1. Introduction

Data residency conflicts in multi-country clinical trials arise when personal data, particularly clinical, medical, genetic and health-related information of trial participants, is collected in one country, processed or stored in another country, and accessed by sponsors, Contract Research Organisations (CROs), laboratories, investigators or regulatory authorities located in several jurisdictions.

Clinical trials are increasingly international. A pharmaceutical company headquartered in the United States, for example, may conduct a clinical trial in India, recruit participants in the European Union, process laboratory results in Singapore and store clinical-trial records on cloud servers located in Ireland.

This arrangement creates complex legal questions:

Which country's data protection law applies?

Can clinical-trial participant data be transferred outside the country where it was collected?

Does the country where the data is collected require local storage?

Can a foreign sponsor access identifiable patient records?

What happens when two countries impose conflicting data localisation or data transfer requirements?

Which country's courts and regulatory authorities have jurisdiction over a violation?

Who bears liability: the sponsor, CRO, investigator, hospital or cloud service provider?

The central legal conflict is between the territorial control of personal data by individual states and the global operational requirements of international clinical research.

Importantly, data residency, data localisation and data sovereignty are related but distinct concepts.

2. Meaning and distinction between key concepts

For example, an Indian clinical trial may collect patient information in India but store it on servers in Germany.

Data residency: Germany.

Data collection jurisdiction: India.

Applicable legal obligations: Potentially Indian, German and European Union laws, depending on the parties, processing activities and territorial scope.

Data sovereignty: Multiple jurisdictions may assert regulatory authority.

A critical distinction is that storing data in a country does not automatically mean that only that country's law applies. The applicable laws depend on territorial scope, the parties' roles, the nature of processing and the relevant transfer provisions.

3. Why data residency conflicts arise in multi-country clinical trials

A. Different national data localisation requirements

Different countries adopt different approaches to the storage and transfer of personal information.

For example:

India regulates digital personal data through the Digital Personal Data Protection Act, 2023.

The European Union regulates personal data through the General Data Protection Regulation (GDPR).

China imposes specific localisation and cross-border transfer obligations under its Personal Information Protection Law (PIPL).

Brazil regulates personal data through the Lei Geral de Proteção de Dados (LGPD).

The United States follows a sectoral and state-based framework, including HIPAA for covered healthcare entities and business associates.

Consequently, a clinical-trial sponsor cannot assume that a single global data management policy will satisfy every country's legal requirements.

B. Conflicting cross-border transfer rules

Suppose a clinical trial is conducted in India and the European Union.

The European sponsor wants to transfer Indian participants' clinical data to its European headquarters.

At the same time, the Indian data protection framework may impose conditions on transfers to particular jurisdictions, and the sponsor must also comply with applicable clinical-trial confidentiality and recordkeeping requirements.

The conflict arises because the sponsor may be subject to different regulatory obligations in the countries involved.

C. Conflict between informed consent and data protection law

Clinical-trial participants provide informed consent for participation in research. However, consent to participate in a clinical trial does not automatically constitute valid consent for every subsequent use or international transfer of personal data.

For example, participants may consent to:

Participation in a cancer drug trial.

Collection of blood samples.

Laboratory testing.

Analysis of medical records.

However, this does not necessarily mean they have agreed to unrestricted disclosure of their identifiable medical information to third parties in foreign jurisdictions.

D. Conflict between research transparency and confidentiality

Clinical trials require scientific transparency, reproducibility, regulatory reporting and safety monitoring.

At the same time, data protection laws require confidentiality and appropriate safeguards.

The sponsor may need to share clinical trial data with:

Foreign regulatory authorities.

Ethics committees.

Independent data monitoring committees.

Contract research organisations.

Statistical analysis centres.

Pharmaceutical research partners.

The legal challenge is to ensure that legitimate research objectives do not override participants' privacy rights.

4. Major legal frameworks governing multi-country clinical trials

A. European Union – General Data Protection Regulation (GDPR)

EU legal framework

The General Data Protection Regulation (GDPR) is one of the most influential data protection frameworks governing international clinical research.

Important provisions include:

Article 3 – Territorial scope

The GDPR can apply to organisations established in the EU and, in specified circumstances, organisations outside the EU that offer goods or services to individuals in the EU or monitor their behaviour there.

Article 5 – Principles relating to processing

Clinical-trial data processing must comply with principles including:

Lawfulness, fairness and transparency.

Purpose limitation.

Data minimisation.

Accuracy.

Storage limitation.

Integrity and confidentiality.

Accountability.

Article 6 – Lawfulness of processing

Processing requires a lawful basis, such as consent, performance of a contract, legal obligation or another applicable basis.

Article 9 – Special categories of personal data

Health information and genetic data are special-category personal data. Their processing is generally prohibited unless an applicable exception exists.

Article 9(2)(j) provides an exception for processing necessary for scientific research purposes, subject to applicable safeguards and Union or Member State law.

Articles 44–49 – International data transfers

These provisions regulate transfers of personal data to countries outside the European Economic Area.

Important mechanisms include:

Adequacy decisions under Article 45.

Standard Contractual Clauses (SCCs) under Article 46.

Binding Corporate Rules under Article 47.

Limited derogations under Article 49.

Practical implication: An EU-based clinical-trial sponsor cannot simply transfer identifiable participant data to a third-country CRO without examining the applicable transfer mechanism and safeguards.

B. India – Digital Personal Data Protection Act, 2023

Indian legal framework

The Digital Personal Data Protection Act, 2023 establishes India's framework for processing digital personal data.

Important provisions include:

Section 3 – Application of the Act

The Act applies to digital personal data processed within India and, subject to its conditions, processing outside India in connection with offering goods or services to individuals within India.

Section 4 – Grounds for processing

Personal data may be processed for a lawful purpose on the basis of consent or certain legitimate uses recognised by the Act.

Section 8 – General obligations of Data Fiduciary

A Data Fiduciary must comply with obligations relating to processing, security safeguards, breach reporting and other statutory requirements.

Section 16 – Processing of personal data outside India

The Central Government may restrict transfers of personal data to specified countries or territories.

This is important because India does not establish a general requirement that every category of personal data must always remain physically stored within India under the DPDP Act.

However, other applicable Indian laws, regulatory requirements and contractual obligations must also be examined.

Practical implication: A foreign sponsor or CRO processing Indian trial participants' digital personal data must assess the DPDP Act's applicability, the applicable rules and transfer restrictions, as well as clinical-trial-specific obligations.

C. China – Personal Information Protection Law (PIPL)

Chinese legal framework

China's Personal Information Protection Law (PIPL) establishes extensive controls over personal information processing and international transfers.

Important provisions include:

Article 3: Territorial application.

Article 6: Purpose limitation and data minimisation.

Article 13: Legal bases for processing.

Article 28: Sensitive personal information.

Article 38: Conditions for transferring personal information outside China.

Article 39: Information and separate consent requirements in specified cross-border transfers.

Article 40: Local storage and security assessment requirements for specified critical information infrastructure operators and qualifying large-scale personal information processors.

Health and medical information may constitute sensitive personal information under PIPL.

Practical implication: A global clinical-trial sponsor collecting medical information in China must examine the applicable cross-border transfer mechanism and whether local storage or a security assessment is required.

D. United States – HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) establishes privacy and security obligations concerning protected health information (PHI).

HIPAA applies to covered entities and business associates within its statutory scope.

Important provisions include:

Privacy Rule: 45 CFR Parts 160 and 164.

Security Rule: 45 CFR Part 164, Subpart C.

Breach Notification Rule: 45 CFR §§ 164.400–414.

HIPAA does not impose a general requirement that all PHI must be stored within the United States.

However, contractual requirements, security obligations and other applicable federal and state laws may affect international access and processing.

E. International clinical-trial standards

Apart from domestic data protection legislation, clinical research is also governed by international standards.

Important instruments include:

ICH-GCP E6(R3): International Council for Harmonisation guidelines on Good Clinical Practice, addressing participant protection, data governance, data integrity and trial oversight.

Declaration of Helsinki: Ethical principles governing medical research involving human participants.

CIOMS International Ethical Guidelines: Ethical requirements for health-related research involving humans.

EU Clinical Trials Regulation 536/2014: Governs clinical trials conducted within the EU and interacts with GDPR requirements.

An important point is that compliance with Good Clinical Practice does not automatically establish compliance with national data protection legislation.

5. Important case laws relating to data residency conflicts and clinical trials

There is an important legal distinction here: not every relevant judgment directly concerns data residency in clinical trials. Some establish the constitutional right to privacy, others govern international data transfers, and others establish safeguards for clinical-trial participants.

The following cases should therefore be understood as forming the legal foundation for resolving data residency conflicts.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Leading Indian constitutional precedent

Supreme Court of India | (2017) 10 SCC 1 | Judgment dated 24 August 2017

Background

The case concerned whether the right to privacy is protected as a fundamental right under the Constitution of India.

The Supreme Court considered the relationship between privacy, personal liberty, dignity and individual autonomy.

Issues before the Court

Whether the right to privacy is a fundamental right.

Whether privacy is protected under Article 21.

Whether the State can interfere with an individual's privacy without satisfying constitutional requirements.

Judgment

A nine-judge Constitution Bench unanimously recognised privacy as a fundamental right protected under Article 21 and as an intrinsic part of the freedoms guaranteed under Part III of the Constitution.

The judgment recognised informational privacy as an important dimension of the right to privacy.

The constitutional framework requires an interference with privacy to satisfy legality, legitimate State purpose, proportionality and appropriate safeguards.

Relevance to multi-country clinical trials

The judgment is significant because clinical-trial participants disclose highly sensitive information, including:

Medical history.

Genetic information.

Blood test results.

Psychiatric records.

Disease history.

Treatment responses.

Biometric information.

Such information is closely connected with individual autonomy and privacy.

Suppose an Indian hospital collects identifiable medical information from participants in a clinical trial and transfers it to a foreign pharmaceutical sponsor.

The transfer must be evaluated against applicable statutory protections and the constitutional privacy principles recognised in Puttaswamy.

A foreign sponsor cannot justify unrestricted use of Indian participants' personal information merely because the information is required for scientific research.

Legal principle: Privacy and informational autonomy must be protected when personal information is collected, stored, processed and disclosed.

Source: Puttaswamy judgment .

Sci API

+1

Case 2: Swasthya Adhikar Manch, Indore v. Union of India (2013–2014 and subsequent proceedings)

Important Indian clinical-trial precedent

Supreme Court of India | W.P. (C) No. 33 of 2012

Background

The case involved concerns regarding irregularities in clinical trials conducted in India.

The petitioners raised concerns regarding:

Inadequate informed consent.

Unethical clinical-trial practices.

Deaths and serious adverse events.

Compensation for trial-related injuries.

Regulatory supervision of clinical trials.

The Supreme Court examined the regulatory framework governing clinical research in India.

Important judicial directions

The Court emphasised the need for appropriate safeguards in clinical trials, including proper informed-consent procedures.

In its proceedings, the Court also addressed audio-visual recording of the informed-consent process and preservation of the associated documentation while maintaining confidentiality.

Relevance to data residency conflicts

This case is particularly important when a multinational sponsor collects clinical-trial information in India.

Consider the following situation:

An Indian participant signs a consent form at a local hospital. The sponsor subsequently transfers the participant's clinical records to a foreign CRO.

The sponsor must ensure that:

The informed-consent process is properly conducted.

Participant confidentiality is maintained.

Clinical-trial documentation is preserved.

Applicable regulatory requirements are followed.

Foreign processing does not undermine participant protection.

The judgment is not a direct ruling on cross-border data localisation. Rather, it establishes an important foundation for participant protection and confidentiality in Indian clinical research.

Legal principle: Clinical-trial research must be conducted with adequate participant safeguards, informed consent and confidentiality.

Sources: Swasthya Adhikar Manch proceedings  and Supreme Court order on consent recording and confidentiality .

PMC

+2

Case 3: Data Protection Commissioner v. Facebook Ireland Ltd. and Maximillian Schrems (Schrems II)

Landmark international data-transfer precedent

Court of Justice of the European Union | Case C-311/18 | 16 July 2020 | ECLI:EU:C:2020:559

Background

Maximillian Schrems challenged the transfer of personal information from Facebook Ireland to Facebook Inc. in the United States.

The dispute concerned whether the United States provided adequate protection for personal data transferred from the European Union.

The case examined the validity of Standard Contractual Clauses and the EU-US Privacy Shield.

Legal issues

Whether personal data could be transferred to a third country under Standard Contractual Clauses.

Whether the legal system of the receiving country provided adequate protection.

Whether individuals had enforceable rights and effective legal remedies.

Whether foreign government surveillance could undermine the protection promised by contractual arrangements.

Judgment

The CJEU:

Invalidated the EU-US Privacy Shield adequacy decision.

Upheld the validity of Standard Contractual Clauses in principle.

Required an assessment of the protection available in the receiving country.

Emphasised the need for effective safeguards and supplementary measures where necessary.

Recognised that transfers must be suspended or prohibited where the required protection cannot be ensured.

Application to clinical trials

This is arguably the most important international judgment for understanding cross-border clinical-trial data transfers.

Imagine a clinical trial involving patients in Germany, France and India.

The European sponsor transfers patient information to a US-based CRO for statistical analysis.

Even if the sponsor and CRO execute Standard Contractual Clauses, that agreement alone may not be sufficient.

The sponsor must assess:

The data protection laws of the United States.

The possibility of government access.

The nature of the information being transferred.

Whether participants have effective legal remedies.

Whether additional technical and organisational safeguards are necessary.

For clinical trials, additional safeguards may include:

Pseudonymisation.

Encryption.

Restricted access to identifiable records.

Separation of identification keys.

Strict contractual limitations on secondary use.

Legal principle: A contractual agreement cannot, by itself, overcome deficiencies in the legal protection available in the receiving country.

This principle is particularly significant for pharmaceutical companies transferring clinical-trial data from the EU to countries with different privacy standards.

Sources: and Irish Data Protection Commission case summary .

EUR-Lex

+2

Case 4: Schrems v. Data Protection Commissioner (Schrems I)

Court of Justice of the European Union | Case C-362/14 | 6 October 2015

Background

Maximillian Schrems challenged the transfer of personal data from the EU to the United States under the Safe Harbour framework.

He argued that the framework did not adequately protect European citizens against access to their personal information by US authorities.

Judgment

The CJEU invalidated the EU-US Safe Harbour adequacy decision.

It emphasised that the fundamental rights of individuals cannot be undermined by a third country's surveillance practices.

Relevance to clinical trials

Suppose an EU-based pharmaceutical company transfers identifiable patient information to a US-based research organisation.

The existence of a commercial agreement between the organisations does not automatically establish that the foreign destination provides adequate protection.

The sponsor must evaluate the applicable international transfer mechanism and safeguards.

Legal principle: International data transfers must preserve an adequate level of protection for individuals, even when the data is transferred for legitimate commercial or research purposes.

This decision provides historical context for the stricter transfer requirements subsequently developed in Schrems II.

Case 5: Public Health and Medical Professionals for Transparency v. FDA (2022)

United States District Court for the Northern District of Texas | 2022

Background

The litigation concerned public access to clinical-trial documents submitted to the US Food and Drug Administration in connection with COVID-19 vaccine approval.

The applicants sought disclosure of regulatory records relating to the vaccine approval process.

The dispute raised important questions concerning transparency in clinical research and access to regulatory information.

Relevance to data residency conflicts

This case illustrates the tension between:

Public access to clinical-trial information.

Protection of participants' personal information.

Regulatory transparency.

Confidential commercial information.

In multinational trials, regulatory authorities may require access to clinical-trial documents, even where the original records are maintained in another country.

However, disclosure of regulatory information does not mean that all identifiable participant information must be made public.

Appropriate redaction and protection of confidential information remain important.

The Indian Supreme Court also considered arguments relating to clinical-trial data transparency in Jacob Puliyel v. Union of India, W.P. (C) No. 607 of 2021, judgment dated 2 May 2022.

Sci API

Legal principle: Clinical-trial transparency must be balanced against individual privacy and legitimate confidentiality interests.

6. Comparative analysis of the case laws

Important academic observation: None of these cases should be cited as establishing a universal rule that clinical-trial data must be stored in the country where participants are recruited. Their importance lies in establishing the privacy, consent, confidentiality and international transfer principles that govern the issue.

7. Practical examples of data residency conflicts in multi-country clinical trials

frontiersin.org

Example 1: India–EU clinical trial

Suppose a pharmaceutical company based in Germany conducts a clinical trial in India.

The trial involves 1,000 Indian participants.

The Indian hospital collects:

Patient names.

Medical histories.

Laboratory results.

Treatment outcomes.

Adverse-event information.

The data is transferred to Germany for statistical analysis.

Legal conflict

India's DPDP framework and applicable clinical-trial requirements must be considered alongside the GDPR where the GDPR applies to the relevant processing.

The sponsor must examine:

Whether the information is personal data.

Whether the transfer is permitted under applicable Indian law.

Whether the sponsor has a lawful basis for processing.

Whether the relevant GDPR international transfer mechanism is satisfied.

Whether appropriate technical and organisational safeguards are in place.

Possible solution

Keep direct identifiers with the Indian hospital wherever feasible.

Transfer pseudonymised trial records for statistical analysis.

Establish appropriate data-processing agreements.

Implement encryption and access restrictions.

Document the applicable legal basis and transfer mechanism.

Example 2: EU–US clinical trial

A European pharmaceutical company conducts a clinical trial in France and transfers the data to a US-based CRO.

Conflict

The GDPR regulates the transfer of personal data outside the EEA.

The CRO may be subject to US laws, including government access requirements.

Applicable case law: Schrems II.

Possible solution

Execute the appropriate EU Standard Contractual Clauses.

Conduct a Transfer Impact Assessment.

Introduce supplementary technical measures.

Restrict access to identifiable information.

Suspend transfers if adequate protection cannot be ensured.

Example 3: China–US clinical trial

A Chinese hospital conducts a clinical trial in collaboration with an American pharmaceutical company.

The Chinese hospital transfers participants' medical and genetic information to the US sponsor.

Conflict

China's PIPL may require an applicable cross-border transfer mechanism, separate consent in specified circumstances, and a personal information protection impact assessment.

Additional requirements may arise under China's Human Genetic Resources framework.

Possible solution

Identify whether the data constitutes sensitive personal information or important data.

Determine whether the relevant transfer assessment, certification or standard contract requirements apply.

Obtain the required participant consent where applicable.

Assess whether local retention is mandatory.

Examine human genetic resource restrictions separately.

The Chinese framework is especially significant because clinical research can involve both personal information and regulated genetic-resource information.

CASRAI

+2

8. Major legal challenges in resolving data residency conflicts

A. Conflict of jurisdiction

One of the most complicated problems is determining which country has authority over the clinical-trial data.

For example:

The participants are located in India.

The hospital conducting the trial is in India.

The pharmaceutical sponsor is in Germany.

The CRO is in the United States.

The cloud server is located in Singapore.

In this situation, several jurisdictions may have legal authority over different aspects of the processing.

The conflict may concern:

Regulatory investigations.

Data breach notifications.

Requests for access to clinical records.

Rights of participants to access or erase their data.

Legal liability for unlawful disclosure.

Legal concern: A multinational sponsor must not assume that the law of the country where the server is located is the only applicable law.

B. Government access versus participant confidentiality

A government authority may require disclosure of clinical-trial information under its domestic laws.

However, the country where the participants were recruited may impose confidentiality obligations.

For example, a US-based CRO may receive a lawful government request for information that includes clinical-trial records originating in India.

The CRO may face competing obligations involving:

The foreign government's disclosure requirements.

Contractual confidentiality obligations.

Indian privacy requirements.

Applicable international data transfer restrictions.

This problem requires an assessment of the legal basis for disclosure, the scope of the request and available safeguards.

C. Data retention and deletion conflicts

Different jurisdictions may prescribe different retention periods for clinical-trial documentation.

Clinical-trial sponsors must preserve certain records for regulatory inspection, scientific verification and participant safety.

At the same time, data protection laws generally require that personal information not be retained longer than necessary for its purpose, subject to applicable exceptions.

For example, a participant may request deletion of personal information while the sponsor is legally required to retain particular clinical-trial records.

The solution is not necessarily to delete every record. The sponsor must identify the applicable legal retention obligation and restrict further processing where appropriate.

D. Data breach notification conflicts

Suppose a multinational clinical-trial database is compromised.

The database contains medical information relating to participants in India, Germany, China and the United States.

The incident may trigger different notification obligations and deadlines under the laws applicable to the affected processing.

The sponsor must establish:

Which participants are affected.

Which national laws apply.

Which regulator must be notified.

Whether affected individuals must be informed.

Whether the breach involves identifiable or pseudonymised information.

Which organisation is responsible for notification.

9. Legal mechanisms for resolving data residency conflicts

Several legal and technical mechanisms can help multinational sponsors manage these conflicts.

9.1 Standard Contractual Clauses (SCCs)

Standard Contractual Clauses are contractual safeguards adopted by the European Commission for certain international transfers of personal data.

They establish obligations between data exporters and data importers.

For example, a German pharmaceutical company may execute SCCs with an American CRO.

The clauses can regulate:

Purpose of processing.

Confidentiality.

Security obligations.

Sub-processing.

Data subject rights.

Government access requests.

Return or deletion of information.

However, as established in Schrems II, signing SCCs is not sufficient in every situation. The parties must assess whether the safeguards can actually be complied with in the destination country.

9.2 Data localisation

Data localisation involves retaining specified categories of data within the jurisdiction where they were collected or generated.

For example, a Chinese clinical-trial organisation may need to maintain certain regulated information within China.

Data localisation can help:

Satisfy local regulatory requirements.

Reduce certain cross-border transfer risks.

Facilitate regulatory supervision.

Protect sensitive medical information.

However, localisation should not be treated as a universal requirement. It depends on the applicable law and the particular category of data.

9.3 Pseudonymisation

Pseudonymisation replaces direct identifiers with artificial identifiers.

For example:

The identification key is stored separately and access is restricted.

Pseudonymisation is particularly useful in multinational clinical trials because the foreign sponsor can often analyse clinical outcomes without receiving direct identifiers.

However, pseudonymised information generally remains personal data under the GDPR where re-identification remains possible.

9.4 Encryption

Encryption protects clinical-trial data against unauthorised access.

A multinational clinical-trial sponsor should consider:

Encryption at rest.

Encryption during transmission.

Appropriate key management.

Restricted administrative access.

Role-based permissions.

Audit trails.

Encryption is an important security safeguard, but it does not independently establish that an international data transfer is legally permitted.

9.5 Data Processing Agreements

A Data Processing Agreement (DPA) should clearly allocate responsibilities between the sponsor, CRO, hospital and cloud service provider.

It should address:

Purpose and scope of processing.

Categories of personal information.

Roles and responsibilities.

Confidentiality obligations.

Security safeguards.

International transfers.

Subcontracting arrangements.

Data breach reporting.

Retention and deletion.

Regulatory cooperation and audit rights.

10. Indian legal position: Specific relevance to multinational clinical trials

For a research paper or Indian law examination, this is an especially important part.

The Indian legal framework should be analysed through the following instruments.

A. Digital Personal Data Protection Act, 2023

Three provisions deserve particular attention.

Section 4: Establishes the requirement for lawful processing of digital personal data.

Section 8: Establishes general obligations of Data Fiduciaries, including responsibility for compliance and security safeguards.

Section 16: Enables the Central Government to restrict transfers of personal data to specified countries or territories.

An important clarification is that Section 16 does not itself impose universal data localisation.

Therefore, a foreign clinical-trial sponsor should not automatically assume that all Indian participants' digital health information must remain in India.

The sponsor must assess applicable government restrictions, rules and other sector-specific requirements.

B. New Drugs and Clinical Trials Rules, 2019

The New Drugs and Clinical Trials Rules, 2019 provide the regulatory framework for clinical trials in India.

They address matters including:

Permission for conducting clinical trials.

Ethics Committee requirements.

Informed consent.

Compensation for clinical-trial-related injury or death.

Responsibilities of sponsors and investigators.

Regulatory oversight.

These rules must be read alongside the applicable data protection and confidentiality requirements.

C. Article 21 of the Constitution

Following Justice K.S. Puttaswamy v. Union of India, privacy is constitutionally protected.

Consequently, the handling of clinical-trial participant information must respect privacy and informational autonomy.

A foreign sponsor's commercial interest in obtaining research information cannot automatically override the participant's privacy interests.

11. Illustrative legal problem: Multinational pharmaceutical clinical trial

Consider the following hypothetical situation.

Facts of the hypothetical case

A pharmaceutical company headquartered in Germany conducts a cancer drug trial in India, Germany and China.

India

Patients are recruited and their medical records are collected at Indian hospitals.

Germany

The sponsor receives clinical-trial data for regulatory and statistical analysis.

China

Chinese hospitals collect medical and genetic information.

United States

A US-based CRO performs statistical analysis using the combined dataset.

Legal issues

Issue 1: Whether Indian patient data can be transferred to Germany?

The transfer must comply with applicable Indian data protection requirements and any relevant restrictions. Where the GDPR applies to the processing, its requirements must also be satisfied.

Issue 2: Whether German patient data can be transferred to the US CRO?

The sponsor must examine GDPR Articles 44–49 and identify an applicable transfer mechanism. If SCCs are used, the Schrems II assessment and any necessary supplementary safeguards must be considered.

Issue 3: Whether Chinese genetic information can be transferred to the US?

The sponsor must assess PIPL, relevant implementing regulations and the separate Chinese human genetic resources framework. Depending on the nature of the information and parties involved, additional approvals or restrictions may apply.

Issue 4: Who is responsible for a data breach?

Liability depends on the respective legal roles and obligations of the sponsor, CRO, investigator, hospital and other processors.

Issue 5: Can the sponsor retain all information indefinitely?

No. Applicable clinical-trial record-retention requirements must be balanced against data protection principles and any relevant statutory exceptions.

Suggested legal resolution

The sponsor should adopt a jurisdiction-specific data governance arrangement:

Indian identifiable participant records should be protected under applicable Indian law.

EU participant data should be processed in accordance with GDPR.

Chinese personal and genetic information should undergo the necessary Chinese regulatory assessment.

The US CRO should receive only the information required for its approved research functions.

International transfers should be supported by the appropriate legal mechanisms.

A common global security framework should operate alongside country-specific legal requirements.

This approach allows international research collaboration while protecting the rights of participants.

12. Recommendations for preventing data residency conflicts

A multinational clinical-trial sponsor should implement the following compliance framework.

Suggested compliance structure

Step 1: Identify jurisdictions

Determine where participants, sponsors, CROs and servers are located.

Step 2: Classify clinical-trial data

Identify personal, health, genetic and anonymised information.

Step 3: Examine applicable laws

Compare localisation, transfer, consent and retention requirements.

Step 4: Implement safeguards

Use contracts, encryption, pseudonymisation and access controls.

Step 5: Continuous monitoring

Audit data flows, review legal changes and monitor compliance.

13. Critical analysis

Data residency conflicts in multinational clinical trials reveal a fundamental tension between two important legal objectives.

First, protection of individual privacy.

Participants have a legitimate interest in controlling the collection, disclosure and use of their sensitive medical information.

Second, advancement of medical science.

International collaboration enables pharmaceutical companies and researchers to conduct large-scale trials, identify treatment outcomes, monitor adverse events and develop new medicines.

Excessive restrictions on cross-border data transfers may create operational difficulties, increase research costs and delay scientific collaboration.

On the other hand, unrestricted international transfers may expose participants to surveillance, unauthorised disclosure, discrimination and misuse of medical information.

Therefore, neither unrestricted data movement nor universal data localisation provides a complete solution.

A more balanced legal framework should adopt:

Risk-based international data transfer assessments.

Strong participant confidentiality protections.

Purpose limitation and data minimisation.

Appropriate international contractual safeguards.

Effective regulatory supervision.

Cooperation between national data protection authorities.

The principle of privacy by design should be incorporated from the beginning of the clinical-trial planning process rather than introduced after data collection has started.

14. Conclusion

Data residency conflicts in multi-country clinical trials represent a significant challenge in contemporary international health research.

The conflict arises because clinical trials operate across national boundaries, whereas data protection laws are primarily based on territorial jurisdiction.

The GDPR, India's DPDP Act, China's PIPL and the US healthcare privacy framework adopt different approaches to the collection, storage, processing and transfer of sensitive medical information.

Judicial decisions such as Justice K.S. Puttaswamy v. Union of India, Swasthya Adhikar Manch v. Union of India and Schrems II establish important principles concerning privacy, informed consent, confidentiality and international data transfers.

The ultimate objective should be to develop a harmonised, risk-based data governance system that protects clinical-trial participants without unnecessarily obstructing international scientific collaboration.

Thus, the legal solution lies not simply in deciding where clinical-trial data should be stored, but in ensuring that the collection, storage, processing, transfer and subsequent use of that data remain lawful and adequately protected across every relevant jurisdiction.

15. Important legal references and reading material

For academic research, dissertation writing or a legal presentation, the following primary materials are particularly useful.

16. Suggested structure for an academic research paper

If this topic is being developed as a law dissertation, seminar paper or research assignment, the following chapter structure would be appropriate:

Introduction to data residency in multinational clinical trials.

Conceptual distinction between data residency, localisation and sovereignty.

International legal framework governing clinical-trial data.

Comparative analysis of India, EU, US and China.

Judicial interpretation and relevant case laws.

Conflicts concerning informed consent, confidentiality and cross-border transfers.

Legal liability of pharmaceutical sponsors and CROs.

Challenges in implementing international data governance.

Recommendations for harmonisation of data protection laws.

Conclusion and future legal developments.

One particularly important research argument: International clinical-trial data governance should distinguish between the physical location of data and the legal authority to control its processing. This distinction provides a strong foundation for analysing data residency conflicts.

Legal currency note: This explanation reflects the legal framework as at 4 November 2026. For actual clinical-trial deployment, verify the commencement and applicable provisions of the DPDP Rules, 2025, current transfer restrictions and country-specific clinical-trial regulations. This is an academic overview, not jurisdiction-specific legal advice.