Multiregional Clinical Trials With China Sites in 2026: HGR Approval, PIPL Data Export and What the Registries Show

TL;DR

Takeaway: In the analysed ClinicalTrials.gov cohort, more than one in four industry multinational drug trials starting in 2025 listed mainland China sites. Running one well depends on separating two legal regimes that teams often merge: the human genetic resources rules, which cover HGR materials and gene/genome-related information, and the personal information law, which covers identifiable participant information, including coded health records.

In 2025, 28.6% of industry multinational drug and biologic trial starts recorded in the analysed ClinicalTrials.gov cohort included at least one site in mainland China, rising from 65 starts (5.9%) in 2015 to 322 in 2025 [1]. Across the entire 2015-2026 window, 2,138 industry trials fit this multiregional profile [1]. These are large programmes: the median trial spans 15 countries and 90 investigator facilities, and 86.4% also run sites in the United States [1]. China's own registry gives the same order of magnitude: the Center for Drug Evaluation (CDE) reported 337 international multicentre registrations out of 2,539 new-drug trials in 2024 (13.3%) [2][3].

Clinical operations and regulatory teams often assume that human genetic resources (HGR) oversight covers the whole electronic case report form. The text says otherwise. Article 2 of the 2023 HGR Implementing Rules excludes clinical data, medical imaging, protein data and metabolic data from HGR information, leaving the HGR regime with biological materials and gene- or genome-type data [4]. Ordinary trial data are instead sensitive personal information under Article 28 of the Personal Information Protection Law (PIPL), which requires separate consent and a lawful export mechanism [5]. For a non-CIIO handler without an applicable exemption or important-data trigger, the Cyberspace Administration of China (CAC) volume thresholds help determine the mechanism: sensitive personal information of 10,000 or more individuals exported cumulatively since 1 January of the year requires a government security assessment, while smaller volumes can use a standard contract or certification [6].

Licensing statistics move in the same direction. International collaboration permits under the HGR regime fell from 4,729 in 2022 to 1,871 in 2024 [7], a descriptive decline whose causes remain unresolved. The filing exemption for qualifying registration trials without material export already existed in the 2019 Regulations; the 2023 Rules specify its operating conditions [8][4]. Since 1 May 2024 the competent authority has been the National Health Commission (NHC) rather than the Ministry of Science and Technology (MOST), under State Council Decree 777 [8][9].

This paper is a data-governance workpaper for sponsors, contract research organisations (CROs) and clinical data leaders structuring a China-inclusive multiregional clinical trial (MRCT). It sorts trial data into legal routes, compares hosting patterns, sequences the filings and sets out what the United States Food and Drug Administration (FDA) and the European Medicines Agency (EMA) will ask of the China data. It is analysis, not legal advice, and it is not a market ranking.

One in four observed multinational starts in 2025 listed mainland China

Takeaway: Industry multiregional trials with mainland China sites grew fivefold between 2015 and 2025 and reached 28.6% of industry multinational starts; they are large, late-phase programmes that also run US sites 86.4% of the time.

The cohort comes from ClinicalTrials.gov via AACT: interventional drug and biologic trials started between 2015 and 2026, with geography read from site-level facility country strings and deduplicated per study [1]. Mainland China is the facility string "China"; Hong Kong, Taiwan and Macau are tracked separately. A China-inclusive MRCT has at least one mainland facility and at least one facility outside all Greater China jurisdictions; 25 industry trials that ran only in mainland China plus Hong Kong, Macau or Taiwan are excluded [1]. Registration records describe filings and planned designs, not verified enrolment or site execution.

Annual starts rose from 65 in 2015 to 322 in 2025, with a dip to 228 in 2022 and a plateau near 250 in 2023 and 2024 [1]. Measured against all industry multinational drug-trial starts (facilities in two or more countries), the China-inclusive share went from 5.9% in 2015 (65 of 1,093) to 15.0% in 2020 (181 of 1,209) and 28.6% in 2025 (322 of 1,125) [1]. The partial year to 25 July 2026 shows 140 of 562 starts (24.9%). Across 2015-2026 the cohort holds 2,138 of 13,399 industry multinational starts, 16.0% [1].

Sponsor headquarters classes, assigned with a curated dictionary of about 230 names and keywords plus a keyword rule, show that European and US companies run most of these studies [1]. Across the 2,138 trials, European sponsors lead 835 (39.1%), US sponsors 779 (36.4%) and mainland Chinese sponsors 285 (13.3%); Japanese sponsors lead 109, and 118 trials (5.5%) remain unclassified [1].

The Chinese share is growing from a small base. Mainland sponsors led 24 of 356 China-inclusive trials started in 2015-2018 (6.7%), 123 of 825 in 2019-2022 (14.9%) and 138 of 957 in 2023-2026 (14.4%) [1]. The largest sponsors by count are AstraZeneca (181), Novartis (141), Roche (119), MSD (117), Eli Lilly (102), Janssen (93), Pfizer (89), Sanofi (87) and Bristol Myers Squibb (86); BeiGene appears with 44 trials plus 37 registered under BeOne Medicines [1].

Therapeutic areas are skewed toward oncology. Tagging by MeSH condition branches shows oncology on 42.4% of China-inclusive MRCTs (907 of 2,138) against 28.8% of multinational trials without China (3,248 of 11,261); respiratory disease on 19.5% versus 14.1%; immunology on 18.3% versus 17.5% [1]. Neurology (7.2% versus 12.8%), infectious disease (3.6% versus 9.0%) and psychiatry (1.8% versus 4.6%) are under-represented [1]. The most frequent condition terms are non-small cell lung cancer (224 trials), breast neoplasms (101), stomach neoplasms (52), colorectal neoplasms (46), prostate neoplasms (46), multiple myeloma (45) and type 2 diabetes mellitus (45) [1].

The operational profile is the decisive fact for data governance. China is added to the largest programmes: the median China-inclusive MRCT spans 15 countries (interquartile range 7 to 23) and 90 facilities, against 5 countries and 27 facilities for multinational trials without China [1]. 86.4% (1,847) have US sites, 80.5% (1,722) have sites in Europe (EU/EEA/UK/CH), 75.3% (1,610) have both, and 60.8% and 60.0% include Japan and South Korea respectively [1].

The phase mix is consistent with substantial late-stage development, with registration intent requiring separate protocol confirmation: phase 3 designs (including phase 2/3) make up 61.1% of the cohort (1,306 trials) against 34.9% (3,926) of multinational trials without China, and 89.4% (1,912) are flagged in the registry as an FDA-regulated drug product [1]. The rest are phase 2 (404), phase 1 (207), phase 1/2 (195), phase 4 (22) and a handful without a phase [1].

The contrast is the China-only trial run by a foreign sponsor. Between 2015 and 2026, foreign-headquartered sponsors started 610 industry China-only trials (315 European, 206 US, 66 Japanese, 23 other), against 6,114 led by mainland sponsors and 1,498 unclassified, with 9 additional records outside those listed sponsor groups, out of 8,231 industry China-only studies [1]. Their median size is one facility; that is compatible with smaller local studies, with bridging, pharmacokinetic, label-extension and pivotal purposes requiring protocol-level classification, and their annual starts peaked at 96 in 2021 and fell to 42 in 2025 [1].

Wang and colleagues describe the same shift from the sponsor's side: China is moving from a late-stage add-on toward earlier inclusion through first-wave, modular and staged participation pathways, and they warn that earlier inclusion does not by itself make the evidence interpretable across regions or workable under governance constraints [10].

What China's own registry adds

Takeaway: The NMPA registry puts international multicentre trials at 13.3% of 2024 new-drug registrations, while most international records in the separate detail sample are phase 3, inside a platform where domestic sponsors account for 92.8% of first-published trials.

China's own registry gives the second lane. On 19 June 2025 the NMPA Center for Drug Evaluation (CDE) released its annual report on new-drug registration trials for 2024 [2][3]. It records 4,900 registrations on the Drug Clinical Trial Registration and Information Disclosure Platform in 2024, up 13.9% on 2023, of which 2,539 were new-drug trials registered by acceptance number, up 9.3% [2][3].

Among the new-drug trials, 337 (13.3%) were international multicentre and 2,201 (86.7%) domestic; these two published counts leave one of the 2,539 records outside the stated categories [2][3]. Across all 4,900 registrations, which include bioequivalence trials, international multicentre trials were 339 (6.9%), domestic 4,540 (92.7%) and "other" 21 (0.4%) [2][3]. Domestic sponsors accounted for 92.8% of first-published trials, and participating institutions split 62.2% domestic and 37.8% foreign [2][3].

An independent capture of the public search listing on 30 July 2026 returned 35,996 rows and 35,989 unique CTR numbers [11]. Registration numbers with a 2024 prefix total 4,872, with a 2025 prefix 5,160, and 2,849 carry a 2026 prefix through 30 July [11]. By status, 21,312 trials are marked completed, 12,688 are in progress (5,942 recruiting, 2,514 recruitment complete, 4,232 not yet recruiting), 1,497 were voluntarily terminated and 495 suspended [11].

A bounded sample of 1,640 public detail pages captured on 31 July 2026 contained 1,313 records with a stated trial scope [11]. Of those, 160 (12.2%) are international multicentre; this is a different, non-random cohort from the official 2024 new-drug denominator, so representativeness relative to the official 13.3% proportion remains untested; 1,153 are domestic and 327 leave the field blank [11]. Of the 160 international records, 139 are phase 3, 13 phase 2, 4 phase 4 and 4 other, and the sponsors named are multinational groups such as Novartis, Boehringer Ingelheim, Janssen, Bayer, Eli Lilly, Roche, Bristol Myers Squibb, UCB, Takeda and MSD [11].

The listing has no field for the ClinicalTrials.gov NCT number, so matching a global trial to its CTR record is an identity problem in its own right; the methods are in the earlier workpaper on cross-registry multinational trial identity. The 1,640-record sample is bounded by a capture interruption and is an indicative sample, not a census, and should not be treated as representative of the official annual-report cohort [2][11].

The HGR regime in 2026: narrow scope, three routes and a new competent authority

Takeaway: The 2023 Implementing Rules exclude clinical, imaging, protein and metabolic data from HGR information and send registration-directed trials without sample export to a filing rather than an approval; the NHC has run the regime since May 2024.

The governing instrument is the Regulations on the Management of Human Genetic Resources, promulgated by State Council Decree 717 on 28 May 2019 and revised by the Decree 777 decision of 10 March 2024 [8]. Article 4 makes the State Council health authority competent; Article 7 bars foreign organisations, individuals and foreign-controlled entities from collecting, preserving or exporting China's HGR [8].

Article 22 carries the rule that matters for trials. International collaborative research using China's HGR needs approval against seven conditions, including ethics review in both countries, but a clinical trial run in clinical institutions to obtain marketing authorisation for a drug or device in China, without export of HGR materials, needs no approval; the parties instead file the types, quantities and uses of the HGR with the competent authority before the trial starts [8].

Article 28 governs HGR information provided to foreign entities: it must not harm public health, national security or the public interest, a security review applies where it might, and sets a filing/back-up obligation; the Rules specify an exemption from a separate prior report and back-up for information shared with the foreign partner during an approved or filed collaboration under its agreed joint-use terms [8]. Article 36 sets fines of CNY 500,000 to 5,000,000 (five to ten times illegal gains above CNY 1,000,000) for, among other things, unapproved international collaboration and failure to file before an international cooperative clinical trial [8].

The Implementing Rules (MOST Order 21) were issued on 26 May 2023 and took effect on 1 July 2023 [4]. Article 2 draws the boundary: HGR information means human gene and genome data generated from HGR materials, and "不包括临床数据、影像数据、蛋白质数据和代谢数据", it excludes clinical data, imaging data, protein data and metabolic data [4]. That exclusion applies to those data categories themselves; gene/genome-derived datasets and their linked attributes still require an HGR assessment.

Article 12 treats an entity as foreign-controlled when foreign organisations or individuals hold 50% or more of its shares, voting rights or similar interests, or otherwise exert decisive influence; Article 11 treats domestically controlled entities in Hong Kong and Macau as Chinese parties [4].

Article 32 states the two filing conditions: either the HGR are collected, tested, analysed and the residual materials handled inside the clinical institution, or they are collected inside the institution and tested, analysed and handled by a domestic unit designated in the marketing-authorisation trial protocol [4]. The same article adds that an exploratory research part of such a trial requires an international collaboration approval, not a filing [4].

Article 27(3) exempts registration-directed trials from the collection permit that large-population studies of more than 3,000 people otherwise need [4]. Article 33 prohibits splitting a multicentre study into separate applications, and Article 34 lets the sponsor or lead institution file once the lead site's ethics committee has approved, after which participating institutions submit their own ethics approval or recognition of the lead site's approval plus a commitment letter [4].

Article 35 requires a joint report within six months after the filing or permit expires [4]. Article 36 requires a prior report and back-up copy before HGR information is provided abroad, with an exemption for information generated during an approved or filed collaboration and provided by the Chinese party to its foreign partner under agreed joint-use terms [4].

Article 37 requires a security review when the outbound HGR information concerns important genetic families, specific regions, exome or genome sequencing of more than 500 people, or other matters that may affect public health, national security or the public interest [4]. Article 41 gives the authority 20 working days to decide an approval application, extendable by 10, with technical review and other specified procedures excluded from that clock under Article 42 [4]. Article 47 permits certain quantity changes of at most 10% of the approved total without an amendment application only when research content and protocol remain unchanged; written notification and supporting materials are still required; Article 51 makes NMPA clinical trial approval, notification or record a prerequisite for the filing; Articles 52 and 53 list the filing contents and change rules [4].

On 25 April 2024 MOST announced that HGR administration would pass to the NHC from 1 May 2024 under Decree 777, with the application platform unchanged [8][9]. The NHC's filing guide, posted in March 2025, restates the Article 32 conditions and lists what counts as HGR material (cells, whole blood, tissue, semen, cerebrospinal fluid, effusions, smears, hair with follicles; the guide excludes specified secretions and swabs only where they contain no human cells) and as HGR information (gene, genome, transcriptome, epigenome and ctDNA-type nucleic-acid biomarker data with their linked disease and ethnicity attributes) [12].

Licensing statistics compiled by Song, Liu and Meng describe permit volumes before and after the 2023 Rules [7]. Total HGR permits went from 5,690 in 2021 and 6,900 in 2022 to 5,328 in 2023 and 2,214 in 2024; international collaboration permits from 3,661 and 4,729 to 3,853 and 1,871; export permits stayed rare at 0, 1, 10 and 10 [7]. Sponsors holding at least 1% of 2023-2024 permits were led by BeiGene (4.80%), AstraZeneca (4.03%), Roche (3.82%), MSD (2.89%), Novartis (2.40%) and Johnson & Johnson (2.27%) [7].

The authors interpret the decline in light of the filing route. That is a proposed explanation, not a causal estimate: the exemption predates 2023 and these counts do not measure filings, activity shifts or other causes [4][7].

Chen and Li add the point that genomic data carry a dual character: they are HGR under the Regulations and sensitive personal information under PIPL at the same time, so an outbound sequencing dataset passes an NHC report or security review and a CAC export mechanism in parallel [8][5][13].

Personal information export: the regime that covers most trial data

Takeaway: Coded trial records remain personal information, and medical-health data are sensitive personal information under PIPL, so teams must assess notice, consent or another applicable legal basis, impact assessment and the relevant export route for each flow. Volume is one part of that assessment.

PIPL was adopted on 20 August 2021 and has applied since 1 November 2021 [5]. Article 4 defines personal information as information relating to an identified or identifiable natural person and excludes anonymised information [5]. Trial data are coded, and the key from subject number to identity stays at the site, so coded data remain personal information; only irreversibly anonymised data leave the law's scope.

Article 28 defines sensitive personal information as information whose leak or unlawful use can easily harm a person's dignity or personal or property safety, and names medical health (医疗健康) alongside biometric, religious, specific-identity, financial-account and location data and the data of children under 14 [5]. It may be processed only for a specific purpose, with sufficient necessity and strict protective measures [5]. Article 29 requires separate consent (单独同意) for sensitive personal information [5].

Article 38 lists the export mechanisms: a security assessment organised by the national cyberspace authority under Article 40, personal information protection certification by a professional body, a contract with the overseas recipient on the CAC standard contract, or another condition set by law or the CAC [5]. Article 39 requires the handler to tell the individual the overseas recipient's name, contact details, processing purpose and method, the categories involved and how to exercise rights against the recipient, and to obtain separate consent for the export [5].

Article 40 requires critical information infrastructure operators and handlers above a CAC-set volume to store personal information collected in China domestically and pass a security assessment before export [5]. Article 41 prohibits providing personal information stored in China to foreign judicial or law-enforcement bodies without approval from the competent Chinese authority, and Article 55 requires a personal information protection impact assessment (PIA) before any export [5].

The CAC Provisions on Promoting and Regulating Cross-border Data Flows (Order 16) took effect on publication on 22 March 2024 and reset the thresholds [6]. Article 2 says handlers need not declare an important-data security assessment for data not notified or publicly identified as important by a relevant department or region; Articles 3 to 5 exempt, among others, non-personal and non-important data from academic cooperation and exports of non-sensitive personal information of fewer than 100,000 individuals in the year; Article 6 lets free trade zones publish negative lists [6].

Article 7 sets the security-assessment triggers: a critical information infrastructure operator exporting any personal information or important data; any other handler exporting important data; or exporting non-sensitive personal information of 1,000,000 or more individuals, or sensitive personal information of 10,000 or more individuals, cumulatively since 1 January of the year [6]. Article 8 assigns the standard contract or certification to exports of 100,000 to fewer than 1,000,000 non-sensitive individuals or fewer than 10,000 sensitive individuals [6]. Article 9 extends an assessment's validity to three years, and the CAC's published answers state that counts are deduplicated by natural person [6].

The exemptions and free-trade-zone rules must be assessed first; they do not automatically remove other PIPL duties. For routine clinical exports, document the handler, legal basis, important-data status, CIIO status, recipient access and cumulative counts before selecting a route. The clocks sit in the earlier CAC measures. Under the Security Assessment Measures (Order 11, in force 1 September 2022), the provincial office checks completeness within 5 working days, the national office decides acceptance within 7 working days (Article 7), and the assessment is completed within 45 working days of acceptance, extendable for complex cases (Article 12); Article 9 lists the clauses the export contract has to contain [14]. Under the Standard Contract Measures (Order 13, in force 1 June 2023), a PIA comes first (Article 5), export may start only once the contract is in effect (Article 6), and the contract and PIA report are filed with the provincial office within 10 working days of effectiveness (Article 7) [15].

The Data Security Law, in force since 1 September 2021, is an additional, parallel legal framework. Article 21 creates classified and graded protection and tells regions and sectors, health among them, to publish catalogues of important data; Article 31 reserves the export rules for important data; Article 36 mirrors PIPL Article 41 by prohibiting provision of data stored in China to foreign judicial or law-enforcement bodies without approval [16].

Data category by legal route

Takeaway: Biospecimens and genomic data trigger the HGR regime; eCRF, imaging, eCOA and safety records travel under PIPL, where CIIO status, important data, exemptions and cumulative subject counts determine the applicable mechanism.

The matrix below assigns each data or material category to its route. Biospecimens and sequencing data belong to the NHC regime; every identifiable or coded participant record in trial software belongs to the PIPL regime supervised by the CAC [4][5][6].

Four flows deserve separate attention because teams tend to leave them out of the map.

1. eCOA and ePRO collected by an offshore service. When a participant's phone or a provisioned tablet sends symptom scores to a server outside mainland China, the personal information leaves China at the moment of collection; the CAC's published interpretation of the 2024 Provisions describes cross-border flow as both transfer abroad and access from abroad to data still in China [17]. Those scores are medical-health data and therefore sensitive [5]. The consent form needs the Article 39 particulars for the offshore recipient, and each participant counts toward the 10,000 sensitive-data threshold [5][6].

2. Central imaging reads. DICOM files are outside HGR information because imaging data are excluded by Article 2 of the Rules [4], but they remain sensitive personal information under Article 28 of PIPL [5]. Sending them to an offshore reading centre is an export that needs an effective standard contract, certification or assessment, and header de-identification reduces risk without taking coded scans out of the regime [5][6].

3. Safety cases to a global pharmacovigilance database. Serious adverse event and suspected unexpected serious adverse reaction reports carry health data about an identifiable participant. Article 13 of PIPL allows processing without consent where necessary to protect life, health or property in an emergency, but the export chapter still governs routine transfers, so the safety flow belongs inside the study's export mechanism and consent language [5][6].

4. Remote monitoring and data-management access. When monitors or data managers outside China open records held on a China-hosted system, the CAC's interpretation treats that access as cross-border flow [17]. Role-based access, named overseas recipients, session logs and inclusion of remote access in the standard contract or assessment are the practical response [5][15].

The matrix is EClinCloud's synthesis of the binding texts as of September 2026 and is analysis rather than legal advice.

Three hosting patterns and when each fits

Takeaway: A global instance with the PIPL route live before first entry, a China-hosted instance with scheduled coded exports, or a split design that keeps genomic work in a protocol-designated domestic laboratory: each pattern fits a different trial shape.

Three hosting patterns cover the practical choices.

Pattern 1, global instance. China sites enter data directly into the sponsor's global electronic data capture (EDC) instance hosted outside mainland China. One database, one audit trail and real-time monitoring come with a hard dependency: the applicable export mechanism (standard contract effective, certification obtained or assessment passed) and required notices/consents must be ready before the first covered cross-border collection or access. The standard contract and impact-assessment report are filed within 10 working days after the contract becomes effective; filing is not stated as a precondition to its effectiveness [5][15]. If the mechanism lags, site activation waits.

Pattern 2, China-hosted instance. EDC, eCOA and local randomisation run on infrastructure inside mainland China. Sites can activate once all applicable trial, ethics, HGR and local operational requirements are met. Coded analysis-ready datasets leave only after the applicable export route is ready; offshore remote access also counts as an export, even before a scheduled file transfer. The price is a second instance to validate and maintain, schema mapping, and query reconciliation across the boundary.

Pattern 3, split architecture. Clinical, imaging and safety data follow pattern 1 or 2 under PIPL, while biospecimens and any genomic, transcriptomic or ctDNA analysis go to a domestic laboratory designated in the protocol, which can support the Article 32 filing route if all conditions are met and any exploratory component is separately assessed [4]. Only derived, coded genomic tables leave China, under the applicable Article 36 report or collaboration exemption, Article 37 security review where triggered, and the PIPL route. Material export approval is not triggered by a data-only transfer, but the data obligations remain [8][4][5].

The trade-offs in one view:

The registry profile shapes the choice. A median of 90 facilities across 15 countries, US sites in 86.4% of trials and an FDA-regulated flag on 89.4% mean that whichever pattern is chosen has to hold up to FDA inspection of a China site and to applicable GCP and computerised-system requirements. Part 11 applies to covered electronic records and signatures; EU Annex 11 is a GMP instrument and is not a blanket clinical-trial requirement [1]; the earlier report on computerized system inspection signals covers what those inspections cite.

Two judgments follow.

• EClinCloud judgment: For a phase 3 registration programme with a genomic or biomarker sub-study, the split pattern can avoid material export, but filing eligibility still requires every Article 32 condition: sample export or an exploratory research part moves the study to the approval route with a 20 working day decision clock that excludes specified review procedures, and ethics documentation under Articles 31, 32, 41 and 42 [4]. The approval route is workable, but it should be a deliberate choice, not a discovery at site activation.
• EClinCloud judgment: A personal information handler whose covered China flows together will export sensitive personal information of 10,000 or more individuals in a calendar year should plan the CAC security assessment across that handler’s covered flows, subject to applicable exemptions, because Article 7 counts cumulatively from 1 January and Article 4 of the Standard Contract Measures forbids splitting volumes to stay on the contract route [6][15].

What FDA and EMA will ask of the China data

Takeaway: FDA accepts China data under 21 CFR 312.120 when GCP and inspectability are shown, approves on foreign data alone only under the three 314.106(b) conditions, and stated in 2022 that E17 multiregional trials are the preferred approach; China's own rules point the same way.

Under 21 CFR 312.120, FDA accepts a foreign clinical study not conducted under an IND when it was conducted in accordance with good clinical practice, including review and approval by an independent ethics committee and documented informed consent, and when FDA is able to validate the data through an on-site inspection if it deems that necessary [18]. The sponsor supplies investigator qualifications, site descriptions, a protocol summary and results, the ethics committee's identity and decision, the consent process, monitoring and protocol-adherence measures and investigator GCP training, and retains records for two years after approval of the supported application, or for the alternative period specified in §312.120(d) when the study is not submitted in support of an application [18].

21 CFR 314.106(a) refers acceptance of foreign data back to 312.120; 314.106(b) allows approval on foreign data alone only if the data are applicable to the US population and US medical practice, the studies were performed by investigators of recognised competence, and the data can be considered valid without an inspection or FDA can validate them by inspection or other appropriate means; 314.106(c) encourages a presubmission meeting [19].

ICH E17 (Step 4, 16 November 2017) sets the design principles for a trial run under one protocol across regions: pre-specified pooling of regions or subpopulations, stratification by region, and an evaluation of consistency defined as the absence of clinically relevant differences in treatment effect across regions [20].

China's rules point the same way.

• NMPA Announcement No. 88 of 2019 applies E5(R1), its questions and answers, and E17 from 5 November 2019 [21].
• NMPA Announcement No. 52 of 2018 accepts overseas trial data in three grades, full, partial and non-acceptance, on condition that the complete data are submitted without selection, that ICH GCP was followed, and that an E5 ethnic-sensitivity analysis compares the Chinese subgroup with the whole population; conditional acceptance exists for critical, rare and paediatric conditions [22].
• The 2015 guidance on international multicentre drug trials asks for a scientific and regulatory rationale for the sample allocated to each country, pre-specified methods for subgroup consistency, local-language consent forms and a protocol statement of the case report form language [23].

FDA's position on single-country China data is on the record in the briefing document for the Oncologic Drugs Advisory Committee meeting of 10 February 2022 on BLA 761222, sintilimab, supported by the ORIENT-11 trial conducted entirely in China [24]. The document notes an increasing number of oncology programmes based solely or predominantly on China data, with over 25 applications in development, planned or under review [24].

The reviewers wrote that E5 and E17 "should be used in tandem", that E17 promotes the multiregional trial as the preferred approach, and that ORIENT-11 "is not consistent with the principles outlined in ICH E17" because a single-country trial allows no evaluation of consistency across regions; they also questioned the endpoint and control arm against US practice and the applicability of an all-Chinese population to US patients [24].

On inspection, the same document states that site inspections had been initiated but "cannot fully capture the heterogeneity of data quality and study conduct across numerous clinical sites", and that the ORIENT-11 investigators had had limited interactions with FDA [24]. The lesson for a sponsor is direct: China sites inside an E17 trial with a consistency analysis are the evidentiary design FDA described as preferred, and a China-only study carries the 314.106(b) burden on its own [19][24].

EMA's 2012 reflection paper on trials conducted outside the EU/EEA sets out the ethical and GCP expectations for such data and records that the agency tracks where pivotal-trial patients are recruited [25]. Its 2013 geographic report gives the baseline: from 2005 to 2011 China contributed 8,053 patients in pivotal trials (0.9% of all patients) at 408 sites, and a single 2007 application recruited 45,852 patients in China [26]. The EMA patient/site counts and the 2025 ClinicalTrials.gov share of starts measure different populations and units, so report them as separate historical context. The exceptional 2007 application also needs to be kept separate from the reported aggregate.

Public inspection data are thin on China. FDA's BIMO fiscal-year 2024 metrics give clinical investigator inspections, domestic and foreign combined, as no action indicated 429, 350, 408, 536 and 484 for FY2020 to FY2024, voluntary action indicated 110, 82, 87, 136 and 110, and official action indicated 5, 5, 9, 9 and 15 [27]. The decks carry no country breakdown, so this deck supplies no China-specific inspection denominator; what exists is the 312.120 condition that FDA be able to validate the data on site, which is the standard to build the China sites to [18][27].

A planning sequence with statutory hooks

Takeaway: The HGR filing waits for NMPA approval and lead-site ethics, and the export mechanism has to be in effect before data leave, so the data-flow map, consent language and hosting decision belong in protocol development.

The sequence table lists each step with its statutory hook and prerequisite; the narrative below shows what can run in parallel.

Five stages follow from the texts.

1. Protocol design and vendor selection. Map every clinical, imaging, genomic and biospecimen flow by destination and subject count, because Article 55 of PIPL requires an impact assessment before export [5]. Name the domestic laboratory in the protocol if the filing route is wanted (Rules Article 32) [4]. Draft the Article 39 particulars and separate consent into the master consent form [5].

2. NMPA submission and lead-site ethics. The clinical trial application goes to NMPA while the lead site's ethics committee reviews the protocol and consent form. Article 51 of the Rules makes NMPA approval, notification or record a prerequisite for the HGR filing, and Article 34 opens the filing once the lead site's ethics approval exists [4].

3. HGR filing and site on-boarding. The sponsor or lead institution files jointly with the Chinese party; participating sites then submit their own ethics approval or recognition of the lead site's approval and a commitment letter (Article 34) [4]. Where samples will leave China or the protocol has an exploratory part, an approval application replaces the filing, with a 20 working day decision clock extendable by 10 (Article 41) and ethics review in both countries (Article 31) [4].

4. Export mechanism. In parallel, execute the standard contract with each offshore recipient; export may start only when it is in effect (Article 6), and the contract and PIA report are filed within 10 working days (Article 7) [15]. If the sponsor's cumulative sensitive-data volume will reach 10,000 individuals in the year, the security assessment applies instead, with 5 working days for provincial completeness, 7 for acceptance and 45 for the assessment [6][14].

5. Conduct and close-out. For approved collaborations, Article 47 permits certain quantity changes of at most 10% without an amendment application only with unchanged research content/protocol and written notification; filed trials follow Article 53; HGR information leaving China follows the Article 36 prior report and back-up unless the specific approved/filed collaboration and agreed joint-use exemption applies; the joint report is due within six months after the filing expires (Article 35) [4].

Frequently asked questions

Does the Chinese human genetic resources regime govern standard clinical eCRF and EDC data?

No. Article 2 of the Implementing Rules defines HGR information as gene and genome data and excludes clinical, imaging, protein and metabolic data [4]. Case report form data sit outside the HGR regime and inside PIPL as sensitive personal information, with separate consent and an export mechanism required [5][6].

When does an international clinical trial require HGR approval rather than an HGR filing?

A trial run to obtain drug or device registration in China takes the filing route when samples are collected in the clinical institution and tested there or by a domestic unit designated in the protocol, and no HGR material leaves mainland China (Regulations Article 22; Rules Article 32) [8][4]. Approval is needed where materials are exported, where the trial contains an exploratory research part, or where the research is not a registration trial at all [8][4].

What specific activities constitute an outbound data transfer under the PIPL?

Under PIPL Articles 38 and 39 an export is the provision of personal information to a recipient outside mainland China, and the CAC's published interpretation of the 2024 Provisions counts access from abroad to data still in China as cross-border flow [5][17]. Offshore eCOA services, imaging sent to an overseas reading centre, safety cases sent to a global database and remote monitoring from outside China are all in scope [5][15].

Can an enterprise sponsor host its primary EDC system outside mainland China for a China-inclusive multiregional trial?

None of the cited texts prohibits a global instance for a non-critical-infrastructure sponsor below the security-assessment thresholds. The conditions are separate consent under Articles 29 and 39, an impact assessment under Article 55, and an effective standard contract or certification, or a passed security assessment where sensitive-data volume reaches 10,000 individuals in the year [5][6][15]. Above the thresholds, Article 40 adds domestic storage until the assessment is passed [5].

Can clinical data generated solely from clinical sites in China support marketing approval by the US FDA?

It can, but only under the three 314.106(b) conditions: applicability to the US population and US medical practice, investigators of recognised competence, and data FDA can validate [19]. The 2022 sintilimab briefing shows how FDA applied them to a China-only trial and why it described E17 multiregional trials as the preferred approach [20][24].

Methodology and limitations

Takeaway: Two computed registry lanes, primary Chinese and US/EU legal texts and a literature lane; every headline number is reproducible from the extracts, and the limits are stated once here.

Five inputs were used.

1. ClinicalTrials.gov via AACT, registry snapshot of 25 July 2026 in the AACT export of 1 August 2026 [1]. Interventional drug or biologic trials started 2015-2026; facility country strings define mainland China and the multinational denominator; sponsor headquarters classes come from a curated dictionary of about 230 names and keywords plus a keyword rule, leaving 118 trials (5.5%) unclassified; therapeutic areas are MeSH ancestor branches and can overlap [1].

2. The China Drug Trials public listing captured on 30 July 2026 (35,996 rows, 35,989 unique CTR numbers) and a bounded sample of 1,640 public detail pages captured on 31 July 2026 [11], checked against the CDE annual report for 2024 [2][3].

3. Chinese primary texts: the HGR Regulations as revised in 2024 [8], the Implementing Rules [4], the MOST hand-over notice [9], the NHC filing guide [12], PIPL [5], the CAC Provisions of 2024 [6], the Security Assessment Measures [14], the Standard Contract Measures [15], the Data Security Law [16] and the CAC's published interpretation of the Provisions [17].

4. US and EU acceptance texts: 21 CFR 312.120 and 314.106 [18][19], ICH E17 [20], NMPA Announcements 2019/88 and 2018/52 and the 2015 guidance [21][22][23], the FDA ODAC briefing of February 2022 [24], the EMA reflection paper and geographic report [25][26] and FDA BIMO FY2024 metrics [27].

5. Literature: Europe PMC title and abstract queries run on 12 September 2026 returned 17 records on human genetic resources and China, 112 on multiregional trials and China, 22 on PIPL and 15 on cross-border health data and China [28]; the papers by Song and colleagues [7], Wang and colleagues [10] and Chen and Li [13] were read in full or in abstract.

Limitations. Registry records describe filings and planned designs, not enrolment or conduct, and a listed China facility does not prove that a participant was enrolled there. The sponsor class is name-based. The 1,640-record detail sample was cut short by a capture interruption and is indicative only. The licence counts are a third-party compilation of official postings. The BIMO decks combine domestic and foreign inspections without a country split. Legal texts are cited as of 12 September 2026; free trade zone negative lists and sector catalogues of important data change, and the article is analysis rather than legal advice.

Conclusion

Takeaway: Keep biospecimens and genomic data on the NHC filing route, assess clinical, imaging and safety exports under the applicable PIPL route, and settle both before the protocol is final.

Three conclusions carry the argument.

1. China-inclusive MRCTs were 28.6% of industry multinational starts in 2025, are mostly phase 3, and run US sites 86.4% of the time [1]; their data governance is a global architecture question, and the earlier report on protocol complexity and study build burden shows what the country count already costs in study build.
2. The HGR regime reaches biospecimens and genomic data, and a protocol-designated domestic laboratory can support filing if the full conditions are met and exploratory work is separately assessed [8][4]; case report forms, imaging and safety data are sensitive personal information under PIPL, and the 10,000-sensitive-individual threshold is one trigger, alongside CIIO status, important data and applicable exemptions [5][6].
3. The HGR filing cannot be lodged before NMPA approval and lead-site ethics, and no data may leave before the export mechanism is in effect, so the data-flow map, consent language and hosting choice belong in protocol development [4][15].

EClinCloud describes its offering as one unified clinical evidence platform spanning EDC, RTSM, CTMS, eTMF, eCOA, IRC, RM and eLearning, "Built in China. Ready for studies worldwide.", with private or on-premises deployment and data residency options, and its Trust page lists 21 CFR Part 11, EU Annex 11, ICH E6(R3), ISO 27001, ISO 27701, GDPR, HIPAA and China's DJCP among the standards it works to; the company reports solutions deployed across study sites in the United States, Canada, the United Kingdom, Spain, Georgia, Poland, Pakistan, Puerto Rico, China, Australia and New Zealand [29][30]. These are company statements about scope, not a claim that any study is compliant by using them.

Sources

1. ClinicalTrials.gov via AACT, EClinCloud analysis of the 25 July 2026 registry snapshot (AACT pipe export 1 August 2026): interventional drug/biologic trials started 2015-2026; China-inclusive multiregional cohort, accessed September 2026. Cohort of 2,138 industry-led China-inclusive multiregional trials and comparison groups; figures are EClinCloud computations from the public export.

2. NMPA Center for Drug Evaluation, 《中国新药注册临床试验进展年度报告（2024年）》 (Annual Report on the Progress of Clinical Trials for New Drug Registration in China, 2024), released 19 June 2025, accessed September 2026. Figures quoted from the published excerpt in source 3.

3. China Pharmaceutical News (中国医药报, NMPA-affiliated), 中国新药注册临床试验进展年度报告（2024年）（摘登）, 3 July 2025, accessed September 2026. Chapter 4: 4,900 registrations; 2,539 new-drug; 337 international multicentre (13.3%); 2,201 domestic; 339/4,900 = 6.9%; domestic sponsors 92.8%; 62.2% domestic vs 37.8% foreign participating institutions.

4. Ministry of Science and Technology, 《人类遗传资源管理条例实施细则》 Implementing Rules (MOST Order 21, issued 26 May 2023, in force 1 July 2023), accessed September 2026. Art. 2 (HGR information = gene/genome data; excludes clinical, imaging, protein, metabolic data); Art. 11-12 (foreign-controlled entity ≥50% or control); Art. 27 (collection permit >3,000 large-population study; registration trials exempt); Art. 32 (filing conditions; exploratory research needs approval); Art. 33-34 (no splitting; lead-site ethics; sponsor or lead site files); Art. 35 (report within 6 months after expiry); Art. 36 (prior report + back-up; collaboration agreement exemption); Art. 37 (security review: important families, specific regions, >500 exome/genome cases); Arts. 41-42 (20-working-day decision period, possible 10-day extension and specified review-period exclusions); Art. 47 (for approved collaborations with unchanged protocols, specified minor changes including quantity adjustments of no more than 10% require written submission but no amendment approval); Art. 51 (NMPA approval/notification before filing); Art. 52-53.

5. National People's Congress, 《中华人民共和国个人信息保护法》 Personal Information Protection Law (adopted 20 Aug 2021; in force 1 Nov 2021), accessed September 2026. Art. 4 (anonymised excluded); Art. 28 (sensitive PI incl. 医疗健康); Art. 29 (separate consent); Art. 38 (routes: security assessment, certification, standard contract); Art. 39 (notice + separate consent for export); Art. 40 (CIIO/volume localisation); Art. 41 (foreign judicial/enforcement); Art. 55 (PIA before export).

6. Cyberspace Administration of China, 《促进和规范数据跨境流动规定》 Provisions on Promoting and Regulating Cross-border Data Flows (CAC Order 16, 22 March 2024, in force on publication), accessed September 2026. Art. 2 (important data only if notified/published); Art. 3-5 exemptions (incl. <100,000 non-sensitive PI/year); Art. 6 FTZ negative lists; Art. 7 security assessment (CIIO; important data; ≥1,000,000 PI or ≥10,000 sensitive PI since 1 Jan); Art. 8 SCC/certification (at least 100,000 but fewer than 1,000,000 non-sensitive PI subjects, or fewer than 10,000 sensitive PI subjects, subject to the applicable exemptions); Art. 9 assessment valid 3 years.

7. Song L, Liu Z, Meng F, Statistic tells: the regulatory pendulum of permit trajectories in China's genetic governance (2021-2024). Front Genet. 2025. PMID 40678383, accessed September 2026. Table 1: total permits 5,690/6,900/5,328/2,214 (2021-24); international collaboration 3,661/4,729/3,853/1,871; export 0/1/10/10; Table 2 sponsors ≥1% (BeiGene 4.80%, AstraZeneca 4.03%, Roche 3.82%, MSD 2.89%, Novartis 2.40%, J&J 2.27%).

8. State Council of the PRC, 《中华人民共和国人类遗传资源管理条例》 Regulations on the Management of Human Genetic Resources (Decree 717, 28 May 2019; revised by Decree 777 decision of 10 March 2024), accessed September 2026. Art. 4 (NHC competent); Art. 7; Art. 22 (approval + filing exemption for registration-directed trials without material export); Art. 28 (information provision abroad: security review if may affect public health/national security; filing + back-up); Art. 36 penalties CNY 0.5-5m.

9. Ministry of Science and Technology, 关于人类遗传资源管理工作由科学技术部负责调整为国家卫生健康委员会负责的公告, 25 April 2024, accessed September 2026. From 1 May 2024 NHC responsible; platform apply.hgrg.net unchanged.

10. Wang J, Lan S, Li J, Gao X, Rao Y, Yu J, The evolving role of China in global clinical trials: from late-stage add-on to strategic early inclusion. Drug Discov Today. 2026. PMID 42173306, accessed September 2026. Abstract: first-wave, modular, staged participation pathways; earlier inclusion does not guarantee interpretability or governance compatibility.

11. China Drug Trials (药物临床试验登记与信息公示平台), Public search listing captured 30 July 2026 (35,996 rows / 35,989 unique CTR) and 1,640 public detail pages captured 31 July 2026: EClinCloud analysis, accessed September 2026. Listing counts and a bounded detail sample; EClinCloud computations.

12. National Health Commission, 《中国人类遗传资源国际合作临床试验备案范围和程序》 (filing scope and procedure for international cooperative clinical trials), March 2025 posting, accessed September 2026. Defines HGR materials (cells, whole blood, tissue, semen, CSF, effusions, smears, hair with follicle) and HGR information (gene, genome, transcriptome, epigenome, ctDNA-type nucleic-acid biomarker data plus linked disease/ethnicity data); filing requires prior NMPA CTA approval/notification.

13. Chen J, Li W, Is cross-border transfer of China's human genetic data an impossible mission? Hum Genet. 2025. PMID 40488785, accessed September 2026. Dual character of genetic data (PI under PIPL and HGR under the Regulations) requiring a double review; recent easing in practice.

14. Cyberspace Administration of China, 《数据出境安全评估办法》 Measures for Security Assessment of Outbound Data Transfers (CAC Order 11, 7 July 2022, in force 1 Sep 2022), accessed September 2026. Art. 7 (5 working days provincial completeness; 7 working days acceptance); Art. 12 (45 working days from acceptance, extendable); Art. 9 (contract contents).

15. Cyberspace Administration of China, 《个人信息出境标准合同办法》 Measures on the Standard Contract for Outbound Transfer of Personal Information (CAC Order 13, 22 Feb 2023, in force 1 June 2023), accessed September 2026. Art. 5 PIA before export; Art. 6 export only after contract effective; Art. 7 filing within 10 working days of effectiveness with PIA report; Its Art. 4 thresholds are superseded by source 6 where inconsistent.

16. National People's Congress, 《中华人民共和国数据安全法》 Data Security Law (adopted 10 June 2021; in force 1 Sep 2021), accessed September 2026. Art. 21 (classified/graded protection; important-data catalogues by sector); Art. 31 (important data export measures); Art. 36 (no provision to foreign judicial/law-enforcement bodies without approval).

17. Cyberspace Administration of China, 专家解读｜促进和规范数据跨境流动的重要规定 (expert interpretation of the Provisions on Promoting and Regulating Cross-border Data Flows, published by the CAC), accessed September 2026. Describes cross-border data flow as both transfer abroad and access from abroad to data held in China.

18. US Government Publishing Office via Cornell LII, 21 CFR § 312.120 Foreign clinical studies not conducted under an IND (73 FR 22815, effective 28 April 2008), accessed September 2026. GCP definition; IEC review; informed consent; FDA able to validate by on-site inspection if deemed necessary; supporting information list; records 2 years.

19. US Government Publishing Office via Cornell LII, 21 CFR § 314.106 Foreign data, accessed September 2026. (b) three conditions for approval based solely on foreign data; (c) presubmission meeting encouraged.

20. International Council for Harmonisation, ICH E17 General Principles for Planning and Design of Multi-Regional Clinical Trials (Step 4, 16 November 2017), accessed September 2026. Pre-specified pooling of regions/subpopulations; consistency defined as lack of clinically relevant differences; stratification by region.

21. National Medical Products Administration, 国家药监局关于适用《E1》等15个ICH指导原则的公告 (Announcement No. 88 of 2019, 5 November 2019), accessed September 2026. E5(R1), E5 Q&A and E17 apply from the announcement date.

22. National Medical Products Administration, 国家药品监督管理局关于发布接受药品境外临床试验数据的技术指导原则的通告 (Announcement No. 52 of 2018, 10 July 2018), accessed September 2026. Full / partial / non-acceptance; ICH E5 ethnic-sensitivity analysis of the Chinese subgroup; complete data, no selective submission; conditional acceptance for critical/rare/paediatric.

23. China Food and Drug Administration (now NMPA), 国际多中心药物临床试验指南（试行） (Announcement No. 2 of 2015, 30 January 2015), accessed September 2026. Defines MRCT and regional trials; sample allocation across countries; pre-specified subgroup consistency methods; local-language ICF and CRF-language rule.

24. US Food and Drug Administration, FDA Briefing Document, Oncologic Drugs Advisory Committee Meeting, 10 February 2022, BLA 761222 sintilimab, accessed September 2026. Archived copy of FDA media 156021 (live FDA link no longer resolves). §1.2: >25 China-based applications; 314.106(b) three requirements; E5 and E17 "in tandem"; ORIENT-11 not consistent with E17; single-country foreign data discussion.

25. European Medicines Agency, Reflection paper on ethical and GCP aspects of clinical trials of medicinal products for human use conducted outside of the EU/EEA and submitted in marketing authorisation applications (EMA/121340/2011, final 16 April 2012), accessed September 2026. Listed on EMA's GCP page with the geographic-origin tracking statement.

26. European Medicines Agency, Clinical trials submitted in marketing-authorisation applications to the EMA: overview of patient recruitment and the geographical location of investigator sites (EMA/INS/GCP/676319/2012, 11 December 2013; data 2005-2011), accessed September 2026. China 8,053 patients in pivotal trials 2005-2011 (0.9% of patients); 408 sites; one 2007 application alone recruited 45,852 patients in China.

27. US Food and Drug Administration, Bioresearch Monitoring (BIMO) Fiscal Year 2024 Metrics, accessed September 2026. Clinical investigator inspections final classified FY2020-2024 (domestic + foreign): NAI 429/350/408/536/484; VAI 110/82/87/136/110; OAI 5/5/9/9/15. No country breakdown in the deck.

28. Europe PMC, EClinCloud literature counts, title/abstract-restricted queries run on the Europe PMC REST API, 12 September 2026, accessed September 2026. HGR+China 17 records; MRCT+China 112; PIPL 22; cross-border health data + China 15.

29. EClinCloud, Trust & compliance page, accessed September 2026. Lists 21 CFR Part 11, EU Annex 11, ICH E6(R3), GAMP 5, ISO 27001, ISO 27701, ISO 9001, ISO 20000, ISO/IEC 42001:2023, GDPR, HIPAA, DJCP (China MLPS); "Private / on-premises deployment & data residency options": company statements, not independent findings.

30. EClinCloud, Platform and about pages, accessed September 2026. "One unified clinical evidence platform"; EDC, RTSM, CTMS, eTMF, eCOA, IRC, RM, eLearning; "Built in China. Ready for studies worldwide."; solutions deployed across study sites in US, Canada, UK, Spain, Georgia, Poland, Pakistan, Puerto Rico, China, Australia, New Zealand; HQ Ningbo; 20,000+ users, 300+ organisations, 1,100+ trials, 10+ countries and regions (company claims).