Help & Resources

Everything you need to get started with CR.GDPR, all in one place.

Whether you’re looking for answers to frequently asked questions, guidance documents, ways to contact COSUP or the latest updates from CR.GDPR, you’ll find the information and resources you need below.

One-Pagers | FAQ | Resources | Contact the COSUP | Join the conversation

Download CR.GDPR One Pager

Service Provider one-pager

Sponsor one-pager

Site One-pager

Frequently Asked Questions

What is CR.GDPR?
A Code of Conduct developed under Article 40 of the GDPR.

A compliance framework for adhering organisations to demonstrate alignment of their services with the GDPR.

An interpretive guide to the GDPR created by multiple stakeholders and opinion leaders in clinical research and endorsed by the data protection supervisory authorities of the EU

An effective governance and accountability mechanism with the Commission Nationale de l’Informatique et des Libertés (CNIL) as the Competent Supervisory Authority, responsible for the approval, establishment and monitoring adherence to the Code.

A transnational Code, recognised by the 27 EU data protection authorities and the European Data Protection Board (EDPB)
Who does the Code apply to?
Any data processing activities for the services delivered by CROs and other service providers in clinical research as data processors

GDPR requirements shown in the application to 23 classes of services typically delivered by CROs.

Personal data of European Union study subjects and healthcare professionals processed for interventional and non-interventional studies
Who oversees CR.GDPR?

On 29 January 2026 CNIL [here] adopted Resolution no. 2026-006, formally approving the Supervisory Committee (COSUP) as the accredited monitoring body for CR.GDPR. The COSUP’s role will be to assess the compliance of Candidate CROs and Adherents and enforce the implementation of the requirements of CR.GDPR amongst those service providers who have chosen to adhere to it. The COSUP is comprised of 10-12 experienced and qualified Members approved by the CNIL to assess and decide whether a CRO is CR.GDPR compliant. For more information, see the whole COSUP Board of Members here.
What are the Compliance Marks?

Adherents earn the right to display a Level 1 or Level 2 Compliance Mark. The Compliance Mark demonstrates their commitment to and achievement of high data protection standards. Compliance Marks are valid for three years.

Adherents will be sent the mark directly by the COSUP upon their adherence, alongside a guideline usage. You can find the Usage Guidelines for the Compliance Marks here.
Is CR.GDPR recognised across the European Union?
What is the legal status of CR.GDPR?

The lead supervisory data protection authority for CR.GDPR is the French Data Protection Authority (CNIL). CR.GDPR was approved on 12 September 2024 – See EDPB opinion published June 18^th, 2024 [here] – see CNIL’s decision nb 2024-064 published 12 September 2024 [here]. That makes CR.GDPR the only approved GDPR Code of Conduct for clinical research in all Member States of the European Union.

For CROs/Service Providers

How do I become a CR.GDPR Adherent?

Register your organisation’s profile in the Public Registry, complete an organisational profile and a compliance questionnaire tailored to the services your organisation provides (the “Compliance Dossier”), and submit it to COSUP for review. COSUP will review the Compliance Dossier and issue its resolution within 6–8 weeks.
What is the difference between Level 1 and Level 2?

Organisations may obtain either a Level 1 or Level 2 Compliance Mark.

Level 1: Self-declaration and Review

Level 2: Once Level 1 has been obtained, the COSUP will organise an audit of your organisation to verify compliance.

The level of Compliance Mark depends on the evaluation model selected by the Candidate CRO. Find out more here.
How much does adherence cost?
Level 1 and Level 2 are two different evaluation routes.

Both Compliance Marks are valid for three years.

Organisations must renew their adherence every three years to continue displaying the Compliance Mark.

Standard application, maintenance and renewal fees apply to both Level 1 and Level 2 organisations.

Level 2 organisations pay separate audit expenses in addition to the standard fees.

See full fee information here
What happens once my organisation has adhered?
Why should my organisation adhere to CR.GDPR?
Organisations may choose to adhere to:

reduce administrative and operational waste caused by conflicting interpretations of the GDPR

obtain practical instructions on demonstrating and maintaining compliance with GDPR in clinical research

achieve trusted status in assessments of GDPR compliance

earn the right to display a Compliance Mark as evidence of high data protection standards

demonstrate compliance and high standards of services to sponsors conducting clinical trials in the European Union

For Sponsors

Why is CR.GDPR relevant to sponsors?

CR.GDPR helps sponsors understand whether a service provider has aligned relevant services with a recognised GDPR compliance framework.

It supports a more consistent approach to GDPR compliance across clinical research by providing practical guidance for service providers acting as data processors under a service contract.
How can CR.GDPR support supplier selection and oversight?

Sponsors may use CR.GDPR as part of their supplier assessment and oversight activities.

CR.GDPR can support easier vendor conversations, clearer expectations, greater transparency through the Public Registry and a common framework across all 27 European Union Member States.
What do the Public Registry and Compliance Marks show?

The Public Registry provides information about organisations participating in the CR.GDPR adherence scheme. Companies listed on the Public Registry have either initiated their submission file for adherence or been awarded a Compliance Mark. Organisations that complete the adherence process may become eligible to display a Level 1 or Level 2 Compliance Mark.

Resources

What You Need to Know

A quick introduction to CR.GDPR
New to the Code? This guide provides an overview of what CR.GDPR is, who it applies to, why it was developed and how organisations can get involved.

Download Resource

The CR.GDPR Code of Conduct

The official Code of Conduct
Access the full EUCROF GDPR Code of Conduct for Service Providers in Clinical Research, including the complete requirements and framework governing adherence to the scheme.

Download Resource

User Guide

Guidance for organisations using CR.GDPR
This practical guide is designed to help organisations understand the Code, navigate the adherence process and make the most of the resources available through CR.GDPR.

Download Resource

Webinar: Demonstrating data protection compliance with CR.GDPR

This video provides an overview of what CR.GDPR is, who it applies to, why it was developed and how organisations can get involved. Watch the recording of our live webinar with members of the CR.GDPR Supervisory Committee, covering CR.GDPR, the adherence process and what organisations can expect when applying.

In the webinar:

What is CR.GDPR and what is its purpose
How to make an application (process)
How to make a successful application
Decision making process
Live Q&A

Download Webinar Slides

Contact the COSUP

Whether you’re exploring adherence, have a question about the CR.GDPR Code of Conduct, or would like to learn more about the scheme, the COSUP team is here to help.

Get in touch using the details below, and a member of the Committee will respond to your enquiry as soon as possible.

Help & Resources

Download CR.GDPR One Pager

Frequently Asked Questions

For CROs/Service Providers

For Sponsors

Resources

What You Need to Know

The CR.GDPR Code of Conduct

User Guide

Webinar: Demonstrating data protection compliance with CR.GDPR

Contact the COSUP

Your information

Join the Conversation

Mailing list sign-up