GVP: Masking of personal data in ICSRs submitted to EudraVigilance
2165
wp-singular,post-template-default,single,single-post,postid-2165,single-format-standard,wp-theme-bridge,wp-child-theme-bridge-child,bridge-core-3.3.4.5,cookies-not-set,qode-optimizer-1.0.4,qode-page-transition-enabled,ajax_fade,page_not_loaded,,qode-title-hidden,qode_grid_1300,footer_responsive_adv,qode-smooth-scroll-enabled,qode-child-theme-ver-1.0.0,qode-theme-ver-30.8.8.5,qode-theme-bridge,wpb-js-composer js-comp-ver-8.7.1,vc_responsive

31 Jul GVP: Masking of personal data in ICSRs submitted to EudraVigilance

Posted at 13:08h in Pharmacovigilance by

Due to Brexit the European Medicines Agency (EMA) had to relocate from London to Amsterdam, which at the time created huge internal turbulences for the Agency starting with loss of staff and the additional workload to handle the Brexit. Many activities remained on hold as EMA released an updated table back in 2019 summarising all not priority activities. GDPR was among the activities that had to be delayed.

Five years later, as outcome of an EudraVigilance audit performed by the European Data Protection Supervisor (EDPS) in the context of pseudonymisation procedures and personal data masking, the EDPS recommended to the Agency to adopt a common masking policy that should be complied with by all entities reporting to EudraVigilance (“senders”).

Now, the new Guideline on good pharmacovigilance practices (GVP) Module VI Addendum II – Masking of personal data in individual case safety reports submitted to EudraVigilance comes into effect on 25 July 2025.

EudraVigilance data elements are divided into several categories where in total 24 fields are found to be non-essential for signal management, duplicate detection or ICSR processing and should be masked or left blank:

  • 13 data elements to be masked (set with nullFlavours);
  • 11 data elements to be left blank;
  • data elements that may contain personal data and are required for pharmacovigilance processes;
  • other data elements that do not contain personal data and are required for pharmacovigilance processes.

 

Organisations – senders of individual case safety reports (ICSRs) – should implement the instructions described in this document as soon as possible and within a reasonable timeframe.