# Who can license protocol deviation records? | SourceX

Canonical: https://refer.sourcex.si/questions/who-can-license-protocol-deviation-resolution-records
Last updated: 2026-10-19

Introduce the CEO, who can approve a licensing discussion about company data, with the quality director as sponsor. The quality director knows how deviations were classified and where the gaps are; the head of clinical operations confirms studies, sites and years; general counsel reads sponsor agreements, which often decide who controls trial records. Administrator access to the trial platform is not authority, and whether any record can be licensed stays unknown until SourceX's rights review.

This decision tree is part of the [protocol deviation resolution guide](/guides/workflow-protocol-deviation-resolution), which covers what to inventory before a research system migration. It answers one narrower question: at a contract research organization or research site network, who can say yes?

## Four roles that know the records, and what each can tell you

Each of these people can describe deviation records. None of them is automatically the person to introduce.

- **Quality director or head of quality assurance.** Owns the deviation and CAPA procedures, knows which studies have clean version links, and is the natural sponsor of the idea inside the company.
- **Head of clinical operations.** Knows which studies, sites and years exist, and usually runs any trial platform migration.
- **General counsel or contracts lead.** Reads the sponsor master services agreements, study contracts and any data clauses.
- **CEO.** Holds the decision to explore licensing company data at all, and signs.

The partner's goal is to leave the first conversation with one name for the last role and a list of the branches that need extra review.

## The tree: five questions to ask the quality director

1. **Which record classes are we talking about?** Deviation logs, CAPAs and monitoring reports for sponsor studies are one class; the company's own procedures, training files, internal audits and anonymized process metrics are another. Note both.
2. **Whose studies generated them?** If sponsor studies, sponsor agreements become a review item for counsel. If internal or investigator-initiated work, the path is shorter.
3. **What did sponsors transfer to the company in writing?** Under 21 CFR 312.52, a sponsor may transfer any or all of its obligations to a contract research organization, but the transfer must be described in writing, and anything not covered is treated as not transferred. Those documents show which responsibilities the company took on; they do not by themselves settle who controls the records, so counsel reads them alongside the study contracts.
4. **Who signs contracts about company data?** The CEO; at an owner-managed business, usually the owner. This person is the introduction. A [fractional CFO](/questions/can-fractional-cfo-sign-contracts-behalf-company) can prepare the case but does not sign in the CEO's place.
5. **Is anything changing who decides?** A sale, merger, wind-down or ownership change can move decision rights to a buyer, board or trustee; the [board resolution clauses for data assets](/resources/board-resolution-to-wind-down-company) show one version.

## Record classes and who usually controls them

The evidence asset for this page: each record class a CRO typically holds, who is likely to control it, and the sign-off that would matter before licensing. "Likely" is deliberate; contracts decide.

| Record class | Likely controller | Sign-off to expect | Notes for the partner |
|---|---|---|---|
| Deviation logs for sponsor studies | Sponsor, under the study contract | Counsel; possibly the sponsor | Note how many sponsors and studies, not their names |
| CAPAs arising from site deviations | Often shared between sponsor and company | Counsel | CAPAs about the company's own processes may be its own |
| Monitoring visit reports | Sponsor, usually | Counsel; possibly the sponsor | Prepared under the sponsor's monitoring plan |
| Standard operating procedures and training records | The company | CEO | Often the clearest class |
| Internal audits and quality metrics | The company | CEO, with the quality director | Process metrics may be anonymized already |
| Participant-level detail in any class | Subject to privacy rules and consents | Privacy lead and counsel | Handled in SourceX's review, never at introduction |

The split matters most at a CRO, where a sponsor's trial data and the company's own operating records sit side by side in the same quality system. [Why data rights matter](/proof/why-data-rights-matter) sets out the principle.

## Branches that need legal, sponsor or privacy sign-off

**Sponsor agreements.** The first document counsel reads. Many state who owns trial records and what may be reused; some say nothing about AI training at all, which is itself a question for review.

**Participant information.** Deviation records usually carry participant study IDs and visit dates, sometimes clinical detail. HHS describes two methods that can satisfy the HIPAA Privacy Rule's de-identification standard, Expert Determination and Safe Harbor; the [HIPAA expert determination process](/guides/hipaa-expert-determination-process) explains the first. Which applies, if any, is decided in SourceX's review.

**Seriousness of the deviations.** ICH E6(R3), final FDA guidance since September 2025, describes important deviations as those that may significantly affect data reliability or participant rights, safety or well-being. Records about important deviations may draw closer scrutiny from sponsors and counsel. That is a review point, not a reason to stop.

This is general information, not legal advice. The [decision-maker discovery questions](/resources/decision-maker-discovery-questions) help find the signer if the quality director is unsure.

## Two companies, two paths (Illustrative)

Both companies are fictional and written for this page.

| Question | 280-person site network | 650-person full-service CRO |
|---|---|---|
| Main record classes | Site deviation logs, own SOPs and training | Sponsor deviation logs, CAPAs, monitoring reports, own audits |
| Whose studies? | Several sponsors, mostly small | About 40 sponsors |
| Written transfers | Few; sites mostly follow sponsor procedures | Many study-level transfers of monitoring and data management |
| Person introduced | CEO, the founder | CEO, with the quality director as sponsor |
| Extra review | Sponsor contracts for site logs | Counsel on sponsor agreements, privacy lead on participant data |

The tree ends at the CEO in both cases. The difference is how many side branches the full-service CRO carries into review.

## What stays unknown until SourceX's rights review

The partner identifies the executive and lists the branches. SourceX's rights review decides which record classes the company can license, what de-identification is needed, whether sponsor consent is required, buyer interest and any offer. SourceX licenses approved business data directly from companies for AI training and evaluation, and manages the agreement, rights review, data preparation, delivery and payout. The [worked exception example](/guides/protocol-deviation-resolution-exception-examples) shows what the records look like, and the [referral brief template](/resources/protocol-deviation-resolution-referral-brief-template) puts the named executive into the handoff.

For SourceX, an introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. Partners sign the Channel Partner Agreement before submitting; the first valid introduction within the 90-day window is credited when the company submits a verified application.

## Next step

> **Refer a company. Earn up to $100,000.** Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

Once the tree points to a named executive and the sponsor and privacy branches are noted, [register as a partner](/register), check the company on [who qualifies](/who-qualifies) and read the [program terms](/terms) before you introduce the executive, with the quality director as sponsor.

## Sources

- https://www.ecfr.gov/current/title-21/chapter-I/subchapter-D/part-312/subpart-D/section-312.52
- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/e6r3-good-clinical-practice-gcp
- https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html
- https://refer.sourcex.si/terms