Yes. As a hub for precision medicine, tenants and partners at the Campus (and the wider West Midlands Secure Data Environment) are expected to adhere to rigorous information governance standards. This often goes beyond basic GDPR to include NHS Information Governance compliance and strict protocols for handling “Special Category” genetic and biometric data. We help you align with these local ecosystem requirements to facilitate smoother partnerships with the University of Birmingham and local hospitals.

This is a critical distinction for research. Anonymised data has been stripped of all identifiers effectively enough that the individual can never be re-identified; this falls outside GDPR scope. Pseudonymised data (often used in trials) replaces identifiers with a code/key; this is still personal data and requires full GDPR compliance. We help you implement the correct technical controls (like key-coding strategies) to satisfy the Health Research Authority (HRA) and ethical committees.

Likely, yes. Under UK regulations, software that has a medical purpose is classified as “Software as a Medical Device” (SaMD). This means you must comply with the UK Medical Device Regulations (UK MDR), potentially appoint a UK Responsible Person (if you are outside the UK), and adhere to ISO 13485 quality standards. Formiti helps you navigate the intersection of medical device safety and data privacy regulations.

Almost certainly. Under the UK GDPR, appointing a DPO is mandatory if your core activities involve processing Special Category Data (like health or genetic data) on a large scale. Even for smaller trials, not having a DPO is a “red flag” for investors and partners. Formiti provides an outsourced DPO as a Service, giving you the necessary legal expert on your team without the cost of a full-time executive hire.