New GDPR Code for the Medical Industry. Consultations Start Today

Author: Jakub Styczyński • Source: Rynek Zdrowia • Added: 04 June 2025 10:25 • Updated: 04 June 2025 10:29

The creators of the code want to make it easier for signatories to conduct clinical trials, research processes and support systemic solutions in healthcare. Comments on the document can be submitted until August 18, 2025.

Code of Conduct members can expect lower financial penalties from the supervisory authority. Photo: AdobeStock/ Aut. NanSan

Money for participating in a clinical trial. You can withdraw it, but there are conditions

Vote of confidence for the government at a special session of the Sejm. The Prime Minister announced the date

L4 after a visit to the dentist. The patient has the right to be released

Today ( 4 June 2025 ) consultations on the Code of Conduct for the Pharmaceutical Sector have started. They will last until 18 August 2025.

Formally, it is to be a code of the type referred to in Article 40 of the GDPR . According to this provision, organizations representing personal data controllers may develop codes of conduct to clarify and facilitate the proper application of the provisions of the GDPR in their industry.

The author of the project is the Employers' Association of Innovative Pharmaceutical Companies INFARMA . On the website of the Association we read that the code is to apply in particular to the following areas of activity of the pharmaceutical sector:

conducting clinical trials and analyses to develop new innovative drugs;
processing personal data of patients and third parties involved in research processes in a way that ensures adequate protection of their data;
supporting systemic solutions in the field of healthcare that aim to improve the quality of treatment and the availability of modern therapies in Poland.

The content of the draft document can be found on the INFARMA website. Comments and suggestions should be submitted via the attachment (comments table) to the following address: [email protected] .

The GDPR Code of Conduct must be approved by the supervisory authority (in Poland, the Office for Personal Data Protection ). As indicated by the UODO, the benefit of the application of the Code by its signatories is a kind of protection in the context of potential fines. In the event of imposing a fine on an entity, the supervisory authority takes into account in each case whether it correctly applied the approved Code of Conduct of which it is a member.

It is worth recalling that the President of the Personal Data Protection Office has so far approved two codes of conduct, both for the medical sector:

Write to the author: [email protected]