Category: Legal and Regulatory
Labels: Regulation, Data processor, Data controller
Related questions: NA
Creation date and Author: Merry K., August 8th 2025
Last Update and Author: Maria G., August 8th 2025
No, a center participating in the Rosalind Study shall always be a data processor. Below is an analysis of the roles under the GDPR and the reasoning for why, in the ROSALIND study, the institution should remain a data processor, not a controller.
1. Determination of “purposes and essential means”
Under GDPR Art. 4(7) and Recital 74, a controller is defined as the entity that determines both the purpose and the essential means of processing. In the ROSALIND study, these elements have already been established by CURE51 in the study protocol and laboratory manual (variables, sequencing methods, retention periods, legal basis, publication strategy). The institution’s role is limited to the execution of these decisions.
The Data and Material Transfer Agreement (DMTA) reflects this allocation, stating that CURE51 (the sponsor of the ROSALIND study) acts as the independent data controller once the material has been received.
2. Contractual allocation agreed by all participating centres
The DMTA section on “Controllership” specifies that CURE51 is the controller and the lead centres act as processors, applying the same principle to all providers. Reclassification of a single institution would disrupt the uniform governance model already agreed upon by all participating sites.
3. Why specific objections do not change the role
| Institution’s Comments Examples | Reason it does not establish controllership |
|---|---|
| “The institution is a publishing party.” | Publication can be carried out on the controller’s instructions under an Article 28 Data Processing Agreement. The DMTA already permits co-authorship once CURE51 has approved the manuscript. |
| “The institution files the ethical approval.” | Filing ethics paperwork is an operational responsibility, not a GDPR criterion. An institution carrying out this function on the sponsor’s instructions can still act as a processor. |
| “The institution has its own interests.” | Separate research with independently defined purposes would indeed require controller status — but only for that separate purpose and under a separate agreement. For the ROSALIND’s objectives, no autonomous purpose is pursued. |
4. Precedent within the study
Even lead centres that contributed to the drafting of the protocol have been classified as processors; by comparison, an institution that did not shape the protocol cannot credibly be assigned a higher level of control.
This classification aligns with broader legal consensus: in clinical and research studies, the sponsor holds the role of sole GDPR data controller, while other parties operate as data processors.
Further resources: