Data sharing policies, requirements, and support from public and private clinical trial sponsors: a survey on top sponsors of clinical trials in Europe

This survey of the top 40 public and private clinical trial sponsors in Europe reveals a significant sectoral imbalance in data sharing governance, where private sponsors generally offer more detailed and accessible operational documentation compared to public sponsors, who tend to provide high-level commitments lacking trial-specific guidance despite shared adherence to GDPR requirements.

The Gist

Imagine the world of medical research as a massive, bustling library. Inside this library are millions of books (clinical trial data) that contain the secrets to curing diseases. For a long time, these books were locked in different rooms, guarded by different librarians, and some librarians had very strict rules about who could even peek inside.

This paper is like a survey of the top 40 librarians (the biggest sponsors of medical trials) in Europe to see how they handle their books. The researchers wanted to know: Do these librarians have a clear rulebook for sharing their books? Is that rulebook easy to find? And does it actually help people borrow the books to learn something new?

Here is the story of what they found, broken down into simple concepts:

1. The Two Types of Librarians

The study looked at two very different groups of librarians:

• The Private Librarians (Pharmaceutical Companies): These are big, for-profit companies. Think of them as the "corporate chains" of the library world.
• The Public Librarians (Hospitals and Universities): These are government-funded or academic institutions. Think of them as the "community centers" of the library world.

2. The "Rulebook" Differences

The researchers found a huge gap between how these two groups operate.

The Private Librarians (The Corporate Chains)

• The Vibe: They are very organized and business-like.
• The Rulebook: Most of them have a clear, detailed, and easy-to-find "Data Sharing Policy." It's like a menu at a restaurant that clearly lists what you can order, how to order it, and the price.
• The Process: They often use a central "kiosk" (like a website called Vivli) where researchers can go, fill out a form, and get the data if they qualify. They have standard contracts (Data Use Agreements) that everyone signs, just like a standard library card agreement.
• The Result: If you want data from them, you know exactly where to go and what to do.

The Public Librarians (The Community Centers)

• The Vibe: They are passionate about "Open Science" and sharing knowledge, but they are often chaotic.
• The Rulebook: They often say, "Yes, we believe in sharing!" but they rarely have a specific rulebook for clinical trial data. Instead, they have general rules about "research data" that are buried deep in huge, boring institutional handbooks.
• The Process: There is no central kiosk. Sometimes you have to email a specific person, sometimes you have to fill out a form on a different website, and sometimes the rules change depending on which hospital department you are dealing with.
• The Result: It's like trying to borrow a book from a community center where the rules are written on a whiteboard in the back office, and the librarian is currently on lunch break. You know they might share the book, but you don't know how to ask.

3. The "Privacy Shield" (GDPR)

In Europe, there is a giant, invisible force field called the GDPR (General Data Protection Regulation). It protects patient privacy like a super-strong shield.

• The Challenge: Both types of librarians are terrified of breaking this shield. If they share data and a patient's identity is accidentally revealed, it's a disaster.
• The Difference: The Private Librarians have built a specialized "tunnel" through the shield. They have legal teams and tech systems specifically designed to move data safely through the GDPR. The Public Librarians often just put up a "Caution" sign and hope for the best, or they rely on general rules that weren't built specifically for clinical trials.

4. The "Data Management Plan" (The Blueprint)

Before a trial starts, the sponsor should draw a blueprint (a Data Management Plan) showing how they will handle the data.

• Private Sponsors: They often skip drawing a public blueprint for every single trial. They just follow their standard corporate rules.
• Public Sponsors: They draw blueprints all the time. However, these blueprints are often very different from each other. One hospital's blueprint looks like a sketch on a napkin; another looks like a complex architectural drawing. They are rarely standardized.

5. The Big Takeaway

The study concludes that Europe has a "Two-Speed" system for data sharing.

• Speed 1 (Private): Fast, clear, and standardized. If you are a researcher, you know the path.
• Speed 2 (Public): Slow, confusing, and fragmented. Even though these public institutions hold a massive amount of data, it's hard to get to it because the "doors" are locked with different keys.

The Recommendation:
The authors suggest that the Public Librarians need to stop being so vague. They don't need to become corporate giants, but they do need to build a clear "front door" with a sign that says: "Here is how you ask for our data, here are the rules, and here is the contract you need to sign."

If they do this, we can unlock more of the medical secrets hidden in those books, leading to faster cures and better health for everyone, all while keeping the patients' privacy safe behind that GDPR shield.

Technical Summary

1. Problem Statement

The sharing of clinical trial data is critical for research transparency, reproducibility, and ethical obligations to patients. However, sharing clinical data in the European Union (EU) faces significant hurdles due to the General Data Protection Regulation (GDPR), which classifies health data as sensitive and imposes strict requirements on consent, processing, and risk management.

Despite increasing regulatory and societal pressure, it remains unclear to what extent the major sponsors of clinical trials in the EU have developed, standardized, and publicly disclosed Data Sharing Policies (DSP), Data Management and Sharing Plans (DMSP), and Data Use Agreements (DUA). There is a specific gap in understanding the divergence between public sponsors (e.g., universities, hospitals, research institutes) and private sponsors (pharmaceutical companies) regarding their governance frameworks, operational readiness, and compliance mechanisms.

2. Methodology

The study employed a systematic document analysis approach following the CARDA (Checklist for Assessment and Reporting of Document Analysis) guidance.

• Sample Selection:

  • The researchers identified the top 20 public and top 20 private sponsors based on the number of registered trials in the EU Clinical Trials Information System (CTIS) (dataset from inception to July 2025).
  • Private Sponsors: Defined as for-profit entities (primarily pharmaceutical companies).
  • Public Sponsors: Defined as non-commercial entities (universities, public hospitals, research organizations).
  • Note: One public sponsor (Celgene) was excluded due to acquisition and lack of accessible policy, replaced by the next in rank (Sun Pharma).

• Data Collection Strategy:

  • Search: Systematic searches of sponsor websites, structured Google searches, and major Data Management Plan platforms (DMPTool, DMPonline, DMP Assistant).
  • Verification: Direct contact with sponsors (Data Protection Officers, research admins) to verify findings and request missing documents. The overall response rate was 37.5%.
  • Extraction: Two independent reviewers extracted data using a structured form, capturing the existence, accessibility, and content of DSPs, DMSPs, and DUAs.

• Analysis:

  • Quantitative: Descriptive statistics (counts and percentages) of document availability.
  • Qualitative: Non-interpretive descriptive content analysis to characterize recurring policy elements, operational constraints, and areas of heterogeneity.

3. Key Contributions

• First Comparative Mapping: This is the first study to systematically map and compare the data sharing governance landscapes of the top 40 clinical trial sponsors in the EU, distinguishing between public and private sectors.
• Operational Granularity: The study moves beyond high-level commitments to analyze specific operational elements, such as review criteria, dataset readiness, anonymization standards, and legal safeguards.
• Platform Dependency Analysis: It highlights the critical role of third-party data sharing platforms (e.g., Vivli, CSDR, YODA) in standardizing private sector practices versus the fragmented, institution-specific approaches of the public sector.
• GDPR Operationalization: The paper details how different sectors interpret and operationalize GDPR compliance within their data sharing frameworks.

4. Key Results

A. Document Availability and Accessibility

• Private Sponsors: Significantly more likely to have publicly accessible, trial-specific DSPs and DUAs. Most (17/19) utilized established data sharing platforms (e.g., Vivli) to host policies and templates.
• Public Sponsors: More likely to reference DMSPs, but these were often embedded in broader institutional governance documents rather than being trial-specific. Publicly available, trial-specific DSPs were sparse (only 10/20 identified) and often lacked operational detail.

B. Content and Structure of Policies

• Data Sharing Policies (DSP):
  • Private: Outward-facing, detailed, and standardized. They clearly defined eligibility criteria, review processes, and data types (often including patient-level data).
  • Public: Inward-facing, framed as guidance for internal staff. They focused on general research data rather than clinical trials, with rare mentions of specific trial protocols or statistical analysis plans.
• Data Management and Sharing Plans (DMSP):
  • Private: Rarely publicly available; often internal documents.
  • Public: More frequently identified (9/20), but highly heterogeneous in scope. They emphasized GDPR compliance, data protection, and storage but lacked standardization on data quality control and reuse timelines.
• Data Use Agreements (DUA):
  • Private: Highly standardized due to platform adoption (16/19 used Vivli templates). Core elements (privacy, IP, publication rights) were consistent.
  • Public: Highly variable. Each institution often devised its own template or adopted regional/national standards. There was significant divergence in operational constraints (e.g., dataset readiness guarantees) and downstream legal terms.

C. Sectoral Imbalance

• Private Sector: Characterized by standardization, platform reliance, and operational explicitness. They have invested in dedicated infrastructures to manage data requests.
• Public Sector: Characterized by high-level commitments, institutional fragmentation, and ambiguity. While they express strong support for Open Science and FAIR principles, they lack the specific, trial-oriented mechanisms to facilitate external data access.

5. Significance and Implications

• Transparency Gap: The study reveals a "governance gap" where public sponsors, despite conducting a large volume of trials, lack the transparent, standardized pathways that private sponsors have established. This hinders the reproducibility of public research.
• Regulatory Context: The findings suggest that while GDPR compliance is a universal priority, the operationalization of these rules varies. Public sponsors often interpret GDPR as a barrier requiring complex internal governance, whereas private sponsors have integrated it into streamlined, platform-based workflows.
• Policy Recommendations:
  • Standardization: Public sponsors need to develop trial-specific guidance that mirrors the clarity of private sector policies.
  • Infrastructure: Adoption of shared platforms or standardized templates could reduce administrative burdens and improve data accessibility.
  • Harmonization: There is a need for European-level guidance to harmonize GDPR-compliant data sharing practices across public and private sectors, bridging the gap between legal compliance and practical data reuse.

Conclusion: The study concludes that while private sponsors have evolved robust, standardized data sharing ecosystems, public sponsors remain in a transitional phase with fragmented governance. Addressing this heterogeneity is essential to fulfill the ethical obligation of data sharing and to maximize the utility of clinical trial data in the EU.