8 July 2024
EMA/898965/2022

Q&A on the protection of Commercially Confidential
Information and Personal Data while using CTIS
Question and Answers, version 2.1

The Q&A document has been produced to address a number of questions related to the transparency
aspects of the Clinical Trial Information System (CTIS) which were communicated by sponsors in
response to the ACT EU survey on the CTR (Clinical Trial Regulation (EU) No 536/2014)
implementation under ACT EU Priority action 2 (Successful implementation of the CTR), as well as in
the context of implementation of the revised CTIS transparency rules. It is foreseen that the Q&A may
be updated on a regular basis as soon as new information becomes available.
The Q&A also intends to provide more clarity on main aspects that have been discussed with theClinical Trials Coordination Group (CTCG) and it should be read in conjunction with the Guidance
document on how to approach protection of personal data and commercial confidential information
while using Clinical Trials Information System (CTIS) and its Annex I.

Official address Domenico Scarlattilaan 6 ● 1083 HS Amsterdam ● The Netherlands
Address for visits and deliveries Refer to www.ema.europa.eu/how-to-find-us
Send us a question Go to www.ema.europa.eu/contact

Telephone +31 (0)88 781 6000

An agency of the European Union© European Medicines Agency, 2024. Reproduction is authorised provided the source is acknowledged.

Document version

Publication date

Changes introduced in the text

Version 1.0

31 January 2023

N/A

Version 1.1

27 March 2023

New Q&A 1.9

Version 1.2

17 May 2023

- Clarification on deferrals
section 1 (Italics)- Revised text in Q&A 1.8- Revised text in Q&A 2.2- New Q&A 3.3.
- Minimum editorial review
across the text

Version 1.3

29 November 2023

- New section 4 on revisedtransparency rules- Update text across the
document to align withprinciples of section 4

Version 1.4

31 January 2024

- Additional Q&A 3.4 on patient
facing documents disclosure

Version 2.0

18 June 2024

- Alignment with revised CTIS
transparency rules- Removal of section 4 andAnnex (historical trials andtransition trials principles
moved to section 2 of the
Guidance document)

Version 2.1

8 July 2024

- Addition of question 1.9

Q&A on the protection of Commercially Confidential Information and Personal Data
while using CTIS
EMA/898965/2022

Page 2/10

Table of contents
1. Categorisation of trials ............................................................................ 5
1.1 Could RMS/MSC comment on the trial categorisation, when performing the validation
or assessment of the CTA? ......................................................................................... 5
1.2 How should trials in public health emergency settings and trials in emergency
situations be treated in terms of categorisation? ........................................................... 5
1.3 Which type of justification should be provided for the category type? ....................... 5
1.4 Will RMS raise an RFI on the trial category at time of validation or assessment part I? 5
1.5 When will sponsors know if the proposed trial categorisation is accepted? ................. 5
1.6 Will MSC comment on the extent of the redaction done in the CTIS documents version‘for publication’? ....................................................................................................... 6
1.7 Will RMS/MSC compare document version ‘for publication’ vs ‘not for publication’? ..... 6
1.8 How should documents with track changes be submitted in CTIS? ........................... 6
1.9 When submitting applications on a ‘historical’ trial, do sponsors need to ensure thatclean versions of all documents not subject to publication are present in the system? ......... 6

2. Personal Data .......................................................................................... 7
2.1. Which CTIS documents require a signature?........................................................... 7
2.2. Name and surname of individuals – where are they expected to be included? ............. 7
2.3. How should personal data of trial participants be anonymised in the document version‘for publication’? ....................................................................................................... 8
2.4. May sponsors mark/highlight personal data in documents ‘not for publication’? ........... 8
2.5. Under Directive (2001/20/EC) the clinical trial participants subject identifier (ID) was
provided in Annual Safety Reports (ASRs). Is it correct that as per Regulation (EU) No
536/2014 the subject ID should no longer be provided? ................................................. 8

3. Commercially Confidential Information ................................................... 93.1. May sponsors mark/highlight the text that they consider CCI in documents ‘not for
publication’? ............................................................................................................ 93.2. How can dose details be protected from disclosure from CTIS for certain trials
categories? .............................................................................................................. 93.3. Is it possible not to disclose patient facing documents publicly? ................................ 9Q&A on the protection of Commercially Confidential Information and Personal Data
while using CTIS
EMA/898965/2022

Page 3/10

Abbreviations
ASR

Annual Safety Report

CCI

Commercial Confidential Information

CTIS

Clinical Trials Information System

CTR

Clinical Trial Regulation (EU) No 536/2014

CV

Curriculum Vitae

GDPR

General Data Protection Regulation

GMP

Good Manufacturing Practices

MS

Member State(s)MSC

Member State Concerned

RFI

Request for Information

RMS

Reporting Member StateSM

Substantial Modification

QP

Qualified Person

Q&A on the protection of Commercially Confidential Information and Personal Data
while using CTIS
EMA/898965/2022

Page 4/10

1. Categorisation of trials
In the form section of the initial trial application, sponsors are required to indicate to which category
their trial belongs to, depending on the trial phase as defined in Table V of Annex I to the Guidance
document on how to approach protection of personal data and CCI while using CTIS. Trial
categorisation affects publication timelines, as defined in the Revised CTIS transparency rules.
1.1 Could RMS/MSC comment on the trial categorisation, when performing the validation orassessment of the CTA?
It is expected that RMS/MSC could comment on whether the assigned trial category is appropriate,based on the information on the trial phase that is provided by the sponsor throughout the CTA.
1.2

How should trials in public health emergency settings and trials in emergency
situations be treated in terms of categorisation?

As provided in Article 17(1) of Regulation (EU) 2022/123, for clinical trials in public health emergency
settings 1, the protocol should be made public at the time of the start of trial and the summary of
results later on during the trial life cycle. The publication of these documents cannot be deferred.
In principle, clinical trials in emergency situations 2 fall either under category 2 or 3 (therapeutic
intent), since for these trials Article 35 (1)(b) of Regulation (EU) No 536/2014 requires scientificgrounds for individual clinically relevant benefit for subjects. 3
1.3

Which type of justification should be provided for the category type?

RMS/MSC will consider the justification provided for the trial category, based on the characteristics ofthe trial, as the basis for evaluating the appropriateness of the category assigned. The justification
should be in line with definitions provided in Table V of Annex I to the Guidance document. Sponsors
should consider that when a protocol sets out a multiphase or adaptive design that falls in bothcategory 1 and 2, the trial should be treated according to category 2.
1.4

Will RMS raise an RFI on the trial category at time of validation or assessment part I?

An RFI on the trial category can be raised at any time at validation and assessment of part I, however
it is expected to be raised by the RMS primarily at the time of part I assessment.
Currently, trial categorisation can only be set by the sponsors in an initial application. Once the initial
application has been authorised it will not be possible for the sponsor to modify the trial category withsubsequent applications, such as substantial modifications.
1.5

When will sponsors know if the proposed trial categorisation is accepted?

Sponsors will know that a category is granted if no RFIs are raised in that respect during evaluation(validation/assessment part I) or if the issues raised with RFI are addressed in a satisfactory fashionby the sponsor (e.g. no further issues raised on the matter). There is no specific mechanism to flag inthe system that the trial category is accepted, it is part of the application evaluation overall.

Clinical trials with medicinal products with the potential to address public health emergencies.
Emergency situation: first trial specific intervention before signing the informed consent.
3
Article 35 of Regulation (EU) No 536/2014
1
2

Q&A on the protection of Commercially Confidential Information and Personal Data
while using CTIS
EMA/898965/2022

Page 5/10

1.6 Will MSC comment on the extent of the redaction done in the CTIS documents version‘for publication’?
Sponsors are responsible for the level of redaction applied in the documents uploaded in CTIS.
However, in addition to the scientific and regulatory review of the documentation provided in a CTA orother documents, RMS/MSC might occasionally comment on the extent of the redaction applied by thesponsor to ensure that the principles of transparency are followed 4.
1.7 Will RMS/MSC compare document version ‘for publication’ vs ‘not for publication’?
RMS/MSC are not responsible for verifying the level of redaction applied by sponsors in the documents
uploaded in CTIS. However, they might occasionally comment on the extent of the redaction applied by
the sponsor and compare the two versions to ensure that the principles of transparency are followed.
Protection of personal data is described in the CTIS JCA.
In principle, CCI-related redactions should be performed taking into account the timelines fordisclosure of each document, that vary depending on trial development phase and population age, as
defined in the revised CTIS transparency rules. Further information on the management of personal
data and CCI in CTIS is provided in the Guidance document on how to approach protection of personal
data and CCI while using CTIS, its Annex I and training module 12.
1.8

How should documents with track changes be submitted in CTIS?

Documents with track changes should be provided to the Member States to clearly illustrate the scopeof the revision applied in the documents content. These documents can be submitted in an applicationin reply to a request for information (RFI) or as part of a substantial modification (SM). These
documents should not be subject to publication. The clean version of the final text of the documents
should also be uploaded, in the same placeholder, addition to the track changes version.
1.9
When submitting applications on a ‘historical’ trial, do sponsors need to ensure thatclean versions of all documents not subject to publication are present in the system?
Trials submitted before 18 June 2024 could be showing only documents in track changes for those typeof documents that are no longer subject to publication, as described in the quick user guide: the clean
versions of those documents might have been in the corresponding ‘for publication’ placeholders, which
are no longer available.
When submitting a Substantial Modification, Non-Substantial Modification or Additional Member Stateapplication, sponsors are not requested to re-upload the clean versions of those documents ‘not for
publication’ that are no longer available. Sponsors should upload only the new clean version andcorresponding track-changes version of those documents that have been modified as part of theapplication. Sponsors should also not submit any other previous versions of deleted documents.
Note that, however, in case those clean versions of deleted documents would be necessary to assess
the new documents in scope of the application, MSCs may request to provide them within theapplication.

Article 94 (2)(a) of the Regulation (EU) No 536/2014 refers to application of penalties including non-compliance with theprovisions laid down in the Regulation on submission of information intended to be made publicly available to the EU
database.

4

Q&A on the protection of Commercially Confidential Information and Personal Data
while using CTIS
EMA/898965/2022

Page 6/10

2. Personal Data
2.1. Which CTIS documents require a signature?
Signatures should never be included in documents submitted to CTIS that are subject to publication.
With regards to documents that are not subject to publication, a signature should be provided for the
Qualified Person (QP) declaration for GMP (Part I) and the Suitability of sites document (Part II). In
addition, Member States specific requirements for signatures include:- Hungary: Suitability of the principal investigator documents (CV)- Portugal: Suitability of the principal investigator documents (CV and declaration of interests), Proofof insurance certificate- Romania: Proof of payment- Slovakia: Suitability of the principal investigator documents (CV and declaration of interests)
Please also consider further clarification on this matter provided in Eudralex Volume 10, COM Q&A:
‘Importantly, electronic submission of the CTA to CTIS by the sponsor is regarded as equivalent tosigning the document in accordance to Annex I.3. CTR is a regulation, which is directly applicable andensures complete harmonisation of the sector, national laws should be set out to support its full
implementation’.
Sponsors should be mindful of the requirements for signed documents that are part of the trial master
file (TMS), as applicable.
Further information on the management of personal data in CTIS is provided in the Guidance
document on how to approach protection of personal data and CCI while using CTIS, its Annex I andtraining module 12.
2.2. Name and surname of individuals – where are they expected to be included?
Personal data (e.g., names and surnames, and also contact details) should be generally included
exclusively in those CTIS documents that are not subject to publication as per the Revised CTIS
transparency rules. Personal data should be normally redacted if included in documents that are
subject to publication. Exceptions apply to those data that are disclosed as a structured data field in
the CTIS public portal (i.e. Principal Investigator’s name and surname): refer to section 3.3.1 of the
Guidance document on how to approach protection of personal data and CCI while using CTIS.
In the documents that are not subject to publication, principles of data minimisation apply to personaldata, see section 3.4 of the mentioned Guidance document. However, these data could be needed
during the scientific and regulatory review carried out by the MSC and therefore the following names
and surnames of certain roles are expected to be included:•

Principal investigator on the CV•

QP on the GMP declaration•

The person issuing the site suitability document•

Data Safety Monitoring Board (DSMB) composition on the charter or applicable document•

Minimum amount of sponsor staff in the protocol

Q&A on the protection of Commercially Confidential Information and Personal Data
while using CTIS
EMA/898965/2022

Page 7/10

•GDPR compliance statement to be provided under the CTIS ‘form’ section, in line with available
template

Please note that the document versions uploaded in the slot ‘not for publication’ should be clean
documents. Documents redacted of personal data and CCI should be submitted only in the slot ‘forpublication’.
Personal data of trial participants may only appear, as applicable, in CTIS document versions ‘not for
publication’ and encompass personal data in a pseudonymised format (e.g., clinical trial subject ID) as
well as indirect identifiers such as weight, height, age, gender, etc. These personal data are to beanonymised in the document version ‘for publication’.
2.3. How should personal data of trial participants be anonymised in the document version‘for publication’?
Refer to section 3.3.2 of the Guidance document on how to approach protection of personal data and
CCI while using CTIS.
2.4. May sponsors mark/highlight personal data in documents ‘not for publication’?
No. Currently, in the document version ‘not for publication’ it is not necessary to mark those personal
data that were anonymised/redacted in the version ‘for publication’.
In the document version ‘for publication’ any personal data needs to be anonymised/redacted, asapplicable, in line with section 3 of the Guidance document.
In all documents that are not subject to publication, sponsors should limit the presence of personal
data to only those ones that are necessary for Member State(s) assessment (see question 2.2 above).
2.5. Under Directive (2001/20/EC) the clinical trial participants subject identifier (ID) was
provided in Annual Safety Reports (ASRs). Is it correct that as per Regulation (EU) No
536/2014 the subject ID should no longer be provided?
ASRs should only contain anonymous information, namely information which does not relate to an
identified or identifiable natural person or to personal data rendered anonymous in such a manner thatthe data subject is not or no longer identifiable.
A subject identifier is pseudonymised information, in accordance with Article 4(5) of Regulation (EU)2016/679, and should therefore be excluded in the ASRs. Additional clarification on provision of theWorldwide Unique Case Identification Number (case ID) and the trial ID, rather than the subject ID, isprovided in Volume 10 - Clinical Trials Regulation (EU) NO 536/2014 questions & answers, point 7.33
(366 and 367): regulation5362014_qa_en.pdf (europa.eu)
For more information on data protection in CTIS sponsors can consult also:•

CTIS Joint controllership arrangement (JCA):
https://www.ema.europa.eu/en/documents/other/joint-controllership-arrangement-regardclinical-trials-information-system-ctis_en.pdf•

Questions and answers on the JCA:
https://www.ema.europa.eu/en/documents/other/questions-answers-joint-controllershiparrangement-data-protection-matters-related-use-clinical_en.pdf

Q&A on the protection of Commercially Confidential Information and Personal Data
while using CTIS
EMA/898965/2022

Page 8/10

3. Commercially Confidential Information
3.1. May sponsors mark/highlight the text that they consider CCI in documents ‘not for
publication’?
No, this is not necessary. However, in case the sponsors wish to flag what they consider CCI in the
documents ‘not for publication’, they could place red border boxes around the text as indicated below.
The corresponding text in the document version ‘for publication’ should be redacted with black
background boxes. Redacted text and the black background redaction box (that covers the redactedtext) should neither be searchable nor allow further editing. This is not mandatory and can be done
only for information to the Member State.
Example:a) Documents ‘not for publication’ mark in a text content that is considered CCI with red border boxesb) Documents ‘for publication’
It is important that the version of the documents ‘not for publication’ is readable and ready to be used
for Member State (MS) assessment.
Application of redaction in the version ‘for publication’ should be done with scrupulous judgment. It
should be considered that extensive redaction in the document versions ‘for publication’ would goagainst the spirit of transparency of the CTR. The redacted documents have to remain meaningful tothe public, including potential trial participants and health care professionals.
3.2. How can dose details be protected from disclosure from CTIS for certain trials
categories?
Medicinal products’ and active substances’ details of trials falling into Category 1, as well as those of
integrated phase 1 and 2 trials falling under category 2 are subject to publication 30 months after theend of the trial in the EU/EEA, in line with the Revised CTIS transparency rules.
In some other instances, depending on the trial development phase, dose details may be considered to
be CCI. In such instances, sponsors can include ‘dummy data’ (e.g. 00 digits) in the related structured
data field(s) of CTIS.
The full information on the posology should, however, be provided to the Member States forassessment in the document version ‘not for publication’ and can be redacted in the corresponding
documents to be published.
This approach would be acceptable only on justified grounds, i.e. when the sponsor proves that the
specific information on the posology is not in the public domain and constitutes patentable matter, thedisclosure of which before a patent application is filed (typically, after the completion of the trial andduring the trial readout) would jeopardise its protection.
The grounds for considering dose details as CCI should be clearly documented in the cover letter of theapplication.
3.3. Is it possible not to disclose patient facing documents publicly?
In some cases, written agreements between the sponsor and the third-party service provider expressly
establish that patient facing documents (e.g. patient questionnaires) cannot be disclosed publicly. In
Q&A on the protection of Commercially Confidential Information and Personal Data
while using CTIS
EMA/898965/2022

Page 9/10

those cases, it is possible for the sponsor to upload in the ‘for publication’ placeholder a document
where a justification for not disclosing the patient facing document is provided. In the placeholder ‘notfor publication’ the document with its full content should be uploaded to allow the Member State(s)assessment.

Q&A on the protection of Commercially Confidential Information and Personal Data
while using CTIS
EMA/898965/2022

Page 10/10