Guidance

Notification of Serious Breaches of GCP or the trial protocol

Published 28 April 2026

Legal status of this guidance

This guidance accompanies the Medicines for Human Use (Clinical Trials) Regulations 2004, as amended by the Medicines for Human Use (Clinical Trials) (Amendment) Regulations 2025. These amendments come into force on 28 April 2026 and any reference to “the amended Clinical Trials Regulations” in this guidance should be construed as referring to the amended version.

Part 2 of Schedule 1 to the amended Clinical Trials Regulations requires that the investigator and sponsor have regard to all relevant guidance with respect to commencing and conducting a clinical trial.

Investigators and sponsors (and any individual or organisation that the sponsor delegates trial related activities to) must, therefore, ensure that they are fully aware of the information within this guidance and act accordingly to achieve and maintain regulatory compliance.

Legal and regulatory framework

Regulation 29A of the amended Clinical Trials Regulations, includes a requirement for the notification of “serious breaches” of GCP or the trial protocol to the licensing authority:

29A. (1) The sponsor of a clinical trial shall notify the licensing authority in writing of any serious breach of -

(a) the conditions and principles of good clinical practice in connection with that trial; or

(b) the protocol relating to that trial, as modified from time to time in accordance with regulations 20 to 22C,

within 7 days of becoming aware of that breach.

(2) For the purposes of this regulation, a “serious breach” is a breach which is likely to effect to a significant degree – 

(a) the safety or physical or mental integrity of the participants of the trial; or

(b) the scientific value of the trial.

This requirement to notify the MHRA of serious breaches is unchanged in the amended Clinical Trials Regulations and reflects the same requirements as the previous unamended Clinical Trials Regulations (the version prior to 28 April 2026).

Purpose of this requirement

The requirement was first implemented in UK legislation in order to: 

• Enhance the safety of trial participants by seeking to ensure that the licensing authority is promptly informed of such serious breaches, in order to take appropriate action in response to the breach; and/or
• Take the information regarding serious breaches into account when assessing future applications for clinical trial authorisation, and applications for marketing authorisation, which include data from trials affected by serious breaches.

Purpose of this guidance

• To outline the practical arrangements for notification.
• To provide advice on what should and what should not be classified as a “serious breach” and what must be reported.
• To outline possible actions that may be taken by the MHRA in response to notifications of serious breaches.

Arrangements for notification

Responsibility to notify

Notification should be carried out by the Sponsor or a person legally authorised by the Sponsor to perform this function (for example, a legal representative or service provider), if this has been delegated by the Sponsor.

In accordance with the amended Clinical Trials Regulations, the Sponsor retains legal responsibility even if the function is delegated (Regulation 3 (12)). Any party delegated sponsor functions is legally responsible for compliance with legislation regarding those delegated functions (Regulation 3(8)). To ensure participant safety, reporting should not be delayed by debates about reporting responsibility.

If the Sponsor does not report a breach to the MHRA but the investigator or institution believes a serious breach has occurred, due diligence is necessary. Investigators or institutions should consider whether to continue with the trial and/or report the breach directly to the MHRA.   

When to make the notification

• Within 7 days of the Sponsor becoming aware of the breach. If the notification function has been delegated by the Sponsor to another party, the 7-day timeline applies to the other party.

• If the Sponsor retains the notification function, then it is recommended that agreements between the Sponsor and other parties involved in the trial, should state that the other party will promptly notify the Sponsor of a serious breach (as defined in Regulation 29A) that they become aware of, in order for the Sponsor to meet their legal obligation. In this case, the clock starts when the Sponsor becomes aware of the serious breach.

• If the Sponsor obtains clear and unequivocal evidence that a serious breach has occurred (as defined in Regulations 29A), the default position should be for the Sponsor to notify the MHRA first, within 7 days, and investigate and take action simultaneously or after notification. In this case, the Sponsor should not wait to obtain all of the details of the breach prior to notification. In other cases, some degree of investigation and assessment may be required by the Sponsor prior to notification, in order to confirm that a serious breach has actually occurred. It is expected that this investigation is expedited to meet the 7-day timeline as closely as possible.

• A pragmatic approach to clock start should be employed. Inspectors will review the process for notification during MHRA GCP inspections and delays in notification may be classified as non-compliance. If in doubt about whether and when to notify, contact the MHRA GCP Team via GCP.SeriousBreaches@mhra.gov.uk.

Who to notify

• Notify serious breaches to the MHRA GCP Team. Notifications should be sent to the following email address:

GCP.SeriousBreaches@mhra.gov.uk

Organisations should also consider if there are any other relevant MHRA units that should be notified to comply with other legislation (for example, but not limited to):

• notification to the Clinical Investigation and Trials Team (CIT) if the breach relates to an Urgent Safety Measure (USM) or if a substantial modification is required due to a temporary halt in the trial or
• to the Defective Medicines Report Centre (DMRC) if the breach involves defective medicines or IMP recall etc.).

Health Research Authority (HRA) Standard Operating Procedures (SOPs) and Clinical Trials of Investigational Medicinal Product (CTIMP) Standard Conditions also require that the Research Ethics Committee (REC) is notified.

• A template form for notifications of serious breaches to the MHRA is available on the MHRA GCP webpage (https://www.gov.uk/guidance/good-clinical-practice-for-clinical-trials#report-a-serious-breach).

Organisations should use this form to ensure all required information is submitted to the GCP Team, the form should be sent as an MS Word document.

• Organisations may initially contact the MHRA Team to discuss the breach and follow-up with a written notification within 7 days of the Sponsor becoming aware of the breach. For current contact details for the GCP Team, please refer to the MHRA website www.gov.uk/guidance/good-clinical-practice-for-clinical-trials#contact.

• Wherever possible, the MHRA will provide an acknowledgement of receipt for notifications.

• It is recommended that the organisation also informs the relevant Chief Investigator and/or Principal Investigators (as applicable) of the breach notification. Communication in this regard facilitates the implementation of corrective and preventative actions (CAPA).

Identifying serious breaches

Deviations from clinical trial protocols and GCP occur commonly in clinical trials. The majority of these instances are technical deviations that do not result in harm to the trial participants or significantly affect the scientific value of the reported results of the trial. These cases should be documented (for example, in the Case Report Form or the Trial Master File) in order for appropriate corrective and preventative actions (CAPA) to be taken. In addition, these deviations should be included and considered when the Clinical Study Report is produced, as they may have an impact on the analysis of the data. However, not every deviation from the protocol needs to be reported to the MHRA as a serious breach.

What needs to be reported

• Any serious breach of:

(a) The conditions and principles of good clinical practice in connection with that trial; or

(b) The protocol relating to that trial, as modified from time to time in accordance with regulations 20 to 22C.

• For the purposes of this regulation, a “serious breach” is a breach which is likely to effect to a significant degree:

(a) The safety or physical or mental integrity of the participants of the trial (this should only be reported when trial participants in the UK are directly affected); or

(b) The scientific value of the trial (this is for trials with a Clinical Trial Authorisation in the UK or an ongoing marketing authorisation application, regardless of whether UK participants are directly impacted by the breach).

The judgement on whether a breach is likely to have a significant impact on the scientific value of the trial depends on a variety of factors, for example, the design of the trial, the type and extent of the data affected by the breach, the overall contribution of the data to key analysis parameters, the impact of excluding data from analysis etc.

It is the responsibility of the Sponsor to assess the impact of the breach on the scientific value of the trial.

This assessment should be documented, as the appropriateness of the decisions taken by the Sponsor may be examined during MHRA GCP inspections. If the Sponsor is unclear about the potential for a breach to have significant impact on the scientific value of the trial, the Sponsor should contact the MHRA to discuss the issue.

See Appendix I for further information relating to expectation for serious breach topics, this may help when deciding on whether to submit a serious breach notification. Appendix II contains examples of situations that may be considered serious breaches depending on the context of the situation. This list is not exhaustive. It is the organisation’s responsibility to assess the information and ensure appropriate reporting.

It is also the responsibility of the organisation to take appropriate corrective and preventative actions in response to the serious breach and to document these actions. Actions may also be taken by the MHRA, as described in section 7.

Deviations in Clinical Investigations which are not related to, or part of a Clinical Trial of Investigational Medicinal Product(s) do not need to be reported as a serious breach. Study deviations in Clinical Investigations should be reported as per the guidance: www.gov.uk/guidance/notify-mhra-about-a-clinical-investigation-for-a-medical-device#reporting-requirements.

What to notify (hints and tips)

Organisations should use the serious breach notification form to ensure all required information is submitted to the GCP Team. You do not have to wait until you have all the information, follow-up reports are acceptable. If the investigation or corrective and preventative action (CAPA) plan is on-going at the time of reporting the serious breach, it is acceptable to indicate your plans with projected timelines for completion. In such cases, you should indicate in the initial report when these are expected to be completed and what follow-up reports will be provided to the GCP Team and when. Follow-up reports should be submitted via an updated serious breach notification form, and should:

• Be clearly identified as a follow-up report.
• Identify the unique GCP identification number allocated when your initial report was acknowledged (which takes the format GCP-YY-XXX).
• Include all previously submitted information with new information added in a clear and transparent way. Each report form should be a complete record up to that point and therefore only the latest form is needed for review.
• Be forwarded to the inspector dealing with your initial notification directly or to GCP.SeriousBreaches@mhra.gov.uk if the follow-up information is to be submitted prior to the assigned MHRA inspector making contact.

MHRA actions

Upon receipt of a serious breach notification, the MHRA will review and assess the notification, and a variety of actions may be taken, depending on the nature of the breach and its potential impact.

• The GCP Team checks the serious breach mailbox.
• Receipt of the notification will be sent, along with a unique GCP identification number, and a GCP Inspector will be assigned to review.
• The inspector will decide if:
  • The referral is only required to be logged with no further action (the case may be examined during future MHRA GCP inspections).
  • Further information/investigation/CAPA is required. If insufficient information is provided in the initial notification to assess the impact of the breach, follow-up information will be requested using the serious breach notification form.
  • Any other bodies are required to be notified (for example, other competent authorities, Licensing Division, HRA, REC, other GxP areas, etc.) and may request the sponsor to notify these bodies.
  • A triggered inspection is warranted to investigate further.
  • Referral to CIT for consideration of suspension or termination of a clinical trial authorisation is required.
  • Referral to professional bodies, for example, the General Medical Council is required.
  • Further actions are required, for example, a referral to the MHRA Inspection Action Group if the issue is critical which may result in further escalation to the MHRA Enforcement Unit for consideration of enforcement action, for example, infringement notices and/or criminal investigation.
• Once any/all required actions have been satisfactorily completed, the inspector will close the serious breach case.

Organisation responsibilities

Sponsor

There should be a formal process in place to cover the legislative requirements of serious breach notifications. These should include:

• Receipt and assessment of issues (i.e. assessment of deviations/violations by Sponsor/delegate, isolated/systematic incident, participant(s) harmed or put at risk, data credibility etc.)
• Investigation including determination of extent of issue (single trial or multiple trials)
• Root cause analysis/evaluation and CAPA
• Reporting to the MHRA
• Compliance with the 7-day reporting timescale.
• Transparency of serious breaches (clinical study reports, publications, trial summaries)

Lack of systems and failure to report serious breaches may result in findings at MHRA GCP Inspections.

Investigator/Institution

The investigator/institution (for example, service provider or investigator site) should also have a process in place to identify and notify the sponsor of serious breaches in an expedited fashion. This may be a formal SOP or detailed in the protocol or study-specific guidance.

Consideration should be given to what actions to take if the Sponsor does not report the breach to the MHRA but the investigator/institution considers a serious breach to have occurred. The investigator/institution may need to perform suitable due diligence, for example, whether they should report a serious breach directly to the MHRA and/or a consideration of whether they should continue with the trial.

Retention

Where an organisation decides to retain the documentation will depend on each organisation’s quality systems. However, as a minimum, the decision on whether an issue constitutes a serious breach should be retained in the relevant Trial Master File(s). The serious breach notification form and communication with the reviewing inspector, if the issue is reported, should also be retained.

Circulation

Internally: This will depend on who needs to be informed as per the organisation’s procedures regarding responsibility for the decision, and notification of the serious breach to the MHRA (for example, clinical, regulatory, Quality Assurance, management etc.)

Externally: This will depend on the nature of the breach and may include other MHRA departments (where legislation may require notifications, for example, CIT, DMRC), other regulatory agencies and REC. 

However, it is also important that the breach is circulated/made available to relevant staff for inclusion of relevant information in the Clinical Study Report or publication. Serious breaches relating to investigator sites and

service providers should also be available to those making the selection of sites and service providers to be used for future trials, so that a risk-based decision can be made on their suitability. Appropriate circulation and subsequent action taken based on serious breaches may be reviewed during an MHRA GCP Inspection.

Appendix I Expectations for specific serious breach topics

1. Should proof of fraud relating to clinical trial records or data be reported as a serious breach?

If the fraud is likely to have a significant impact on the safety or physical or mental integrity of trial participants or the scientific value of the trial, this will be a serious breach.

While Regulation 29A does not legally require this, the MHRA GCP Team recommends that Sponsors in the UK report any suspected cases of clinical trial fraud they discover. The reason for this is that, although fraud at one particular trial site or organisation may not have a significant impact on scientific value or the safety or physical/mental integrity of participants for that particular trial, the MHRA would wish to assess the impact on other trials or participants.

If clinical trial fraud is identified at a non-UK trial site, a service provider, or a sponsor, for a trial that is also being conducted in the UK, a serious breach notification should only be submitted to MHRA if the fraud is likely to have a significant impact on the safety or physical/mental integrity of participants in the UK or on the overall scientific value of the trial.

Due to the often complex investigations required when fraud is identified, there should be a proactive approach to reporting, and if a Sponsor is unsure of whether a breach should be reported, the GCP Team should be contacted.

2. Should a breach of GCP or the protocol leading to the death, hospitalisation or permanent disability of a trial participant in the UK be reported as a serious breach?

Serious Adverse Events (SAEs) and Suspected Unexpected Serious Adverse Reactions (SUSARs) resulting from a breach of the conditions and principles of GCP or a breach of the protocol, will constitute a serious breach. However, it should be noted that not every SAE or SUSAR would routinely be classified as a serious breach.

Submission of a serious breach notification to the MHRA Team does not remove the requirement to report a SUSAR (where applicable) to be submitted to the concerned competent authorities. If the breach also resulted in an USM or a temporary/permanent halt to the trial, these would still need to be notified to CIT at the MHRA as per the applicable regulatory requirements and related MHRA guidance:  Clinical trials for medicines: collection, verification and reporting of safety events - GOV.UK.

3. Should a failure to report adverse events, SAEs or SUSARs in accordance with the legislation be reported as a serious breach?

If this failure results in trial participants, or the public, in the UK being put at significant risk, then this will constitute a serious breach, for example, inadequate safety reporting in dose escalation studies may impact on the decision to escalate to the next dose level. Trial participants and the public may be put at significant risk if SAEs are not accurately reported to Sponsors/ service providers in a timely manner and SUSARs are not accurately reported in a timely manner to the MHRA, this should be considered when determining whether a serious breach has occurred.

4. Should persistent or systematic non-compliance with GCP or the protocol be reported as a serious breach?

If this non-compliance has a significant impact on the integrity of trial participants in the UK or on the scientific value of the trial, this will constitute a serious breach. For example, widespread and uncontrolled use of protocol waivers affecting eligibility criteria, which leads to harm to trial participants in the UK or which has a significant impact on the scientific value of the trial. Another example would be an investigator repeatedly failing to reduce or stop the dose of an IMP in response to a trigger defined in the protocol (for example, abnormal laboratory results). Serious breach notifications must not be used as a punitive measure against investigator sites or service providers and should not be used by sponsors to manage site/service provider performance.

5. Should a failure to control investigational medicinal product(s) (IMP) be reported as a serious breach?

This will constitute a serious breach if the failure results in trial participants or the public in the UK being put at significant risk or the scientific value of the trial being compromised. If a serious breach occurs due to an IMP defect, a drug defect report may also need to be submitted to the MHRA DMRC, in addition to the serious breach notification.

6. For trials that are ongoing in the UK, should serious breaches that occur at non-UK sites be reported?

If a serious breach is identified at an investigator site outside the UK, which is likely to affect to a significant degree the overall scientific value of the trial and the result will impact on UK participants or the UK public (for example, data will be used in a marketing authorisation application that affects the UK), then this breach should be notified to the MHRA.

Additionally, if a serious breach is identified at an investigator site outside the UK that has a significant impact on the safety or physical/mental integrity of trial participants at that non-UK site and has, on timely investigation, been found to also impact the safety or physical/mental integrity of trial participants in the UK, then this will require notification to the MHRA.

For example:

• The cause of the breach may be such that the breach may occur at other trial sites, e.g. death of a participant due to incorrect administration of IMP as result of erroneous reconstitution instructions in the protocol. There is the potential for this to impact participants recruited in the UK, and therefore an expedited investigation should be conducted to confirm if UK participants have been impacted, and this reported as a serious breach. The need for an investigation should not delay the report of a serious breach to the MHRA, there should be a proactive approach to reporting, and if a Sponsor is unsure of whether a breach should be reported, the GCP Team should be contacted. Other concerned competent authorities may also need to be informed as well as the MHRA.

• In relation to the example above, an USM may need to be implemented to address the cause of the breach. If, in order to address the cause of a serious breach, an USM is implemented at UK sites, to amend the conduct of the trial or suspend the trial, the USM notification should be sent by the Sponsor/delegate to the MHRA CIT as per SI 2004/1031 (as amended).

If a serious breach is identified at an investigator site outside the UK which is not likely to affect to a significant degree the overall scientific value of the trial or a marketing authorisation, and there has been no impact to the safety or physical/mental integrity of UK participants, a serious breach does not need reporting to the MHRA.

7. Where an issue impacts multiple trials, or has occurred in multiple trials, how many notifications should be submitted to the MHRA?

If a serious breach is identified that impacts multiple trials only one submission is required to be made to the MHRA. One serious breach notification form should be used to report the serious breach, but it should be clear which trials have been impacted, and the nature of the impact on each trial.

Appendix II Examples of serious breaches notified to MHRA

Note: this is not an exhaustive list

Details of Breach Reported	Was this a Serious Breach?
A participant was dosed with the incorrect IMP, which was administered via the incorrect route (the IMP used was from a completely different clinical trial to the one the participant was recruited to).	Yes, there was significant potential to impact the safety or physical or mental integrity of trial participants.
Participants in an entire cohort were incorrectly dosed with IMP three times daily when they should have been dosed once daily.	Yes, - there was impact on the safety or physical or mental integrity of trial participants or on the scientific value of the trial. - this issue was systematic and persistent leading to a constant breach of the conditions and principles of GCP in connection with that trial or the trial protocol.
One participant was administered 6 additional doses of IMP. The participant was to receive IMP on day 1 and 8 but instead received IMP on days 1 to 8. The participant experienced a severe adverse event as a result.	Yes, there was impact on the safety or physical or mental integrity of trial participants and on the scientific value of the trial.
A participant took IMP that had expired two days previously. The participant did not experience any adverse events and this issue did not affect the overall scientific integrity of the trial.	No, there was no impact on the safety or physical or mental integrity of the trial participant or on the scientific value of the trial. In addition, the assessment of the breach identified this as a single episode and a detailed CAPA was implemented.
IMP temperature excursions	Yes, if the situation was not managed and participants were dosed with IMP assessed as unstable, which resulted in harm/potential to harm participants. No, if the excursions had been managed appropriately (e.g. IMP was moved to alternative location/quarantined as necessary and an assessment (by qualified personnel) illustrated that there was no impact on participant safety and data integrity.
Three trial participants were significantly underdosed with concomitant standard of care medication in deviation from the protocol. This potentially led to the death of one participant.	Yes, there is impact on participant safety, and additional potential impact on the scientific integrity of the trial.
Multiple issues with the Interactive Response Technology (IRT) system across several clinical trials leading to the dispensing of expired IMP and a shortage of IMP at investigator sites for participant visits.	Yes, there was impact on the safety or physical or mental integrity of trial participants and this issue persisted leading to a constant breach of the conditions and principles of GCP in connection with that trial or the trial protocol, despite the implementation of a CAPA.
On two separate occasions the Sponsor identified issues with the same investigator site. First with consenting and then with potential fraud in recruitment and consenting. However, there was not unequivocal evidence of fraud at the time of reporting. One of the trials involved paediatric participants.	Yes, this subsequently led to enforcement action against the organisation in question.
Concerns were raised during monitoring visits about changes to source data for a number of participants in a trial, which subsequently made participants eligible with no explanation. An audit was carried out by the Sponsor and other changes to source data were noted without explanation, potentially impacting on data integrity. Follow-up reports sent to MHRA confirmed the Sponsor concerns over consenting and data changes made to source without an adequate written explanation.	Yes Note: not all of the information was provided in the original notification, the Sponsor provided follow-up updates.
A non-UK investigator was deviating from the protocol eligibility criteria when enrolling participants. This had no impact on interim analysis or decision making on the trial or the overall scientific integrity.	No, as this did not impact the integrity of UK participants or impact the scientific integrity of the trial, or the decision making at interim stages of the trial. Note: this was not known at the initial referral by the sponsor and follow-up was required to confirm that this was not a serious breach.
A clinical trial participant attended a Hospital’s Emergency Department who attempted to contact the pharmacy (using the phone number listed on the emergency card issued to the participant) in order to unblind. Pharmacy were unable to code break in a timely manner, as a result, the participant withdrew from the clinical trial feeling unhappy that the pharmacy was not available in an emergency situation.	Yes, as this had significant potential to harm the participant if unblinding would have affected the course of their treatment.
A cohort had invalid blood samples as they were processed incorrectly. As a result one of the secondary endpoints could not be met. Therefore, a substantial amendment was required to recruit more participants to meet the endpoint. Participants were dosed unnecessarily as a result of this error.	Yes
Participant safety was compromised because repeat ECGs were not performed, as required by the protocol. Also, there was inadequate quality control of the interim safety reports used for dose escalation which had potential for stopping criteria to be missed.	Yes
The Principal Investigator failed to report a single SAE as defined in the protocol.	No, if this did not result in other trial participants being put at risk, and it was not a systematic or persistent problem. In some circumstances, failure to report a SUSAR could have a significant impact on trial participants or the public and therefore may require reporting.
Over 100 SUSARs reported to the MHRA had incomplete case narratives in the SUSAR reports. This occurred over a period of three years.	Yes, the inaccurate reporting of SUSARs prevent the MHRA from having accurate and contemporaneous oversight of the safety of IMPs, potentially impacting trial participant safety and the public. This issue was a systemic issue not identified for over three years.
An investigator site failed to reduce or stop trial medication, in response to certain laboratory parameters, as required by the protocol. This occurred with several participants over a one-year period, despite identification by the trial monitor of the first two occasions. Participants were exposed to an increased risk of thrombosis.	Yes
An NHS trust identified a member of the clinical trial team had falsified documentation including the forgery of clinical trial prescriptions.	Yes, it should be noted in this case multiple trials and multiple sponsors were impacted by the fraudulent actions. The MHRA should be notified by the trust within 7 days of becoming aware to ensure the impact of the fraud can be assessed.
A potential serious breach was identified, but not reported (documentation in the Sponsor’s TMF identified that there may have been fraud at an investigator site with re-use of previous time point data in later time points). The Sponsor had investigated, and the issue was subsequently found to be a genuine error and not fraud.	No, on this occasion. However, had this been identified as fraud impacting on the integrity of the data, then this serious breach would not have been notified within the regulatory timeframe (i.e. 7-day window), a proactive approach to reporting potential fraud should have been taken.
Patient Information Sheet and Informed Consent form updated, but at one trial site this information was not relayed to the participants until approximately 2-3 months after approval.	No, if this was not a systematic or persistent problem and if no harm to trial participants resulted from the delay. Yes, if there was a significant impact on the integrity of trial participants (e.g. there was key safety information not relayed to participants in a timely manner).
A single participant failed to sign a supplemental consent form. This participant was in France. At the time of report, no issue had been identified in UK participants. There was no impact on the scientific integrity of the trial.	No, this has not impacted the integrity of UK participants and does not impact the scientific integrity of trials.
A Dear Investigator Letter notifying investigators of a potential new safety risk in the trial was not communicated to participants as requested by the Sponsor. This issue impacted sites and participants in a number of countries, but not the UK.	No, there is no impact to the scientific integrity of the trial, and there has been no impact to the integrity of UK participants.
Visit date deviation.  A common deviation in clinical trials.	No, a minor protocol deviation, which does not meet the criteria for notification.
The GCP Team was notified that a substantial amendment had been submitted regarding changes to dosing on a first in human trial, as a result of an SAE after dosing the initial participant. The sponsor had temporarily halted the trial and only after further investigation had assigned the SAE as unrelated. The sponsor had not notified CIT of the USM implemented or reported the SAE as a potential SUSAR.	Yes
The early destruction of Investigator Site Files (i.e. one trial had only been completed a year earlier and one trial was still ongoing).	Yes
A member of public received a named invite to be a volunteer in a clinical trial (no specific trial mentioned). However, this person was not on the organisation’s volunteer database and had not participated previously in a study. On further investigation by MHRA, it was revealed that the organisation had contracted the use of a mail shot organisation to send a generic mail shot to a list of people in a specific location, over a certain age. This had been approved by the REC.	No
An updated Participant Information Sheet was emailed by an investigator site to the 11 participants enrolled at their site with all participants copied into the same email. This allowed each participant to see the names and email addresses of the other participants recruited at that site.	Yes
A participant’s laboratory report was sent from an investigator site to the CRO without anonymisation resulting in the participant’s name and hospital number being disclosed.	No, this was an isolated incident without evidence of systematic failure.