#2026-052CNIL Approval of the Quality Control Annex for Health Research Data Processing Methods
AI-generated summary for informational purposes only. Not legal advice. See the original source for the authoritative text.
This measure approves a common quality control annex for French health research projects that process personal data under CNIL reference methodologies. It sets shared rules for checking whether research data is complete and accurate, including comparisons with source documents such as medical records. It matters for sponsors, research organizations, hospitals, investigators, and service providers involved in health studies. Quality checks can be done on site or remotely, but only if the relevant reference methodology allows it and the legal, technical, and organizational safeguards in the annex are followed.
AI-generated summary. May contain errors. Refer to official sources for legal decisions.
Key Changes
- Approves a single quality control annex for CNIL reference methodologies covering health research data processing
- Clarifies when health research quality control can be carried out under a declaration of compliance with a reference methodology
- Requires legal, technical, and organizational safeguards for on-site and remote checks involving sensitive health data
Obligations
What this law requires
A health research data controller may carry out a quality control mission under a CNIL reference methodology only if the applicable reference methodology expressly provides for that quality control mission.
A health research data controller carrying out a quality control mission under a CNIL reference methodology must perform that mission in conditions compliant with the approved “quality control” annex.
A health research data controller relying on a CNIL reference methodology for quality control must also ensure that all other conditions for implementing the health research comply with the applicable reference methodology.
Quality control of health research data must be limited to verifying the completeness and accuracy of data collected for the research, study, or evaluation by comparison with source documents such as the participant’s medical record.
Because quality control involves sensitive personal data, entities carrying out such missions must implement the legal, technical, and organizational measures required by the approved annex to protect the rights and freedoms of data subjects.