Clinical Research and Cross-Border Health Data in China: Orientation

Parallel workstreams (do not serialise poorly)

1. Protocol and ethics committee approvals
2. Informed consent language covering data uses and transfers
3. PIPL lawful basis / notice design for subjects and sometimes staff
4. Data map: EDC, imaging, labs, safety databases, HQ analytics
5. Outbound transfer pathway if data leave China
6. Human genetic resource compliance where samples/data are in scope
7. Vendor contracts (CRO, central lab, cloud)

Personal information in trials

• Health data is typically sensitive PI—higher bar for notice, necessity, and security.
• Pseudonymisation is not a free pass if re-identification remains possible.
• Subject rights processes must work operationally during and after the trial.
• See transfer roadmap for HQ safety databases abroad.

Human genetic resource themes (orientation)

Collection, storage, use, and outbound provision of certain human genetic resources are specially regulated. International collaborations often need structured approvals and Chinese party participation rules. Do not ship samples or unrestricted genomic datasets abroad on a handshake. Engage specialised counsel before protocol finalisation if genetics are involved.

CRO and platform diligence

• Where is primary data hosted?
• Who has admin access from overseas?
• Subprocessors and audit rights
• Breach notification timelines
• Return/deletion at study close

Sponsor checklist

• [ ] Data flow diagram for the protocol
• [ ] Consent covers processing + transfer in plain Chinese
• [ ] Ethics and any genetic-resource pathways scoped
• [ ] Transfer mechanism selected with privacy counsel
• [ ] CRO/cloud DPAs executed
• [ ] Safety reporting systems tested end-to-end
• [ ] Retention schedule defined post-database lock

Counsel

Healthcare hub   Data privacy centre   Find counsel