Ga verder naar contentGa verder naar content en skip ook inhoudsopgave
NDFR
Home

Commission Implementing Regulation (EU) 2025/1467 of 18 July 2025 laying down rules for the application of Regulation (EU) 2024/1938 of the European Parliament and of the Council as regards the technical specifications for the EU SoHO Platform to exchange information concerning substances of human origin intended for human application

Commission Implementing Regulation (EU) 2025/1467 of 18 July 2025 laying down rules for the application of Regulation (EU) 2024/1938 of the European Parliament and of the Council as regards the technical specifications for the EU SoHO Platform to exchange information concerning substances of human origin intended for human application

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2024/1938 of the European Parliament and of the Council of 13 June 2024 on standards of quality and safety for substances of human origin intended for human application and repealing Directives 2002/98/EC and 2004/23/EC(1), and in particular Article 74(4), first subparagraph, thereof,

Whereas:

  1. Regulation (EU) 2024/1938 requires the Commission to establish, manage and maintain a digital platform to facilitate efficient and effective exchange of information concerning substances of human origin (SoHO) activities in the Union (the ‘EU SoHO Platform’).

  2. Regulation (EU) 2024/1938 provides for the processing of personal data, including data concerning health, exchanged through the EU SoHO Platform, where necessary, in the interest of public health and for the purposes of helping to identify, evaluate and manage risks associated with a particular SoHO donation or SoHO donor, including pseudonymised donor identification in the case of rapid alerts, and for the processing of relevant information on clinical-outcome monitoring, including pseudonymised clinical data provided in support of SoHO preparation authorisations.

  3. As sensitive personal data, including data concerning health, may be exchanged through the EU SoHO Platform, the Platform should provide a secure channel for restricted exchange of information and data.

  4. Personal data should be stored on the EU SoHO Platform for a limited period. As some diseases can have a long incubation time and may cause symptoms after 25 to 30 years (e.g. Creutzfeldt–Jakob disease), it is necessary to apply a retention period of 30 years after donation or human application for personal data related to the safety, quality and effectiveness of SoHO.

  5. In order to ensure good administration and sufficient transparency of SoHO supervisory activities and SoHO activities, the personal data of authorised actors should be retained for up to 5 years from the date that they no longer operate as authorised actors.

  6. To ensure the ability to verify whether the SoHO Coordination Board acted in an independent and impartial manner, including in the event of complaints or litigation, the personal data of the SoHO Coordination Board members and alternates should be retained for up to 15 years from the date on which the member or alternate no longer participates in the SoHO Coordination Board.

  7. In order to ensure the safety and security of personal data processed through the EU SoHO Platform, the Commission should put in place and keep up to date state-of-the-art technical and organisational measures, including data access control.

  8. In order to facilitate efficient and effective exchange of information concerning SoHO activities in the Union through the EU SoHO Platform, its user interface should be provided in English as the commonly understood language in the field of SoHO. SoHO entities, SoHO competent authorities, Member States, the SoHO Coordination Board and the Commission should exchange information of cross-border interest through the EU SoHO Platform in that commonly understood language in the field of SoHO.

  9. As Regulation (EU) 2024/1938 applies from 7 August 2027, the application of this act should commence on the same date.

  10. The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council(2) and delivered an opinion on 3 June 2025.

  11. The measures provided for in this Regulation are in accordance with the opinion of the Committee established by Article 79(1) of Regulation (EU) 2024/1938,

HAS ADOPTED THIS REGULATION:

Article 1 Definitions

For the purpose of this Regulation, the following definitions shall apply:

  1. ‘actor’ means a natural person who registers a SoHO entity on the EU SoHO Platform after authentication;

  2. ‘authorised actor’ means a natural person who, after authentication, has been granted access to the EU SoHO Platform to perform actions in accordance with the access rights assigned to the person’s profile and who acts on behalf of a Member State, a SoHO national authority, a SoHO competent authority, the SoHO Coordination Board, a SoHO entity, the Commission, the European Centre for Disease Prevention and Control (ECDC) or the European Directorate for the Quality of Medicines & HealthCare (EDQM);

  3. ‘local administrator’ means an authorised actor who has the right to grant access to the EU SoHO Platform to other actors or authorised actors within the same Member State, SoHO national authority, SoHO competent authority or SoHO entity.

Article 2 Maintenance and use of the EU SoHO Platform

1.

The Commission shall maintain and optimise the EU SoHO Platform to carry out the tasks referred to in Article 73 of Regulation (EU) 2024/1938.

2.

Actors and authorised actors shall use the platform to comply with the requirements laid down in Articles 4(2), 5(5), 9(4), 16, 17(2), (5) to (7), 19(1), (3) and (10), 21(4) and (5), 25(1), (2) and (6), 27(7), 31 to 35, 37(2), 41(2) and (4), 54(3), 56(4), 63(3) point (e), 64(3), 65(3), 68(3) and (4), 69(1), 71 to 74, 76, 81, 82 and 86 of Regulation (EU) 2024/1938.

Article 3 Accessibility, modules and functionalities of the EU SoHO Platform

1.

The EU SoHO Platform shall be accessible via a dedicated website.

2.

The EU SoHO Platform shall provide at least the modules and functionalities listed in Annex I.

Article 4 Access of actors, authorised actors and local administrators

1.

The access of actors to the EU SoHO Platform shall be controlled via an authentication tool.

The access of authorised actors to the EU SoHO Platform shall be controlled via an authentication tool and an authorisation tool.

The authentication tool and the authorisation tool shall ensure that actors and authorised actors have the appropriate access rights for the EU SoHO Platform and the proper permissions to perform actions on the EU SoHO Platform.

Following authentication, actors shall have access to the registration module of the EU SoHO Platform for the registration of a SoHO entity.

2.

The Commission shall be responsible for granting, suspending or revoking the access rights of local administrators for the EU SoHO Platform.

3.

Local administrators shall manage the access rights of actors and authorised actors for the EU SoHO Platform by granting, suspending or revoking those access rights.

4.

Member States shall define the appropriate level of access of authorised actors acting on their behalf for the EU SoHO Platform in accordance with national law.

Article 5 Access of the general public

Article 6 Responsibilities for recording and verifying the accuracy of information exchanged through the EU SoHO Platform

Article 7 Data submission

Article 8 Protection of personal data

Article 9 Safety and security of personal data

Article 10 Technical and administrative support

Article 11 Contingency arrangements in case of prolonged failure or unavailability of the EU SoHO Platform

Article 12 Information technology security

Article 13 Language requirements

Article 14 Entry into force and application

ANNEX IMODULES AND FUNCTIONALITIES

ANNEX IICATEGORIES OF PERSONAL DATA TO BE PROCESSED AND THEIR RETENTION PERIODS