Menu

Who are the COSUP?

September 28, 2026

The Code Supervisory Committee (COSUP) is the accredited monitoring body responsible for assessing adherence to CR.GDPR and overseeing implementation of the Code.

Approved by the French Data Protection Authority (CNIL) on 29 January 2026, COSUP assesses whether clinical research service providers meet the Code’s requirements. Its responsibilities include reviewing Compliance Dossiers submitted by organisations seeking adherence and making decisions on their applications.

COSUP brings together experienced and qualified members whose role is to assess applications and determine whether an organisation meets the requirements for adherence. This independent oversight is central to the credibility of the scheme and the meaning of the CR.GDPR Compliance Mark.

The COSUP is made up of:

Victoria Watts Victoria Watts
Premier Research
Chair
Christophe Maes Christophe Maes
i-HD
Vice Chair
Dimitrios Athanasiou Dimitrios Athanasiou
European Medicines Agency | European Patients’ Forum
Pierre-Henri Bertoye Pierre-Henri Bertoye
WHO | P-H BERTOYE Conseil
Marc Brooks Marc Brooks
elderbrook consulting GmbH
Ricard Martinez Ricard Martinez
University of Valencia
Anastassia Negrouk Anastassia Negrouk
MyData-TRUST
Kate Smirnova Kate Smirnova
PSI CRO AG
Pierre Westphal Pierre Westphal
GDPieRre Consulting / SGS Partner

See their full details and find out more about what the COSUP does here.

What does being CR.GDPR Compliant mean to Tune Insight CEO, Juan Troncoso Pastoriza?

October 20, 2026

For Juan Troncoso Pastoriza, CEO of Tune Insight, responsible data use and the progress of clinical research are closely . . . connected. Following Tune Insight’s achievement of the first Level 1 CR.GDPR Compliance Mark, he reflects on the relationship between data protection, collaboration and research. “European patients are waiting too long for new treatments, and often the hold-up isn’t the science. It’s the months lost agreeing how health data can be used. CR.GDPR changes that. It is the first transnational GDPR Code of Conduct built for clinical research, setting one clear standard across all 27 EU Member States. Tune Insight is proud to be the first organisation to achieve adherence to CR.GDPR, and it proves that privacy and speed are not a trade-off. We have engineered a way for hospitals to keep control of their data so researchers get answers sooner, and now with this certification, patients should see the benefits. Tune Insight will continue to strengthen trust with partners and advance the secure and responsible use of health data.” Tune Insight’s achievement demonstrates how an organisation can use the CR.GDPR adherence scheme to show that it has completed a review against the Code’s requirements. The Level 1 Compliance Mark follows the submission and successful review of a service-specific Compliance Dossier by COSUP. The Mark does not replace an organisation’s wider obligations under data protection law. Instead, it provides evidence of adherence to a framework designed for clinical research service providers. Read more about CR.GDPR and the steps involved in achieving adherence.

First Adherent Announced: Meet Tune Insight

October 6, 2026

Tune Insight has become the first organisation to achieve adherence to CR.GDPR, marking an important step in putting the . . . Code into practice. Following a unanimous decision by COSUP, Tune Insight earned the right to display the Level 1 CR.GDPR Compliance Mark. Level 1 follows a self-declaration and review process. An organisation creates its profile on the Public Registry and completes a Compliance Dossier tailored to the services it provides. COSUP then reviews the dossier and makes a decision on adherence. The Compliance Mark confirms that the organisation has successfully completed this process and demonstrates its commitment to, and achievement of, high data protection standards under the Code. The Mark is valid for three years. It provides sponsors and other stakeholders with a recognised indication of an organisation’s adherence to a framework developed specifically for clinical research. As the first Adherent, Tune Insight offers an early example of how clinical research service providers can put the Code into practice. View the CR.GDPR Public Registry to learn more about adherence status.

Who are the COSUP?

September 28, 2026

The Code Supervisory Committee (COSUP) is the accredited monitoring body responsible for assessing adherence to CR.GDPR . . . and overseeing implementation of the Code. Approved by the French Data Protection Authority (CNIL) on 29 January 2026, COSUP assesses whether clinical research service providers meet the Code’s requirements. Its responsibilities include reviewing Compliance Dossiers submitted by organisations seeking adherence and making decisions on their applications. COSUP brings together experienced and qualified members whose role is to assess applications and determine whether an organisation meets the requirements for adherence. This independent oversight is central to the credibility of the scheme and the meaning of the CR.GDPR Compliance Mark. The COSUP is made up of: Victoria Watts Premier Research Chair Christophe Maes i-HD Vice Chair Dimitrios Athanasiou European Medicines Agency | European Patients’ Forum Pierre-Henri Bertoye WHO | P-H BERTOYE Conseil Marc Brooks elderbrook consulting GmbH Ricard Martinez University of Valencia Anastassia Negrouk MyData-TRUST Kate Smirnova PSI CRO AG Pierre Westphal GDPieRre Consulting / SGS Partner See their full details and find out more about what the COSUP does here.

Be in the loop: How to hear CR.GDPR Updates

September 18, 2026

CR.GDPR is developing as more organisations engage with the Code and begin the adherence process. Following its progress . . . is a useful way to understand how the framework is being put into practice across clinical research. To keep up with developments: Follow CR.GDPR on LinkedIn Subscribe to the CR.GDPR Mailing list Check the Public Registry: See organisations listed in the registry and distinguish those that have initiated a submission file from those that have achieved adherence. As the community grows, updates will highlight new Adherents, practical perspectives on data protection and contributions from the people involved in overseeing and implementing CR.GDPR.

Webinar Materials Available

September 3, 2026

Couldn’t attend the CR.GDPR webinar, or would you like to revisit the discussion? Webinar materials are available to . . . help you learn more about the EUCROF GDPR Code of Conduct for Service Providers in Clinical Research, its purpose and its application to clinical research service providers. CR.GDPR provides practical guidance on interpreting GDPR requirements in the context of clinical research. Its adherence scheme also gives organisations a structured route to demonstrate their commitment to, and achievement of, high data protection standards. Access the available webinar materials, including the recording and the slides, here.

Meet the CR.GDPR Webinar Speakers

August 25, 2026

Understanding how GDPR applies in clinical research raises practical questions for sponsors, service providers and other . . . organisations working with personal data. The CR.GDPR webinar, which took place on 3rd September 2026, brought together speakers to discuss CR.GDPR and its relevance to the clinical research sector. Through their contributions, the webinar provided an opportunity to learn more about the framework, its purpose and the role it can play in supporting data protection practices across clinical research.   Victoria Watts COSUP Chair Victoria Watts has more than 10 years’ experience in data protection and compliance within pharmaceuticals and clinical research. A qualified data protection professional, she was also a key contributor to the development of the EUCROF GDPR Code of Conduct for clinical research service providers. As Chair of COSUP, Victoria is responsible for overseeing the committee’s work in assessing adherence to the Code, making her ideally placed to answer your questions about CR.GDPR, how the adherence scheme works and what it means for service providers. Christophe Maes Co-chair, COSUP With a background in healthcare quality management, audit and certification, Christophe is an experienced compliance professional specialising in data protection and privacy. He has played a key role in developing GDPR compliance criteria and certification schemes for digital health technologies, including those processing health data. He also has extensive experience developing assessment procedures and certification schemes in line with ISO standards. As Co-Chair of the CR.GDPR Supervisory Committee (COSUP), he is closely involved in the assessment and oversight of CR.GDPR and its adherent Emma Butler Risk and Compliance Officer Emma is one of the two RCOs who work as independent contractors tasked with reviewing applications for code of conduct adherence. Emma has run her own consultancy since 2021 helping organisations with data protection compliance as well as offering plain English editing and training. She started working in data protection in 2005 leading the ICO’s international policy team. She was then an in-house DPO at both a multinational and a biometric digital identity SME. She now lives in south-west France helping clients across Europe and the UK. Stephen McCartney Risk and Compliance Officer Stephen is the second of our two RCOs. Stephen has over 25 years’ experience working in data protection and privacy. In that time he has worked for two European regulators, in health services, edtech, fintech and for Google. Missed the webinar? Watch the recording and access the slides on our Help & Resources page.

Welcome to the CR.GDPR Website

August 13, 2026

Welcome to the website of the EUCROF GDPR Code of Conduct for Service Providers in Clinical Research (CR.GDPR). CR.GDPR . . . provides practical guidance on applying GDPR requirements in clinical research, with a framework developed specifically for service providers acting as data processors on behalf of sponsors. Applicable across all 27 EU Member States, the Code supports a consistent, sector-specific approach to data protection. Here you can learn about what CR.GDPR does from a sponsor perspective, service provider perspective, understand the adherence process and fees, meet the people responsible for its oversight (the COSUP), read the code itself, find updates from across the CR.GDPR community, and more. Whether you are exploring the Code for the first time or considering adherence for your organisation, this website is your starting point.