Last month, the EMA issued a common masking policy. This document was delivered as an outcome of an EV audit performed by the European Data Protection Supervisor (EDPS), that should be complied with by all entities reporting to EudraVigilance (including MAHs).
The ‘Guideline on good pharmacovigilance practices (GVP) Module VI Addendum II – Masking of personal data in individual case safety reports submitted to EudraVigilance’ was issued on 25 Jul 2025 and provides instructions to complement Section VI.C.6.2.2.10. on data protection laws and aimed at enhancing data privacy in pharmacovigilance. These instructions form an integral part of the guidance in GVP Module VI.
The guidance defines clear expectations for data redaction in Individual Case Safety Reports (ICSRs) submitted to EudraVigilance. The guidance confirms the ICH-E2B(R3) data elements to be masked and to be left blank when reporting cases to the EMA.
Which data elements must ALWAYS be masked in ICSRs?
Reporter’s personal details such as;
Reporter’s Title
Reporter’s Given Name/Middle Name/Family Name,
Reporter’s Organization / Reporter’s Department,
Reporter’s Street / Reporter’s Post code,
Reporter’s Telephone.
Patient identifiers such as:
Patient Medical Record Number(s)
GP Medical Record Number,
Specialist Record Number
Hospital Record Number)
and parent identification.
Which Data Elements must be left blank?
The following 11 data elements must be left blank:
Sender’s personal details and address:
Sender’s Title
Sender’s Given Name /Middle Name/Family Name
Senders Street Address, City, State/ Province/ Postcode/ Country Code,
Sender’s Telephone/ Fax.
MAHs should implement the instructions in this document as soon as possible and within a reasonable timeframe. Such timeframe should be documented as part of the MAHs internal procedures to demonstrate when and how this will be achieved.
Link to the new Addendum here GVP Module VI Addendum II – Masking of personal data in ICSRs for EudraVigilance
