Protect Patients and Accelerate Study Start-Up with CR.GDPR

Investigational sites are the ultimate guardian of patient data. However, growing regulatory pressure from national authorities means sites’ legal and compliance teams must perform exhaustive due diligence on every vendor involved in a trial.

Drafting Data Protection Impact Assessments (DPIAs) and navigating conflicting legal interpretations slows down contract negotiations—delaying study start-up and holding back life-changing treatments from your patients.

CR.GDPR—the EUCROF GDPR Code of Conduct for Service Providers in Clinical Research—solves this by providing an officially recognised compliance blueprint for clinical research service providers across all 27 EU Member States.

Download one-pager for SITES

How CR.GDPR Protects Your Site and Your Patients:

Fast-Track Legal & Contract Review

Eliminate weeks of back-and-forth negotiation. When a CRO holds a CR.GDPR Compliance Mark, your legal team receives instant, verified assurance that the vendor meets rigorous, sector-specific privacy standards.

Streamline DPIAs and Compliance

Simplify your risk assessments. The CR.GDPR framework aligns directly with national authority expectations, providing ready-made compliance reference points that drastically cut down your administrative workload.

Reassure Ethics Committees Instantly

Demonstrate independent verification of data protection standards to support study approvals.Present your institutional review boards and Ethics Committees with an objective, independent stamp of data protection excellence, ensuring smoother, faster study approvals.

Uphold the Ultimate Patient Trust

Your patients trust you with their health and their data. By ensuring trials utilise CR.GDPR-adherent partners, you guarantee their sensitive medical information is handled with the highest level of security available in clinical research.

Clear the Administrative Bottlenecks.
Focus on the Science.

Don’t let compliance paperwork stand between your patients and breakthrough medicine. Protect your site’s data controller liabilities while accelerating your path to First Patient In.

When evaluating upcoming protocols and partners, look for the CR.GDPR Compliance Mark on the public registry.

Learn how to simplify your site’s due diligence with the resources below

Public Registry

The CR.GDPR Public Registry provides information about organisations participating in the adherence scheme.

The Registry is intended to provide transparency regarding organisations that have engaged with the CR.GDPR adherence process.

Compliance Marks

Organisations that successfully complete the adherence process may become eligible to display a CR.GDPR Compliance Mark in accordance with the rules of the scheme.

The Compliance Mark demonstrates that the organisation has achieved the relevant level of adherence under the CR.GDPR framework.

Compliance Marks are valid for three years.

Looking for something else?

Go to help, resources & FAQ

Whether you’re looking for answers to frequently asked questions, guidance documents, ways to contact COSUP or the latest updates from CR.GDPR, you’ll find the information and resources you need below.

Go to FAQ

Contact the COSUP

Whether you’re exploring adherence, have a question about the CR.GDPR Code of Conduct, or would like to learn more about the scheme, the COSUP team is here to help.

Code of Conduct Reader

Browse the full CR.GDPR Code of Conduct or download it.

Go to reader