Conducting investigator-initiated research (IIT) in China is a valuable strategic choice for foreign pharmaceutical companies looking to drive clinical innovation research. Despite the complex regulatory environment, a clear compliance path has emerged: foreign-funded companies can not only legally participate, but also achieve their research objectives efficiently and safely through professional local partners.

1. Having clear legal support foreign companies can fund and support IITs in China

a) The current PRC law does not prohibit foreign companies from funding and supporting IITs.

b) China Association of Enterprises with Foreign Investment R&D-based Pharmaceutical Association Committee (“RDPAC”) released in June 2023 the following documents to provide guidance on funding IITs :

“IITs Funding Consensus and Advice for Foreign Pharmaceutical Companies”

“IIT Funding Introduction and Checklist for Foreign Pharmaceutical Companies”

c) IITs may require HGR approval for international scientific research collaboration project (“HGR” stands for human genetic resources).

i. Legal basis: The PRC HGR Regulation

ii. Whom to be regulated: Foreign entities, including foreign organizations, and organizations incorporated or controlled by foreign entities.  

iii. Activities: Scientific research activities exploiting Chinese HGRs

iv. Special requirements: To exploit Chinese HGRs by collaborating with Chinese entities

v. Exemptions: If a foreign entity is not substantially involved in an IIT and it does not have access to HGR data (i.e., genes, genomes, transcriptomes, epigenomes, ctDNA and other nucleic acid biomarkers data, as well as disease and ethnographic information associated with these data).

2. Foreign companies may receive the study research report for an IIT that it funded or supported.  

a) Report formality: It may be drafted with reference to ICH E3: Structure and Content of Clinical Study Reports

b) Report content: It may include patient code, demographic data (age, gender, ethnicity, etc.), drug dosage data, laboratory test results, individual data of patient case report forms, adverse event data.

c) Special requirements: If the report contains any HGR data or personal information, HGR regulation or personal information protection obligations have to be satisfied.

3. Practice Code and Rules

a) Compliance Consideration for Funding and Donation

i. Legal basis: Major applicable laws, regulations and code of practices include:

    - “The PRC Law on Donations for Public Welfare”

    - “The PRC Administrative Measures on the Receipt of Public Welfare Donations by Medical Institutions and Family Planning Institutions”

    - “RDPAC Code of Practice”

ii. Key compliance requirements

- Companies funding the IITs, shall not receive any direct benefit in return, such as benefits of certain services, naming right, etc. except that mere acknowledgement for funding is permitted.

- Companies funding IITs are recommended to build up appropriate internal control procedures to review and approve each funding and donation request.

- Business functions shall not lead the review and approval process for funding and donation, and shall not be the only or ultimate decision maker to approve the funding or donation.

- Business functions may act as a “liaison” to initiate a funding or donation request, or provide assistance in implementing a funding or donation program.

b) Compliance requirements during implementation

i. Legal basis: “RDPAC IITs Funding Consensus and Advice for Foreign Pharmaceutical Companies”

ii. Involvement: Foreign pharmaceutical companies may review IIT study protocol from compliance perspective to evaluate whether and how they can properly fund and support an IIT.

4. Restrictions and Response

a) Foreign companies are prohibited from investing in areas of “human stem cell, gene diagnosis and treatment technology development and application”.

i. Legal basis: “Special Regulation Measures for Foreign Investment (Negative List 2021)”

ii. Scope: Currently, there is no official interpretation regarding what constitutes “human stem cell, gene diagnosis and treatment technology development and application”.

iii. Potential risk: IITs involving stem cells or gene therapy may fall into the scope of “human stem cell, gene diagnosis and treatment technology development and application”.

iv. Response: Foreign companies’ funding and support to IITs (either by providing funds or by providing investigational drugs) usually would not be deemed as “investment activities”.

v. Options: Non-investment activities for stem cell or gene therapy, such as collaborating with local partners under product supply and distribution model or IP licensing model.

b) Chinese parties, before they provide HGR data to foreign parties, may need to go through HGR data disclosure reporting procedure.

i. Activities: Provision of HGR data to foreign parties.

ii. Legal basis: Applicable laws and regulations include the PRC HGR Regulation and the PRC HGR Implementing Rules.

iii. Procedure: Go through HGR data disclosure report prcocedure.

iv. Exemption: Such HGR data disclosure reporting procedure may be exempted if the prior HGR collaboration project approval for the IIT could cover the intended HGR data sharing activity.

c) Cross-border data transmission

i. Regulated activities: Cross-border transmission of personal information collected or generated under IITs, including patient sensitive personal information, personal medical and health data.

ii. Legal basis: Major applicable laws and regulations include:

- “The PRC Personal Information Protection Law”

- “The PRC Security Assessment Measures for Cross-Border Data Transmission”

- “The PRC Implementing Rules for the Certification of Personal Information Protection”

- “The PRC Measures on the Standard Contract for Cross-Border Transmission of Personal Information”

- “The PRC Provisions on Promoting and Regulating Cross-border Data Flows”

iii. Actions:

- To obtain the informed consent from patients.

- To conduct personal information protection impact assessment.

- To evaluate and take the following actions where necessary: signing Standard Contractual Clause with overseas data recipients, certification of personal information protection  system, or security assessment for cross-border data transmission.