Data protection and clinical trials
Read the PDF edition (2 pages)
Clinical research generates some of the most sensitive data that a company can hold. Health data of trial participants, genetic information and data from patient support programmes are particularly protected under Swiss law and under the General Data Protection Regulation of the European Union. The revised Swiss Federal Act on Data Protection, which entered into force on 1 September 2023, classifies health and genetic data as sensitive personal data and requires, among other things, data protection impact assessments for high-risk processing and the reporting of certain data breaches to the Federal Data Protection and Information Commissioner. Because clinical trials of the Basel groups are run in dozens of countries, the transfer of data to Switzerland and onwards to other countries must be structured in compliance with the rules on international data transfers.1
The conduct of clinical trials in Switzerland is governed by the Human Research Act and the Clinical Trials Ordinance, which require the approval of a cantonal ethics committee and, for trials with medicinal products, of Swissmedic. The Ethics Committee for Northwest and Central Switzerland, based in Basel, reviews a considerable share of the country's research projects because of the concentration of university hospitals and industry in the region. Compliance in this field covers the protection of participants, the correct handling of informed consent, the reporting of adverse events and the integrity of the data. Payments to investigators and institutions are covered by the transparency rules discussed above. Infringements can lead to administrative measures and, in serious cases, to criminal proceedings under the Human Research Act.2
Data protection has also become a factor in internal investigations. When a company investigates allegations of misconduct, it needs to review e-mails, chat messages and documents of its employees. Swiss data protection law and labour law allow this only within limits that include the employees' right to be informed. If the results are to be passed to foreign authorities, Article 271 StGB and the rules on cross-border data transfers must be observed. Lawyers who conduct such investigations in Basel therefore work with protocols that document each step and that provide for the involvement of the Federal Office of Justice or other authorities where necessary. The interplay of these regimes is one reason why compliance in a Swiss headquarters is legally more complex than in a purely domestic company.3
Notes
- Federal Act on Data Protection of 25 September 2020 (FADP/DSG, SR 235.1), in force since 1 September 2023, Article 5 letter c (sensitive personal data), Articles 16 et seq. (cross-border disclosure), Article 22 (impact assessment) and Article 24 (notification of breaches); Regulation (EU) 2016/679 (GDPR), Articles 9 and 44 et seq. To be verified. ↩
- Federal Act on Research involving Human Beings of 30 September 2011 (Human Research Act, HRA/HFG, SR 810.30); Ordinance on Clinical Trials in Human Research of 20 September 2013 (ClinO/KlinV, SR 810.305); on the Ethics Committee for Northwest and Central Switzerland (EKNZ), see its website. To be verified. ↩
- On the legal framework for internal investigations in Switzerland, including the employee's rights under Article 328b of the Swiss Code of Obligations and the FADP, and on the procedure for the authorisation of cooperation with foreign authorities under Article 271 StGB, see the relevant literature and the practice of the Federal Department of Justice and Police. To be verified. ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of August 2025.