

• New biomarkers or novel methodologies not yet qualified (to the extent that the information is not

yet disclosed in the public domain), including new methodologies to support future developments

as regards secondary or exploratory endpoints.

• Detailed information concerning innovative analytical methods.

• Detailed information on the facilities and equipment available at the sponsors and clinical sites.

• Only in clinical trial application dossiers: the details of the daily dose allowed and maximum dose

allowed for the medicinal product under investigation on justified grounds, i.e. when the sponsor

proves that the specific information on the posology is not in the public domain and constitutes

patentable matter, the disclosure of which before a patent application is filed (typically, after the

completion of the trial and during the trial readout) would jeopardise its protection.

This might be applicable, for example, to integrated phase I/phase II trials that are to be marked

in CTIS as category 2 trials. The grounds for considering dose details as CCI should be clearly

documented in the cover letter of the application

4.6. Information that may not be considered CCI

In order to achieve a high level of consistency in the identification of CCI across the clinical trial

documents, the sections presented below list some additional examples of types of information which

may not be considered CCI

4.6.1. Information that is already in the public domain or publicly available

It is recommended that the clinical trial sponsor and marketing authorisation applicants/holders

compile a list of the most common websites/locations where information regarding their own medicinal

ACT EU questions and answers pm protection of personal data and commercially confidential information while using

CTIS

These examples reflect the most common redactions proposed by applicants/MAHs which are usually rejected by EMA in

the framework of Access to Documents in accordance with Regulation (EC) No 1049/2001.

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 26/28

product is usually made available. They may consider creating and maintaining their own specific lists

detailing the level of public information concerning their product(s). The following sources of

information be included in the list (as a minimum):

• Sponsors, Applicants’/MAHs’ own website(s).

• EMA web-site (e.g. scientific guidelines, and for, centrally authorised products, the product

EPAR,);

• Clinical trials registries (such as CTIS, EU Clinical Trials Register, ClinicalTrials.gov);

• Web-sites of other regulatory authorities within the EU and outside the EU (such as FDA, PMDA,

TGA, Health Canada) especially when the product (or another product containing the same active

substance) is approved in those specific jurisdictions;

• Scientific literature and articles (such as Textbooks, PubMed, Medline).

The information sources suggested above are not intended to constitute an exhaustive list, but rather

to serve as a starting point for the creation of their own (more exhaustive, customized) lists. In this

case, the above-mentioned examples should be considered as the minimum number of information

sources to be scrutinised in order to reach a basic level of awareness on publicly available information

related to the product concerned.

4.6.2. Information that does not bear any innovative elements

Information which has already been revealed to certain extent, which can be inferred from information

available in the public domain or has the content of textbooks or scientific guidelines as basis, should

not be withheld from the public versions of the clinical trial documents.

The fact that certain pieces of information are not in the public domain as such does not necessarily

mean that they should be considered by default to constitute CCI.

In many instances, particular pieces of text contained in clinical trial documents describe how the

sponsors and marketing authorisation applicants/holders complied with regulatory and scientific

guidelines and how they applied the scientific knowledge available at that time to their own

development programme. In essence, these pieces of text do not reveal any innovative elements (of

any regulatory or scientific nature) as the approaches described in the text are built upon logic and

common sense in line with the content of publicly available documents such as:

• Scientific literature and articles (Textbooks, PubMed, Medline).

• Scientific and regulatory guidelines and guidance documents (ICH).

• Treatment/clinical practice/disease management guidelines (Learn societies, HTAs).

4.6.3. Information that would not qualify as commercially confidential

When considering commercially confidential information while using CTIS it is important to stress once

again that the concept of CCI is time dependent, with a particular focus on the development phase of

the medicinal product used in a clinical trial. It is important, therefore, to differentiate between CCI

applicable in an earlier development phase at the time of submission of a clinical trial application and

during the trial life cycle, and CCI at the end of the development cycle when trial results are provided

in the clinical study report as part of a marketing authorisation procedure.

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 27/28

As mentioned in the introductory section 4.1 of this chapter it is expected that the redaction of CCI in

the documents uploaded and submitted in CTIS will decrease overtime in line with the evolution of the

development plan.

Redaction of information that is already present as structured data field in CTIS should be done in line

with the applicable publication timelines of those fields (see table I of Annex I). For early phase trials

(e.g. category 1 trials), details on medicinal product, as well as on other characteristics such as the

third parties and service providers are disclosed 30 months after the end of trial date in EU/EEA and

therefore may be equally protected in any document that could be published earlier in time (e.g.

protocol of a paediatric trial, summary results), if the disclosure would undermine the legitimate

economic interest or competitive position of the concerned parties.

Some data elements should not be redacted from CTIS documentation since they are unlikely to

constitute commercially confidential information at any point in time, in an application nor in a CSR.

Some of these data elements are presented below. The list is not intended to be exhaustive, rather as

indicative examples about details of the data elements generally not considered to be CCI:

• Unit measurements, in such cases only the actual value may be considered CCI. [e.g.] 2.5mL/kg

→ xx mL/kg.

• Study identification number(s) (e.g., EudraCT, ClinicalTrials.gov Identifier (NCT…), sponsor’s

internal study number).

• Names and addresses of investigator sites and the names of the principal investigators at each

trial site.

• Names of the countries where the clinical study is/was conducted.

• Number (how many) of study sites/research facilities were involved in the research.

• Name of the applicant’s/sponsor’s own research facility(ies) where clinical studies were conducted

(e.g., phase I studies).

• Name of the trial sponsor or the legal entity (CRO) that acted on behalf of the sponsor for clinical

trial application submission.

• Names/identifying elements of all CROs, vendors and service providers involved in trial-related

duties and functions (e.g., central laboratories, IVRS provider, image reading centres), unless

referred to Category 1 trials.

• Standard Operating Procedure (SOP) numbers and titles.

• Information on worldwide approval status, Marketing Authorisation dates and launch status.

In the clinical trial application(s), and during the whole trial life cycle, sponsors should only redact in

the document version ‘for publication’ the CCI identified based on the principles described in section

4.3 above. In case the sponsors wish to flag what they consider CCI in the document version ‘not for

publication’ uploaded in CTIS, they can mark the text with red border boxes. (see description in the

Q&A).

For clinical study reports to be submitted to CTIS, marketing authorisation applicants/holders should

follow the same principles for the protection of CCI that are described in chapter 4 of the document on

Policy 0070

on the publication of clinical study reports submitted to EMA as part of the centralised

procedures for marketing authorisation, or variation or line extension of these. Where applicable,

EMA guidance on policy 0070 https://www.ema.europa.eu/en/documents/regulatory-procedural-guideline/external-

guidance-implementation-european-medicines-agency-policy-publication-clinical-data_en-1.pdf

Guidance document on how to approach the protection of personal data and commercially confidential information while using the

Clinical Trials Information System (CTIS) Version 2

Page 28/28

duplication of efforts should be avoided when preparing for publication those CSRs supporting

centralised applications for marketing authorisation or variations thereof. As the submission and

corresponding publication of CSRs via CTIS and publication via Policy 0070 initiative are triggered by

the same regulatory milestone (i.e., the completion of the marketing authorisation procedure), the

same level of CCI redaction applied in the CSR published on Clinical Data Publication portal (under

Policy 0070 initiative) should be applied in the CSR provided in CTIS.