8. Data Management

8.1 What data privacy and/or technology regulations need to be complied with to run a trial in the countries of interest? 

Health Information, including practices relating to the management of data from clinical trials, is governed by the Health Information Privacy Code 2020. 

8.2 What are the data locality rules within each jurisdiction?

• Does the data have to remain within the countries’ geographic boundaries or can it be transmitted for display on a web browser outside of the region?

There is no requirement to retain and store data within the local jurisdiction.

• Who is responsible for complying with international regulations if a participant travels between geographies (e.g. for vacation)? Does the CRO have to honor the destination country’s rules?

There is no guidance around this matter.

• Are there any specific requirements for using the Cloud (including whether any routing must be excluded/avoided)? Is there a need to implement secure transfers?

There is no guidance around this matter.

• Does data need to be collected in the country? Do the servers need to be in the country? 

There is no requirement to retain and store data within the local jurisdiction.

• Are there data storage and transmission requirements (for data transfer out of the country)?

There is no requirement to retain and store data within the local jurisdiction.

• Are there any exceptions made for research to the local privacy regulations?

No.

• Who is allowed to view data (including the PI) and have access to Personal Identifiable Information (PII)?

This information should also be captured in the data management plan. 

Access to Health Information Records is governed by the Health Information Privacy Code 2020.

8.3 Detail the appropriate level of verification and validation of the CRO system (i.e., a software platform that runs clinical trials but is not considered a clinical device)

Medsafe applies the standards from ICH E6(R2). These standards are defined in GRTPNZ Part 11.