Articles & insights
GDPR & Data Compliance in Pharma
Data protection and data governance for pharmaceutical compliance.
Managing Healthcare Professionals’ Personal Data under GDPR: CRM, FMV and Engagement Records
Apply GDPR to HCP engagement data in pharma: purpose, lawful basis, data minimisation in FMV, accuracy, processors, transfers and retention.
Read the article 2026-09-29GDPR and Transparency Reporting: Disclosing HCP Transfers of Value
How GDPR applies to disclosing HCP transfers of value: consent or legitimate interests, privacy information, objections, accuracy and processor controls.
Read the articleQuestions, answered
GDPR & Data Compliance in Pharma: common questions
What lawful basis is needed to disclose an HCP’s transfers of value?
Naming an HCP is processing of personal data, so it needs a lawful basis under Article 6 of the GDPR. EFPIA’s training material identifies individual consent or legitimate interest, with a documented process.
Is HCO disclosure data personal data?
The ABPI’s December 2025 Disclosure UK factsheet states that information about HCOs is not considered personal data, so a lawful basis is not required for it.
How is legitimate interests documented?
The ICO describes a three-part test (purpose, necessity and balancing) and recommends recording the outcome in a legitimate interests assessment.