1. Introduction

Data-sharing policies for trial datasets are the legal, ethical, technical, and institutional rules governing the disclosure, transfer, access, reuse, publication, and preservation of data generated during clinical trials and other scientific research trials.

These policies are particularly important in pharmaceutical and biotechnology research, where trial datasets may contain patient medical histories, genomic information, treatment responses, adverse-event records, laboratory results, and commercially sensitive information.

The central legal question is:

How can researchers make trial data available for scientific verification and further research without violating participant privacy, informed-consent requirements, intellectual-property rights, confidentiality obligations, or regulatory restrictions?

A sound policy must balance five interests:

Scientific transparency and reproducibility.

Privacy and confidentiality of trial participants.

Protection of confidential commercial information.

Regulatory oversight and patient safety.

Fair access to research data and prevention of scientific misconduct.

International research recommendations support prospective data-sharing plans, appropriate consent, de-identification, controlled access, and clear agreements governing subsequent use.

DOI+1

2. Meaning and scope of trial datasets

A trial dataset is the structured collection of information generated or collected during a research study. It can include:

Individual participant data (IPD), such as measurements and treatment outcomes.

Clinical study reports and statistical analyses.

Adverse-event and safety-monitoring records.

Genomic, biomarker, imaging, and laboratory datasets.

Trial protocols, statistical analysis plans, and data dictionaries.

Audit trails, metadata, and records documenting data corrections.

Derived datasets used to support regulatory submissions or publications.

The legal treatment depends on the dataset's contents, the identity of the recipient, the purpose of disclosure, the applicable jurisdiction, and whether participants can reasonably be re-identified.

For example, sharing an aggregate table showing the overall response rate of a trial generally presents fewer privacy risks than transferring row-level genomic and medical records, although aggregate data can also create identification risks in small populations.

3. Principal legal frameworks

EMA official sees thrombosis link to AstraZeneca vaccine – DW – 04/06/2021

European Union

The General Data Protection Regulation (GDPR), Clinical Trials Regulation (EU) No. 536/2014, and applicable transparency requirements regulate personal-data processing and clinical-trial information. The European Medicines Agency's Policy 0070 established a framework for proactive publication of clinical reports, subject to applicable safeguards.

Publication and access to clinical-trial data+1

Federal workers ordered back to office find shortages of desks, Wi-Fi and toilet paper - OPB

United States

Relevant rules include HIPAA where applicable, the Common Rule for covered federally supported research, FDA requirements, and the federal clinical-trial registration and results-reporting framework under 42 U.S.C. § 282(j). These instruments have different scopes: not every trial dataset is subject to every rule.

Indian Council of Medical Research - Sanskriti IAS

India

Relevant authorities include the Digital Personal Data Protection Act, 2023, applicable implementing rules, the New Drugs and Clinical Trials Rules, 2019, as amended, and the Indian Council of Medical Research's National Ethical Guidelines for Biomedical and Health Research Involving Human Participants (2017). Their application depends on the research, processing activity, and current legal commencement and transition provisions.

ClinRegs+1

Ethical Principles for Medical Research Involving Human Subjects

International research ethics

The Declaration of Helsinki, ICH Good Clinical Practice guidelines, and research-specific ethical standards inform participant protection, responsible data management, and scientific integrity. Their legal enforceability varies; an ethical guideline is not automatically a statute.

4. Core legal principles governing trial-data sharing

A. Informed consent and secondary use

Participants should be informed about the intended collection, storage, sharing, and future use of their information. Where consent is the applicable legal basis, the consent must cover the relevant processing and satisfy the governing legal requirements.

A research consent form should address:

Whether individual-level data will be shared.

The categories of organisations that may receive the data.

Whether data will be used for future research, AI development, or commercial purposes.

Whether data will be transferred internationally.

The limits of withdrawal after data have been shared or incorporated into analyses.

The safeguards protecting participants against re-identification.

Broad consent to future scientific research can be appropriate where the governing law and ethical framework permit it. However, a general consent to participate in a trial should not automatically be treated as permission for every conceivable subsequent use.

The principles and recommendations for sharing individual participant data emphasise explicit broad consent where appropriate, de-identification, and transparent communication about limitations on withdrawal.

PMC+1

B. Anonymisation and pseudonymisation

These concepts are legally distinct.

Genomic datasets require particular care because genetic characteristics may enable identification even after names and obvious identifiers have been removed.

C. Purpose limitation and data minimisation

A recipient should receive only the data reasonably necessary for the approved research purpose. A researcher studying the effectiveness of a treatment may need efficacy outcomes and relevant baseline characteristics, but not necessarily participants' names, full addresses, or unrelated medical histories.

A data-sharing policy should define permitted research purposes, prohibit unauthorised onward disclosure, and require a fresh legal and ethical assessment where a proposed use materially differs from the original purpose.

D. Confidentiality and commercial interests

Trial datasets may disclose valuable information about:

Drug formulations and manufacturing processes.

Novel biomarkers and proprietary analytical methods.

Development strategies and unpublished results.

Patentable inventions and trade secrets.

Commercial sensitivity is not, by itself, a universal right to prevent disclosure. The applicable transparency regime determines which information must be published and which narrowly justified material may be withheld.

In particular, regulators should distinguish genuine trade secrets from information that is merely inconvenient or commercially disadvantageous to disclose. European regulatory practice recognises the need to balance transparency against personal-data protection and legitimate commercial confidentiality.

European Medicines Agency (EMA)+1

E. Data integrity and accountability

Sharing a dataset without preserving its provenance can undermine scientific validity. Sponsors and custodians should maintain:

Version histories and documented corrections.

Data dictionaries and coding definitions.

Audit trails and access logs.

Statistical analysis plans and relevant metadata.

Records of approvals, disclosures, and downstream recipients.

Where a dataset supports a regulatory submission, the shared version should be traceable to the underlying records and should not obscure material changes or exclusions.

5. Detailed case-law analysis

The following judgments are relevant to the legal principles underlying trial-data sharing. An important qualification is that not every case listed is a direct clinical-trial data-sharing dispute. Some establish broader privacy, transparency, research-duty, or disclosure principles that can be applied to trial datasets.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1 · Judgment dated 24 August 2017

Facts and issue: A nine-judge Constitution Bench considered whether privacy is a constitutionally protected fundamental right under Indian law.

Decision: The Court recognised privacy as an intrinsic part of life and personal liberty under Article 21 and the freedoms guaranteed by Part III of the Constitution. Informational privacy was recognised as an important component of the right.

Legal principle: Intrusions into privacy must satisfy the applicable constitutional requirements, including legality, a legitimate state aim or need, and proportionality.

Application to trial datasets: A public authority or publicly funded institution handling identifiable clinical-trial information should not treat disclosure as an administrative formality. It must consider the legal basis, necessity, purpose, and safeguards associated with disclosure. The judgment also supports the importance of a robust data-protection framework for private as well as public actors.

Sci API+1

Limitation: Puttaswamy did not establish a standalone statutory code for sharing clinical-trial datasets. Its constitutional principles must be applied alongside the relevant legislation and research regulations.

Case 2: PTC Therapeutics International Ltd v. European Medicines Agency (2020)

Court of Justice of the European Union · Case C-175/18 P · Judgment dated 22 January 2020

Facts and issue: The dispute concerned access to clinical and toxicology study reports submitted to the European Medicines Agency in connection with a marketing-authorisation process.

Decision: The Court of Justice upheld the rejection of the appeal against the General Court's judgment, which had rejected the claim that the reports should be treated as confidential in their entirety.

Legal principle: Regulatory submission of clinical study reports does not automatically make the reports confidential in their entirety. A party seeking protection must establish the relevant legal basis for confidentiality rather than rely solely on the sensitive nature of clinical research.

Application to trial datasets: Sponsors should separate genuinely protected commercial information from material subject to regulatory transparency requirements. Data-sharing policies should provide a documented review and redaction process instead of imposing blanket confidentiality on all trial information.

Limitation: This judgment concerned access to regulatory documents, not an unrestricted right for every researcher to obtain raw, identifiable participant-level data.

European Ombudsman+1

Case 3: Pari Pharma GmbH v. European Medicines Agency (2018)

General Court of the European Union · Case T-235/15 · Judgment dated 5 February 2018

Facts and issue: The dispute concerned access to a European Medicines Agency assessment report and the claimed confidentiality of information relating to a medicinal product.

Decision: The General Court examined whether the information qualified for protection as commercially confidential under the EU access-to-documents framework.

Legal principle: Confidentiality claims must be assessed under the applicable legal test and supported by a sufficient explanation of the harm disclosure would cause. A general assertion of commercial sensitivity is not necessarily sufficient.

Application to trial datasets: A sponsor should identify specific passages or data elements that qualify for protection and explain why disclosure would cause the legally relevant harm. This approach helps reconcile transparency with legitimate trade-secret protection.

Limitation: This was a regulatory-document access dispute, not a judgment establishing a general duty to release individual patient data. Its value lies in the analysis of confidentiality claims.

European Ombudsman+1

Case 4: Sorrell v. IMS Health Inc. (2011)

Supreme Court of the United States · 564 U.S. 552 (2011)

Facts and issue: Vermont restricted the sale, disclosure, and use of prescriber-identifying information for certain pharmaceutical marketing purposes. Data-mining companies challenged the restrictions.

Decision: The Supreme Court invalidated the restrictions under the First Amendment, treating the law as a content- and speaker-based restriction on speech.

Legal principle: The case demonstrates that rules governing the commercial use of health-related information can raise constitutional questions concerning speech and information markets.

Application to trial datasets: Data-sharing policies must be drafted within the constitutional and statutory framework applicable to the data and the intended use. However, this case does not create a general right to obtain clinical-trial data or permit unrestricted disclosure of patient records.

Limitation: The dispute involved prescriber information and pharmaceutical marketing, not confidential participant-level clinical-trial datasets. Its relevance is therefore indirect.

Case 5: Grimes v. Kennedy Krieger Institute, Inc. (2001)

Court of Appeals of Maryland, United States · 782 A.2d 807 (Md. 2001)

Facts and issue: The case involved a research programme examining lead exposure in residential environments and raised questions about the duties owed to children participating in research.

Legal significance: The decision addressed research ethics, participant protection, and the potential duties of researchers and institutions. It is not a direct precedent on secondary data sharing.

Application to trial datasets: Research institutions should not regard data-management arrangements as separate from their obligations to protect participants. A dataset-sharing arrangement that creates foreseeable risks to participants may require ethical review, additional safeguards, or restrictions on disclosure.

Limitation: The decision must be applied cautiously to data-sharing questions because its central issues concerned research-related duties and participant protection, rather than access to a repository or disclosure of trial records.

Case 6: In re Pfizer Inc. Securities Litigation (2008)

United States District Court, Southern District of New York · 538 F. Supp. 2d 621 (S.D.N.Y. 2008)

Facts and issue: Investors alleged securities-law violations concerning Pfizer's disclosures about its business and drug-development risks.

Legal significance: The case illustrates the distinction between confidential internal research information and information that a company may be required to disclose under securities law. Materiality, the statements made to investors, and the applicable disclosure duties are central to such disputes.

Application to trial datasets: A sponsor cannot assume that all adverse findings or unfavourable trial results may remain undisclosed merely because the underlying data are commercially sensitive. Clinical-trial reporting obligations, securities disclosures, and access-to-documents rules must be considered separately.

Limitation: This is not a general clinical-trial data-sharing precedent. It should not be cited as establishing an independent duty to release raw trial datasets.

6. Indian legal position

India is particularly relevant where a trial is conducted by an Indian hospital, biotechnology company, contract research organisation (CRO), university, or multinational sponsor working with Indian participants.

A. Constitutional privacy

Under Puttaswamy, the constitutional right to privacy provides an important foundation for protecting personal and medical information. Article 21 is particularly relevant to state action, while statutory data-protection and confidentiality obligations govern many private-sector activities.

The judgment does not prohibit all data sharing. It requires applicable legal protections and safeguards to be respected.

B. Digital Personal Data Protection Act, 2023

The DPDP Act establishes a framework for processing digital personal data, subject to its scope, exemptions, and commencement provisions.

For trial datasets, the principal compliance questions include:

Whether the information remains personal data.

Who determines the purposes and means of processing.

Whether the proposed sharing has a lawful basis.

Whether the required notice and consent conditions are satisfied, where applicable.

Whether security safeguards and breach-related obligations apply.

Whether the proposed recipient or overseas transfer creates additional compliance issues.

The Act does not mean that every scientific research activity automatically requires the same form of consent, nor does it mean that all research data are exempt. The applicable provisions and any relevant exemptions must be assessed for the particular activity.

ClinRegs+1

C. New Drugs and Clinical Trials Rules, 2019

The Rules, as amended, establish important requirements for regulated clinical trials, including informed consent, ethics committee oversight, participant safety, and sponsor and investigator responsibilities.

Data sharing should remain consistent with the trial protocol, the consent documentation, ethics committee requirements, and applicable confidentiality obligations. A data-use agreement cannot override mandatory statutory protections.

D. ICMR National Ethical Guidelines, 2017

The ICMR guidelines are an important ethical reference for biomedical and health research involving human participants. They address informed consent, confidentiality, biological materials, secondary use, and research oversight.

For research involving cross-border transfers of human biological material, applicable approvals and material transfer agreements may also be necessary. Transfer of a biological specimen is legally distinct from sharing a dataset derived from it, although both may be involved in the same collaboration.

ClinRegs+1

E. Practical Indian example

Suppose an Indian biotechnology company conducts a clinical trial and wants to share coded genomic data with a university in another country.

A compliant approach would ordinarily require the company to:

Review the original consent form and the approved research protocol.

Determine whether the genomic dataset is still identifiable or linkable.

Establish the lawful basis for the proposed processing and disclosure.

Obtain ethics committee approval or other review where required.

Execute an agreement specifying permitted uses, security controls, retention, onward disclosure, and incident reporting.

Assess applicable cross-border transfer restrictions and recipient-country requirements.

Document the decision, including any additional safeguards.

These steps are a compliance framework, not a claim that every step is mandatory for every trial. The precise requirements depend on the facts and the law in force.

7. Essential components of an effective trial-data sharing policy

A research sponsor or institution should adopt a written policy containing the following provisions.

1. Prospective data-sharing plan

Identify the datasets to be shared, the expected timetable, eligible recipients, intended research purposes, and the review process. Publish a data-sharing statement where required by the applicable registry, funder, regulator, or journal.

2. Consent and ethical approval

Document participant information, the applicable legal basis, relevant ethics committee decisions, and the limits of future use. Establish a process for assessing withdrawal requests where applicable.

3. Privacy and security

Use risk-appropriate de-identification, access controls, encryption, audit logs, secure transfer methods, and re-identification prohibitions. Genomic and rare-disease data may require stronger controls.

4. Data-use agreements

Define permitted uses, security standards, publication rights, onward transfers, retention, destruction, breach notification, and responsibility for unauthorised disclosure.

5. Transparency and confidentiality review

Separate public summaries and required regulatory disclosures from restricted individual-level data. Assess specific claims of commercial confidentiality under the applicable law.

6. Monitoring and enforcement

Maintain access records, investigate misuse, suspend access where justified, require remediation, and provide for contractual or statutory remedies.

8. Legal consequences of non-compliance

Failure to comply with trial-data sharing requirements can result in several types of liability.

The consequences are not automatic. Liability depends on the applicable statute, contractual terms, evidence of misconduct, causation where required, available defences, and the remedies provided by law.

9. Important distinction: mandatory disclosure versus voluntary sharing

Not all trial-data sharing has the same legal basis.

Regulatory disclosure

Information must be submitted or made public where required by applicable clinical-trial legislation, regulator rules, or reporting obligations. Personal information and genuine confidential material remain subject to the relevant safeguards and exceptions.

Academic or journal-driven sharing

A journal, funder, or institutional policy may require a data-sharing statement or make datasets available as a condition of publication or funding. The requirement does not override privacy legislation.

Secondary research sharing

Another researcher requests access to reanalyse the data or conduct a new study. Access may be granted through a controlled repository after review of the proposed purpose, consent, privacy risks, and relevant legal requirements.

10. Conclusion

Data-sharing policies for trial datasets are essential to responsible biomedical innovation. They promote reproducibility, independent verification, and more efficient research while protecting participants against privacy violations and preventing misuse of confidential information.

The key legal lessons are:

Puttaswamy establishes the constitutional importance of privacy in India.

PTC Therapeutics and Pari Pharma demonstrate that commercial confidentiality claims must be evaluated under the applicable transparency framework.

Sorrell illustrates how constitutional protections can affect restrictions on the use of health-related information, but does not authorise unrestricted access to trial records.

Research institutions should establish prospective sharing plans, risk-appropriate de-identification, access controls, and enforceable data-use agreements.

The legality of sharing must be assessed separately for each jurisdiction, dataset, recipient, and proposed purpose.

For legal research, the most important distinction is between a duty to disclose information, permission to share it, and a recipient's right to access it. These are separate legal questions.

Further research

A useful next step is to examine data-sharing agreements for multinational clinical trials, focusing on governing law, cross-border transfers, participant consent, audit rights, and liability for unauthorised disclosure.