Legal basis
The rules behind the checks, by market
The checks are read from one recorded episode. The legal and quality basis under them is read from 29 held controls across 7 frameworks, in market order: the United States, the European Union, the United Kingdom and Australia, then the international guideline each of them applies. Every entry is our one-sentence statement, with its control code and a link to the framework.
Where a market's regime is not held, the page says so rather than stating it. Nothing here is a substitute for the instrument.
United States: the held basis
The federal rules that touch a real-world evidence submission: electronic records and signatures, and the inspection of the records behind them. FDA reads the international good clinical practice guideline alongside these.
FDA 21 CFR Part 11
The federal rules that touch a real-world evidence submission: electronic records and signatures, and the inspection of the records behind them. FDA reads the international good clinical practice guideline alongside these.
Scope and implementation
The rule applies to electronic records and electronic signatures created, modified, maintained or transmitted in place of paper records that FDA regulates.
Audit trail requirements
A secure, computer-generated, time-stamped audit trail records who created, modified or deleted a record, and the trail cannot be turned off by the people it records.
Record protection, retention and inspection readiness
Records can be produced in a readable form for the whole retention period, and are available for inspection when asked for.
Access control, authority and device checks
Access is limited to authorised people, authority is checked at the point of use, and the system can show that the checks work.
European Union: the held basis
A study that will be filed in Europe sits inside the clinical trials regulation for its conduct and the data protection regulation for the people in the data.
EU Clinical Trials Regulation (CTR 536/2014)
A study that will be filed in Europe sits inside the clinical trials regulation for its conduct and the data protection regulation for the people in the data.
Compliance with the protocol and good clinical practice
The sponsor and investigator conduct the trial in accordance with the protocol and with good clinical practice.
Monitoring
The sponsor monitors the conduct of the trial to verify that the rights, safety and well-being of subjects are protected and the data is reliable.
Clinical trial master file and archiving
The sponsor and investigator keep a trial master file containing the essential documents, and archive it for the required period.
GDPR
A study that will be filed in Europe sits inside the clinical trials regulation for its conduct and the data protection regulation for the people in the data.
Principles relating to processing
Personal data is processed lawfully, fairly and transparently, for specified purposes, limited to what is needed, accurate, kept no longer than needed, and secure.
Lawfulness of processing
Processing rests on a named lawful basis, and research processing is tied to the basis the sponsor actually relies on.
Processor
A processor is engaged under a contract that sets the subject matter, duration, nature and purpose of the processing, and the processor's duties.
United Kingdom: the held basis
The UK applies its own version of the data protection regulation, with a research provision that matters when the legal basis is research rather than consent.
UK GDPR (UK General Data Protection Regulation)
The UK applies its own version of the data protection regulation, with a research provision that matters when the legal basis is research rather than consent.
Principles relating to processing
Personal data is processed lawfully, fairly and transparently, for specified purposes, limited to what is needed, accurate, kept no longer than needed, and secure.
Lawfulness of processing
Processing rests on a named lawful basis, and the basis is recorded before the processing begins.
Additional requirements when processing for research, archiving or statistical purposes
Research processing has to meet the additional safeguards the UK regime sets for scientific research.
Appropriate safeguards for research, archiving or statistical processing
The safeguards are not met if the processing is likely to cause substantial damage or substantial distress to an individual.
Australia: the held basis
Australian research ethics review and the Privacy Act govern the people in the data. The therapeutic goods law governs whether the product can be supplied, which is a separate question from whether the study is ready.
Australia NHMRC National Statement on Ethical Conduct in Human Research
Australian research ethics review and the Privacy Act govern the people in the data. The therapeutic goods law governs whether the product can be supplied, which is a separate question from whether the study is ready.
Research merit and integrity
The research is justifiable by its potential benefit, based on current literature, and conducted with integrity.
General requirements for consent
Consent is voluntary and based on sufficient information and adequate understanding of the research and its implications.
The elements of research
The research addresses its scope and design, recruitment, consent, and the collection, use and management of data.
Monitoring
Research is monitored in proportion to risk, including adverse events, amendments and progress reporting.
Privacy Act 1988 (Australia)
Australian research ethics review and the Privacy Act govern the people in the data. The therapeutic goods law governs whether the product can be supplied, which is a separate question from whether the study is ready.
APP 6 to 9: use and disclosure, cross-border, identifiers
Personal information is used and disclosed only for the purpose it was collected for, or a permitted secondary purpose, and cross-border disclosure is accounted for.
APP 10 and 11: quality and security
Personal information is accurate, up to date and complete, and is protected by reasonable security.
International: the held basis
The good clinical practice guideline is not a statute in any one market. It is the international quality standard that regulators read when they judge how a study was designed, recorded and verified.
ICH E6(R3) - Good Clinical Practice
The good clinical practice guideline is not a statute in any one market. It is the international quality standard that regulators read when they judge how a study was designed, recorded and verified.
Scope and principles
The standard sets the ethical and scientific quality requirements for designing, conducting, recording and reporting studies, applied in proportion to risk.
Protocol and study reporting
The protocol states the objectives, design, population, endpoints, analysis and reporting before the study begins.
Data management and external data
A data management plan covers external data, including real-world data, its quality, its traceability and its coordination with the analysis.
Computer systems, audit trail and data integrity
Computer systems used in the study are validated, access is controlled, changes are recorded in an audit trail, and the data meets the ALCOA+ attributes.
Decentralised elements and real-world data
Decentralised elements, remote monitoring and data captured outside the site are governed by the same quality and consent requirements.
Investigator duties and source document verification
The investigator is qualified and resourced, and source documents are kept and made available for verification.
Sponsor, quality management, monitoring and vendors
The sponsor runs a quality management system, monitors the study in proportion to risk, and oversees any vendor or data partner.
Ethics review and informed consent
An independent ethics body reviews the study, and consent is obtained and documented before participation.
Essential documents, trial master file and retention
The essential documents are held in a trial master file and retained for the period the applicable law requires.
What the basis does and does not do
It tells you which held framework bears on a check, and which control the product reads. It does not convert the check into a legal obligation in your market, and it does not decide which regime applies to your study. That depends on where the patients were treated, where the data is held and where you intend to file.
The four market sections are ordered as the product's grounding rule requires. The international section follows them because ICH E6 is not a statute in any one market; it is the guideline regulators read when they judge how the study was designed and recorded.