The End of the Device: Decommissioning, Retention and Disposal in Digital Trials
Recovering, wiping, retaining and disposing of trial devices and the data they hold — the lifecycle stage the assessment forgets.
REGULATORY OPERATIONSExport before you wipe, evidence every step per device, and decide in writing what is retained and what is erased — before the devices come back.
Data wiped before export cannot be recovered, and an unevidenced wipe cannot be shown — neither can be repaired after the fact. Write the end-of-life plan into the RIA at the start: the five-step sequence, a custody log keyed to the device identifier, the retention schedule per jurisdiction and per-device vendor evidence.
Export before wipe: five evidenced steps in a fixed order — reversed, the source data is gone and the erasure is unprovable
Devices come back; each one enters the custody log keyed to its device identifier.
Device-held source data and metadata captured into the retained record before anything is wiped.
Personal data outside the essential record erased; the record stays under GDPR Art. 17(3)(b).
Clear, purge or destroy per NIST SP 800-88 Rev. 2, verified against remanence, certified per device.
Reissue, return to lessor, or dispose as WEEE with the battery under the Batteries Regulation — route documented.
Four duties that do not lapse with the last visit
Retention, deletion, wipe and disposal each carry obligations that do not end when the last visit does. "We'll just collect the devices" assumes none of them is binding.
The record is processed under a legal obligation (GDPR Art. 6(1)(c)), so erasure does not apply to it (Art. 17(3)(b)); consent withdrawal does not unwind collected data (CTR Art. 28(3)).
A factory reset that only removes file pointers does not address remanence. Erasure must be evidenced against the device identifier with a recognized method matched to the destination.
A recovered device carries identifiers and residual data until it is verifiably cleared; for an investigational device its return or disposal is itself a record the sponsor keeps.
Five actions that close the lifecycle cleanly
- 1Sequence the end of life — define export-before-wipe as the order and build it into the close-out plan.
- 2Reconcile retain and delete — document the legal basis for retention and the retention schedule, region by region, per data category.
- 3Evidence the wipe — use a recognized sanitization method, verify against remanence, certify per device and qualify the vendor.
- 4Hold the chain of custody — record each step against the device identifier, end to end; for BYOD, record participant confirmation.
- 5Plan it early — feed end-of-life triggers into the Trigger Register and put the plan in the RIA at the outset, not at close.
ICH E6(R3) · CTR Art. 28(3), 58 · MDR Annex XV Ch. III s.3 · 21 CFR 312.57(c), 812.140(d), Part 11 · EMA/INS/GCP/112288/2023 s.6.11–6.12 · GDPR Arts 5, 6(1)(c), 17, 33 · NIST SP 800-88 Rev. 2 · WEEE · Reg. (EU) 2023/1542
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call