Checklist for implications of data protection

Data protection framework

Register under the Data Protection Act with host institution
Consider if waivers are required for collaboration outside the EU
Consult with Information Commissioner if there is any uncertainty about the process

Implications for staff

Ensure confidentiality clause in staff contracts
Develop procedures for breaches of confidentiality
Ensure staff are aware of data protection protocols within the coordinating centre
Identify lead person for DP issues

Implications for participants

Must give consent to process all personal information
Must be given accurate information regarding the use of data/samples collected both now and in the future
Access to all personal information held, via a process developed by the coordinating centre . The process will ensure correct participant identification. Use NHS systems where possible

Day to day management

Only collect data fit for purpose and approved by ethics committee and registered under the Data Protection Act
Ensuring adequate security and restricted access to paper records by use of lockable cabinets and a password protected computer network.
Ensure information held on participants is anonymised/unlinked as soon as practically possible, depending on the trial design. That may be when an individual’s data collection is completed, and it is considered that the risk of emergency unblinding is minimal
Document the reason for the timing of anonymisation of data

Simple solutions - paper

Store securely, ideally in locked fire proof filing cabinets
Never leave data out on a desk overnight (or take out of the office)
Plan access and archiving procedures (kept for up to 20 years) with your host institution or sponsor

Simple solutions - electronic

This checklist has been contributed by Barbara Farrell who prepared it for the third version of the Trial Management Guide