The French Data Protection Authority has formally accredited the EUCROF Supervisory Committee (COSUP), completing the final step needed to activate the first transnational GDPR Code of Conduct in the field of health across all 27 EU Member States.
The European CRO Federation (EUCROF) is pleased to announce a landmark development for data protection in clinical research. On 29 January 2026, the French Data Protection Authority (CNIL) adopted Resolution no. 2026-006, formally approving the Supervisory Committee (COSUP) as the monitoring body for the EUCROF GDPR Code of Conduct. This decision brings the Code fully into force across the European Union.
A multi-year regulatory journey completed
The approval of the COSUP represents the culmination of a rigorous regulatory process. On 18 June 2024, the European Data Protection Board (EDPB) adopted Opinion 12/2024 on the draft CNIL decision, opening the path to final approval. On 12 September 2024, the CNIL adopted Resolution no. 2024-064 formally approving the Code itself. The final step — accreditation of the COSUP as supervisory body — was taken at the CNIL plenary meeting of 29 January 2026, and confirmed in a letter dated 2 February 2026 from CNIL President Marie-Laure Denis to Yoanni Th. Matsakis, Chair of the EUCROF Code Task Force and acting President of the EUCROF Executive Board.
The CNIL’s accreditation authorises the COSUP to assess compliance dossiers submitted by prospective Code adherents, issue binding compliance decisions, and provide ongoing oversight and enforcement.
A first for transnational health data governance
As noted by the EDPB in its Opinion 12/2024, the EUCROF Code is transnational in scope, applying across the entire European Union under Article 40(7) GDPR, with all EU supervisory authorities listed as concerned SAs. This makes it the first transnational GDPR code of conduct in the area of health with such territorial reach — a significant milestone for the clinical research sector.
Over 90 per cent of clinical research service providers — Contract Research Organisations (CROs) — are micro, small, or medium-sized enterprises. The EUCROF Code offers them a practical, sector-specific compliance framework to demonstrate adherence to the highest standards of personal data protection, covering both clinical study participants and healthcare professionals.
Yoanni Th. Matsakis, Vice President of EUCROF, commented: “With this last act of the regulatory approval process, this transnational GDPR code of conduct, recognised in the 27 Member States of the European Union, effectively comes into force and the first compliance marks should be awarded in the coming months. Nearly 20 clinical research service providers have already applied to join the Code. In the context of the European Health Data Space (EHDS), adherence to the EUCROF Code aims to guarantee the protection of personal data, both of clinical study participants and of healthcare professionals, and to facilitate the implementation of clinical studies with trusted providers.”
Victoria Watts, Chairman of the COSUP, added: “This decision of the CNIL to approve and accredit the operations of the COSUP means that the COSUP can start its important work to put the EUCROF Code into action. The clinical research industry has been awaiting the EUCROF Code with anticipation and the COSUP will be ready to launch its operations within the quarter.”
About the COSUP
The COSUP comprises ten highly qualified individuals drawn from a diverse range of European countries and professional backgrounds. It is chaired by Victoria Watts, Compliance Officer at Premier Research (United Kingdom), who specialises in the application of the GDPR to CRO activities. The Vice Chairman is Christophe Maes from Belgium, who brings extensive experience in implementing certification standards at the European Institute for Innovation through Health Data (i-hd.eu).
For further information on the EUCROF GDPR Code of Conduct, please visit eucrof.eu/gdpr-code-of-conduct. Enquiries may be directed to cosup@eucrof.eu, for the attention of Victoria Watts and Christophe Maes, with the subject line “EUCROF Code”.
