EMA Guidance: Good Pharmacovigilance Practices (GVP) — Introductory cover note with new Addendum II and GVP Module VI Addendum II – Masking of Personal Data

Sharan Murugan
Jul 27
3 min read

The European Medicines Agency (EMA) continuously updates its Good Pharmacovigilance Practices (GVP) guidelines to enhance patient privacy and the quality of safety data, most recently with a focus on masking personal data in Individual Case Safety Reports (ICSRs) submitted to EudraVigilance as of July 2025.

1. Introductory Cover Note on GVP

The Introductory Cover Note provides a contextual background and summary for the entire GVP framework, highlighting recent updates including the new Addendum II to Module VI focused on masking personal data in ICSRs submitted to EudraVigilance.
It outlines the development history of GVP guidelines, their objectives in pharmacovigilance, relevant legal bases, and the roles of different stakeholders in the EU pharmacovigilance system.
Explains the scope of GVP — covering all phases from detection, assessment, and prevention of adverse reactions.
References the modular structure of GVP documents and their interrelation with EU pharmacovigilance legislation.
Advises on public consultation practices and ongoing improvements to pharmacovigilance quality and data privacy.

Key Highlights

Emphasizes patient safety balanced with compliance to GDPR and confidentiality in adverse event reporting.
Details the integration of Addendum II addressing the specific requirements to mask personal identifiable information in ICSRs.
Reinforces the legal basis from EU legislation governing pharmacovigilance activities (Regulation (EU) No 536/2014, Directive 2001/83/EC, etc.).
Discusses the roles of EMA, national competent authorities, marketing authorisation holders, and other actors.

2. GVP Module VI Addendum II – Masking of Personal Data in ICSRs

Purpose

Provides detailed guidance on when and how to mask (withhold or anonymize) personal identifiable data in Individual Case Safety Reports (ICSRs) submitted to the EU's EudraVigilance system.
Designed to protect patient and reporter privacy while ensuring pharmacovigilance processes like signal detection and risk management are not compromised.

Scope

Applies to all entities submitting ICSRs—including marketing authorization holders, healthcare professionals, and regulators.
Particularly important for data submitted from non-EU sources or where additional privacy protections are mandated.
Focuses on the data format defined by the internationally harmonized ICH-E2B(R3) standard for ICSRs.

Key Sections and Guidance

Section	Summary
VI.Add.II.1 Introduction	Explains rationale for masking and links to GDPR and pharmacovigilance compliance.
VI.Add.II.2 Purposes	Clarifies that personal data processing is exclusively for pharmacovigilance purposes.
VI.Add.II.3 Data elements to mask	Specifies strictly which ICH-E2B(R3) data elements should always be masked (e.g., names, exact dates, contact details).
VI.Add.II.4 Data elements to leave blank	Identifies elements that must not contain personal data and should be left blank if no appropriate value exists.
VI.Add.II.5 Data elements that may contain personal data but are required	Defines elements that may contain personal data but are essential for safety monitoring and should be carefully reviewed before masking.
VI.Add.II.6 Non-Personal Data Elements	Details elements that do not contain personal data but must be present to ensure effective pharmacovigilance.

Masking Principles and Techniques

Masking involves removal, anonymization, or replacement with codes where direct identifiers exist.
Must preserve information necessary for public health and regulatory purposes.
Masking decisions must be documented and consistently applied in reporting systems.
Data fields strictly forbidden to contain personal data must remain blank instead of being filled with placeholders.

Both documents together form a comprehensive update to the EMA's GVP framework addressing the critical balance between protecting personal data privacy and maintaining the utility of pharmacovigilance data. The Introductory Cover Note sets the scene and legal background, while Addendum II to GVP Module VI gives explicit technical and procedural guidance on personal data masking for ICSRs.

For complete details, read the original EMA documents (updated 24 July 2025):