PSP021: RDN Research Delivery Confidentiality Disclosure Agreements (CDAs) Standard Operating Procedure

This Standard Operating Procedure (SOP) outlines step by step the refreshed procedure for the NIHR RDNCC Confidentiality Disclosure Agreements (CDAs) enabling the administration and coordination of the activities of the NIHR Research Delivery Network including provisions of RDN Study Support Service  to researchers and life science companies.

NIHR RDNCC provides the entry point for commercial companies to access the RDN Study Support Services for all new studies.  In the course of providing this service, the NIHR RDNCC handles information provided by commercial companies.  In order to maintain  confidentiality of information defined as such, an agreement is entered into between the sharing and receiving parties. This is the NIHR RDNCC ‘Confidentiality Disclosure Agreement’ or CDA. The CDA enables the company to provide confidential information to the RDN Support Service from across the entire health and care partners.

Evolving business processes, digital information management (including General Data Protection Regulation (GDPR) and organisational structure supported a refresh of the approach ensuring  that: 

• Commercial companies have a clear outline of what the data they provide will be used for

• Individuals and organisations understand their obligations with respect to protecting confidential information

Commercial companies request access to the NIHR RDN Study Support Service through the central portfolio management system (CPMS).  Information provided through this  system is shared by the RDNCC, as per our defined business processes, with the relevant RDN employed staff based in the Regional Research Delivery Networks in order to provide RDN Study Support Services. As this structure spans large number of separate legal entities, and works on a cascade approach, we have two agreements in place:

• CDA1 details the terms under which confidential information is shared between the commercial company (acting as study Sponsor or CRO) and the RDNCC. It details the expectations to maintain the confidentiality of the information by explaining what can and cannot be done with the information classified as confidential within the Central Portfolio Management System (CPMS) submission. Only one agreement is required per Sponsor, or their representative, as it covers confidential information relating to ‘current and future clinical studies’ and has a rolling application (i.e. timelines are reset with each new submission). Once in place, CDA1 allows confidential information to be supplied and openly discussed between the Sponsor, or their representative, and NIHR RDNCC staff.  

• CDA2 cascades the terms in CDA1 from RDNCC to any third parties out with the network structure that provides the RDN Study Support Service and thus with which the information will be shared by the RDNCC. This ensures that confidential information (such as study protocols) are only shared when necessary and with the appropriate personnel to maintain its confidential nature. 

Any information provided in the confidential section of the Industry submission form, provided as individual documents marked as confidential  or live study recruitment data provided by the commercial company for inclusion in the Central Portfolio Management System study record is subject to the terms in the CDAs. This information can only be shared with third parties with whom the RDNCC have a complementary CDA2 in place and this process is detailed in the early feedback SOP.

Following site selection, the commercial company will establish Confidential Agreements with each participating site to enable direct exchange of confidential information between the Sponsor/ CRO and the research site. The RDNCC CDA does not cover the provision of information from the commercial company directly to a participating site. 

The NHS have a model Confidential Disclosure Agreement (CDA) which can be accessed via IRAS help 

The NIHR RDN Coordinating Centre (RDNCC) is hosted by the University of Leeds. The wider network consists of 12 RRDNs each hosted by a single organisation who work with their Delivery organisations to provide national coverage. More about the structure of the network can be found on our website and in Appendix 1. The following statement captures the intent of the RDN Coordination Centre within the disclosure agreement.

“We, the RDNCC hereby undertake to The Company, in consideration of their disclosing Confidential Information as set out in the following terms, in connection with our administration and coordination of the activities of the NIHR Research Delivery Network, being a partnership established by the Department of Health and Social Care to improve the clinical research environment, to receive such Confidential Information on the terms as set forth in this Agreement”.

Activities of the NIHR Research Delivery Network includes the provision of RDN Study Support Service which helps researchers and the life sciences industry plan, set up and deliver high quality research to time and target in both the NHS and the wider health and social care environment. The receipt of confidential information facilitates the following elements of this study support service;

• Early Contact and Engagement:  Promote the RDN support available in general and bespoke to each study

• Early Feedback¹: Commercial studies can access our clinical experts for bespoke study advice across the UK.

• Site Identification¹: Help to identify the most appropriate sites to undertake research across the UK

• Optimising Delivery¹: Building on any early contact discussions, our assessment informs the support studies may need.

• Effective Study Set-up: Our study wide action plan supports rapid set up. 

• Eligibility: confirmation of access to NIHR RDN services

¹associated with the feasibility services within the NIHR RDN

CDA1 is an agreement between a commercial company and the RDNCC which enables the company to share confidential information with the consortium as the host of the RDNCC.

2.1.1 The request for a CDA1 is triggered by 1) a request from the commercial company prior to accessing RDN services or 2) the RDN commercial eligibility and feasibility process via the log-on screen disclosure statement (Figure 1). All these requests are directed to the Study Support Service Helpdesk (supportmystudy@nihr.ac.uk) 

2.1.2 The RDN's online system, the Central Portfolio Management System (CPMS), provides a secure area to share information between commercial companies and the RDNCC. All users are required to check the box at the base of the disclosure statement to confirm their agreement with the terms before any information for their submission can be entered, with the exception of the protocol name and acronym which are requested before this disclaimer appears (see 'CPMS Disclosure Statement' below). The RDNCC CDA1 terms also cover the exchange and storage of information within this system.

2.1.3 The confidential information stored within CPMS has restricted access to RDN staff to subsequently access or distribute information required to deliver the RDN Study Support Services.

Figure 1: CPMS disclosure statement

Text in Figure 1 image reads:

AGREEMENT

This section of the website allows you to provide the NIHR Research Delivery Network with details of your study via a secure online form. The information you provide will allow us to assess how this study can be supported by the NIHR RDN*

Before you start:

1. Your company should have a Confidentiality Disclosure Agreement (CDA) in place with the NIHR RDN before you proceed. If you are unsure whether a CDA is in place, please contact supportmystudy@nihr.ac.uk and we can confirm this for you. More information about setting up a CDA is available from the NIHR website. 

2. Please be aware that the information you submit is handled in the following way:

   • Questions about the study are labelled A or B, to indicate how the information is shared by the NIHR RDN:

     • A. This information is considered highly sensitive and strictly confidential. It is shared only with third parties with whom NIHR RDN has a non-disclosure agreement.

     • B. This information forms the basis of a blinded study synopsis. Marked as confidential alongside the Schedule of Events (extracted from the Protocol, if not provided as an independent document), it may be circulated with the wider clinical research network community WITHOUT the need for a formal non-disclosure agreement. 

   • You will be asked to attach the study protocol/synopsis. This will be accessible only to NIHR RDN staff supporting your application, and where relevant, specialty and settings/costings experts who are providing expert feedback as part of this service. The individuals are bound by a CDA. 

3. Please check the box below and click “PROCEED TO SUBMISSION” to proceed to the online form. 

*Note: 

• These services are available for commercial contract studies that meet the DHSC Eligibility Criteria for NIHR Research Delivery Network (RDN) Support. 

• Commercial contract studies running in the NHS require full cost recovery using the interactive Costing Tool (iCT) with cost-related resources reviewed by the NIHR RDN Study Resource Review service. 

• Any interactive Costing Tool submission for Study Resource Review automatically enters the National Contract Value Review process. This requires the location of the Chief Investigator to be provided with the submission to allocate the relevant Contract Value Review Coordinator. Find out more about this on the interactive Costing Tool getting started webpage. 

• The NIHR website provides further details about the services we offer to support delivery of commercial contract research, including Department of Health and Social Care eligibility criteria. 

2.2.1.  CDAs that were in place prior to the move to DocuSign are stored on the RDNCC Google Drive, however, once the digital process has been fully established then CDAs will be deleted and only stored within DocuSign. Once the new digital process has been fully rolled out this information will be superseded and only names listed within DocuSign will be valid.  

2.2.1. Before initiating a new CDA, DocuSign should be checked to ensure that one is not already signed or pending with the commercial company. The search function in the ‘Manage’ tab of DocuSign can be used to search for the company name in the different ‘quick views’ ( ‘completed’, ‘action required’, ‘waiting for others’, ‘expiring soon’, ‘authentication failed’). 

2.3.1. The following information is needed to generate a CDA1.  The company will be asked to share the information;

• The full registered name and address (including country of operation) of the commercial company

• The commercial company suffix (Ltd, AG, GmbH, Inc) must be included in the commercial company name as this can affect who is covered by the CDA1 within the commercial company

• The registered company number for the company signing. The company should be able to provide this information (Appendix 2), and this will be included in the CDA1 where possible. 

• The name of any subsidiary or affiliate companies the company signing would like to be covered under the agreement

2.3.2 Ideally, the commercial company should have the CDA1 signed by the highest entity possible (i.e the commercial company headquarters) or use the commercial company name and endeavour to include the names of any affiliates. This will reduce the number of agreements needed to cover each country specific branch or division of the overall company (although this may not always be possible).  

2.3.3 The necessary information should be collated and provided to the RDNCC via the Study Support Service Helpdesk (supportmystudy@nihr.ac.uk). The CDA1 can then be sent out via DocuSign. 

In order to ensure that the CDA1 process is auditable and secure, a digital system (DocuSign) has been set up to enable the RDNCC to send out CDA1 contracts with an accompanying message, for commercial companies (or their representative) to sign electronically (by generating an e-signature) within a given timeframe. RDNCC can set automatic reminders for the recipient which will be live until the document has been completed, rejected or expired. 

The Study Support Service Helpdesk (supportmystudy@nihr.ac.uk) must take the following steps to send out a CDA1: 

1. On the DocuSign home page, click on ‘start’

2. Select the option: ‘Envelope’ then ‘Use a template’

 3. Select the template: ‘NIHR CRN Confidentiality Disclosure Agreement (CDA1) ’ and click on ‘Add selected’

 4. Scroll down to the "Add recipients" section and add the specified signatory's name and email to the respective fields, if more than one person has been specified, add them using the "Add Recipient" button. 

 5. Update the email subject line with the company name and the appropriate Halo ticket reference number. 

6. Update the email message template with the name of the recipient. 

 7. Click ‘Next’

 8. Enter the company's details (see section 2.3.1) in the respective text fields, as well as the date the RDNCC signed (this will be the date sent). The RDNCC signature is already on the template document

 9. Click on ‘Send’

 10. Once the CDA has been signed by the company, a copy will be sent to both parties’ email addresses automatically via the DocuSign system. The completed contract will also be stored within DocuSign. 

 11. If the company recipient is unable to sign a CDA1 for any reason, they will have the option to ‘decline’ with a reason. They will also have the option to  either assign the document to someone else via the DocuSign system or to download the contract, get it signed by the appropriate person, and upload it through DocuSign.

 12. Members of the Study Support Service Helpdesk team will be able to monitor the status of any pending requests for CDA1s to be signed by logging into DocuSign.

The commercial company may request additions or changes to the CDA1, however, the RDN cannot accept changes (see section 6) (this new process has already received input from a number of commercial companies).  If you are in any doubt, forward the query and any supporting documentation to the Head of Research Operations or Head of Feasibility and Start-up who will respond on behalf of the NIHR RDN.

Access and distribution of confidential information is in line with the disclosure and CDA terms, therefore RDNCC must assure the CDA status of any individual prior to passing on any confidential information.  

All staff employed to undertake RDN activities at the RDNCC, Regional RDN host or partner organisations  are subject to the terms outlined in CDA1 as a result of the RDN contractual agreements. CDA2 does not allow confidential information to be shared directly between two or more different institutions (for example between two RRDN host organisations), even when the institutions involved all have RDNCC CDAs in place. This agreement only covers information shared from the RDNCC with the organisation or where information provided by the CC is shared within the same institution.

Therefore, CDA2 agreement is only required by the RDNCC and advisors or specialty group members who provide any element of the RDN Study Support Service  outside of the RDN structure.

The process for use of CDA 2 in context of feasibility is described in the Early Feedback SOP (SOP in preparation/under review).

Electronic signatures can be accepted as the NIHR RDN does not need to hold wet ink copies. 

The following signatories are authorised for each CDA:

• CDA1 is signed by the relevant Sponsor, or company representative and the NIHR RDNCC National Chief Operating Officer.

• CDA2 is signed by the relevant Institution/Personal representative and the NIHR RDNCC National Chief Operating Officer

Source documents stored on the Google drive with access to be requested via the Feasibility & Study Start Up team:

• Video CDA 1 June 2020

• Video CDA 2 June 2020

• Infographic CDA 1

• Infographic CDA 2

The NIHR RDN does not accept any requested amendments to the CDAs for the following reasons:

• Any changes to the CDA1 would need to be reflected in CDA2 of which there are hundreds of already established agreements.

• It is not practical to cascade a range of different terms for each Sponsor or company into the CDA2s to accommodate these across the RDN CDA system.

The RDN information management systems and processes are not designed to accommodate varying terms within the CDA for different companies and thus the NIHR RDN cannot agree to changes that cannot be reflected in practice.

Laura Bousfield 

Head of Study Support Services

laura.bousfield@nihr.ac.uk

CC: Coordinating Centre 

CDA: Confidentiality Disclosure Agreements

CI: Chief Investigator

CRO: Contract Research Organisation

DHSC: Department of Health and Social Care

EF: Early Feedback

GDPR: General Data Protection Regulation

HRA: Health Research authority

IT: Industry Team 

NIHR : National Institute for Health and Care Research

PAF: Portfolio Application Form

PET: Portfolio Eligibility Team

PI: Principal Investigator

R&D: Research & Development

RDD: Research Delivery Directorate

RDN: Research Delivery Network

RDNCC: Research Delivery Network Coordinating Centre

RRDN: Regional Research Delivery Network 

SMT: Senior Management Team

SOP: Standard Operating Procedure

East Midlands: University Hospitals of Leicester NHS Trust

East of England: Norfolk and Norwich University Hospitals NHS Foundation Trust

North East and North Cumbria: The Newcastle upon Tyne Hospitals NHS Foundation Trust

North London: Barts Health NHS Trust

North West: Manchester University NHS Foundation Trust

South Central: University Hospital Southampton NHS Foundation Trust

South East: Royal Surrey NHS Foundation Trust

South London: Guy's & St Thomas' NHS Foundation Trust

South West Central:  University Hospitals Bristol and Weston NHS Foundation Trust

South West Peninsula - Royal Devon University Healthcare NHS Foundation Trust

West Midlands: The Royal Wolverhampton NHS Trust

Yorkshire and Humber: The Leeds Teaching Hospitals NHS Trust

The NIHR RDN will request the registered company number to be included in the CDA1 ‘company’ information where possible. This unique identifier supports the NIHR RDN data systems for tracking CDA1 status.

UK based companies

The company registration number for UK based limited companies can be found via the online register ‘Companies House’. 

US based companies

In the US the individual state in which the company is registered is responsible for maintaining the company registry. A list of the links to the database of each state can be found online at Registries in the United States of America 

The Securities and Exchange Commission (SEC) register is only for publicly traded companies but can be accessed online at U.S. Securities and Exchange Commission

EU based companies

The company registration number for EU based limited companies can be found via two registry sources:

• The European Business Registry at https://ebra.be/#

  • The members section provides the latest information on the countries covered by the register

• The Kompany Registry providing company profiles and official register reports

  • Italian companies in this registry require the creation of a free account before the Italian database can be searched

Version 1.1

Effective from date: July  2025 

Refresh of the screen shots which reflect RDN nomenclature