What is a Safety Data Exchange Agreement (SDEA)?

Introduction

Modern pharmacovigilance systems depend heavily upon collaboration.

Medicinal products are frequently developed, licensed, marketed and supported through relationships involving:

• Marketing Authorisation Holders
• Distributors
• Licensing partners
• Co-marketing partners
• Contract Research Organisations (CROs)
• Pharmacovigilance service providers
• Technology vendors

When multiple organisations participate in activities affecting pharmacovigilance, responsibilities must be clearly defined.

Without clear responsibilities, important safety information may:

• Be delayed
• Be duplicated
• Be lost
• Be reported incorrectly
• Fail to reach the appropriate party

Safety Data Exchange Agreements exist to reduce these risks.

What Is an SDEA?

A Safety Data Exchange Agreement (SDEA) is a formal document that defines how pharmacovigilance and safety information will be exchanged between organisations.

The agreement typically describes:

• Roles and responsibilities
• Safety reporting obligations
• Data exchange requirements
• Timelines
• Escalation procedures
• Reconciliation activities
• Compliance expectations

A useful way to think about an SDEA is:

An SDEA defines who is responsible for what, when, and how regarding safety information.

The agreement helps ensure that all parties understand their obligations.

Why SDEAs Exist

Pharmacovigilance systems often involve multiple organisations.

Consider a licensing arrangement.

One company may hold the marketing authorisation.

Another company may market the product.

A third party may process safety reports.

Without clear agreements, questions arise.

Examples include:

• Who receives adverse event reports?
• Who submits expedited reports?
• Who performs literature surveillance?
• Who maintains signal detection activities?
• Who communicates emerging safety concerns?

An SDEA helps answer these questions before problems occur.

The Regulatory Perspective

Regulators expect organisations to maintain control of pharmacovigilance responsibilities. When activities are distributed across entities, those obligations must remain demonstrably clear. Inspectors will evaluate whether:

• Roles and accountabilities are explicit and mapped to operations.
• Reporting pathways enable compliance with applicable timelines and formats.
• Oversight and governance mechanisms ensure effective performance.
• Records demonstrate implementation and continual control.

Key regulatory sources include EMA GVP Modules (I, II, III), Directive 2001/83/EC and implementing regulations, ICH E2 series (including E2A, E2D, E2B formats), and local legislation. SDEAs should reference applicable regional obligations and be drafted to support compliance across the territories covered.

Common Situations Requiring an SDEA

SDEAs are needed in many contexts, for example:

• Licensing Agreements
• Co-Marketing Arrangements
• Distribution Agreements
• Pharmacovigilance Service Provider arrangements
• Contract Research Organisations conducting studies
• Business partnerships and joint ventures

Across these situations, the need for clarity and traceability is constant.

What Problems Do SDEAs Solve?

SDEAs primarily reduce ambiguity and operational risk, preventing:

• Reporting delays due to unclear responsibilities
• Duplicate reporting from overlapping obligations
• Missing information due to inadequate exchanges
• Escalation failures for significant safety concerns
• Inspection findings related to governance and implementation gaps

Typical Components of an SDEA

Most robust SDEAs include the following elements:

• Scope (products, territories, activities)
• Roles and responsibilities (who does what and who remains accountable)
• Reporting timelines and regulatory references
• Data exchange requirements (formats, transport mechanisms, minimum data)
• Escalation procedures (who to contact, thresholds, timelines)
• Case processing rules (initial assessment, seriousness, causality assignment)
• Reconciliation requirements (frequency, matching fields, dispute resolution)
• Audit and inspection rights
• Change control and amendment procedures
• Training and qualification expectations
• Confidentiality and data protection
• Record retention and archiving
• Business continuity and contingency arrangements
• Liability, indemnity and termination clauses
• Governance and performance indicators (KPIs)

The SDEA should be consistent with the PSMF, SOPs, and operational practice.

The Most Important Principle

Clarity is paramount. An agreement must reflect operational reality and be used as an active governance tool rather than a static contract. Inspectors will expect to see evidence that the SDEA directs everyday activities and that deviations are addressed via governance and CAPA.

SDEAs and Accountability

An SDEA can allocate responsibilities operationally but cannot remove legal obligations. The Marketing Authorisation Holder (MAH) typically retains ultimate responsibility for pharmacovigilance compliance in the territories where it holds authorisation. This principle should be stated explicitly and implemented through governance, oversight and documented delegation.

SDEAs and Vendor Oversight

An SDEA is one element of vendor governance. Effective oversight requires:

• Regular governance meetings with documented minutes
• Agreed KPIs and SLA metrics and trend monitoring
• Periodic audits and follow-up of CAPA completion
• Reconciliation reports and resolution of discrepancies
• Training records for vendor staff processing safety data
• Evidence of regulatory reporting and submission artifacts

Inspectors expect oversight artifacts and performance data mapped back to the SDEA.

SDEAs and the PSMF

The Pharmacovigilance System Master File (PSMF) must accurately reflect the pharmacovigilance system, including outsourced activities and SDEAs. Inspectors commonly correlate PSMF content with SDEAs, SOPs and operational records; inconsistencies suggest governance weaknesses.

How Inspectors Review SDEAs

Inspectors assess agreements in context:

• They compare SDEA clauses against SOPs, case records, governance minutes, reconciliation outputs, KPI reports, and submission evidence.
• They test whether the operational practice aligns with contractual obligations.
• They review version control, review history and training tied to SDEA requirements.
• They request tangible artifacts demonstrating execution: case examples, submission receipts (e.g., EudraVigilance acknowledgement), reconciliation logs, audit reports and CAPA evidence.

The goal is to verify control, not merely the existence of paperwork.

Common SDEA Inspection Findings

Frequent findings include:

• Missing or incomplete agreements
• Agreements that are outdated or not aligned with current operations
• Ambiguous or overlapping responsibilities
• Inconsistent timelines between documents and practice
• Weak reconciliation and discrepancy resolution
• Poor implementation despite a formal agreement

Most findings point to governance and oversight shortcomings rather than contractual language alone.

Characteristics of a Strong SDEA

Strong SDEAs are:

• Clear: simple, unambiguous assignment of responsibilities
• Complete: cover all relevant activities and scenarios
• Consistent: align with SOPs, PSMF, and regulatory requirements
• Maintainable: version-controlled and periodically reviewed
• Operationally relevant: reflect actual processes and are actively used
• Inspection-ready: accompanied by artifacts demonstrating implementation

The QPPV Perspective

QPPVs rely on SDEAs for visibility of distributed responsibilities and risk management. A structured approach to review includes verifying contractual terms, governance evidence, reconciliation outputs, KPIs and audit trails to demonstrate that delegated activities meet regulatory expectations.

For additional information see: [[psmf-qppv-oversight]]

Inspection-ready SDEA Checklist

The following checklist is written for organisations preparing for pharmacovigilance inspection or internal review. It lists documentary and operational evidence inspectors typically request and that an organisation should maintain in an inspection-ready state. Organise documents for rapid retrieval and ensure version control and cross-references are clear.

Note: adapt the checklist to the specific regulatory jurisdiction(s) and the product lifecycle stage.

1. Agreement documentation
2. Fully executed SDEA (PDF with signatures), including version number, effective date, renewal/expiry date.
3. Amendment history and change control log (who approved what and why).
4. Distribution list and contact details (names, roles, escalation contacts).
5. Scope and mapping
6. Product/indication list and covered territories explicitly listed.
7. Activities mapping (see sample mapping table below) showing which party performs and which party is accountable.
8. PSMF section referencing the SDEA and describing outsourced activities.
9. Regulatory references and timelines
10. SDEA clause listing applicable regulatory requirements by territory (e.g., EMA GVP, national guidance, ICH E2 series).
11. Operational timelines aligned to regulatory requirements and internal SOPs; evidence of compliance (timestamped entries, submission receipts).
12. Data exchange and IT evidence
13. Technical specification document: data formats (e.g., ICH E2B(R3) XML mapping), transmission methods (secure FTP, gateway, portal), and validation tests.
14. Test logs and validation evidence for data transfers.
15. Sample transmission logs and receipts (e.g., EudraVigilance acknowledgements, FDA correspondence).
16. Case processing evidence
17. Sample ICSRs with audit trail demonstrating receipt time, database entry time, assessment, follow-up, and regulatory submission.
18. Records of initial serious/unexpected assessments and causality determinations.
19. Reconciliation and metrics
20. Reconciliation SOP and latest reconciliation reports (case matching, discrepancies, resolutions).
21. KPI metric reports and trend analyses (timeliness, completeness, duplicate rate).
22. Evidence of governance meetings where KPIs were reviewed (minutes, actions, owners, deadlines).
23. Escalation and signal management
24. Escalation matrix (contacts, thresholds, timelines) and sample escalations.
25. Signal meeting minutes, logs showing escalation to MAH/QPPV when required.
26. Audit and oversight
27. Audit reports of the vendor and internal follow-up/CAPA tracking and closure evidence.
28. Vendor qualification documents, training records for vendor personnel performing PV tasks.
29. Training and SOPs
30. Copies of SOPs referenced by the SDEA and training logs demonstrating staff awareness and competence.
31. Business continuity and breach management
    • Business continuity plans, contingency arrangements for safety data processing failures.
    • Breach/incident logs with root cause analysis and CAPA.
32. Confidentiality and data protection
    • Data protection clauses and evidence of compliance with GDPR or other local privacy laws (Data Processing Agreement, DPIA if applicable).
33. Legal and financial
    • Audit-rights confirmation in the SDEA and evidence of exercising those rights if audits occurred.
    • Liability and indemnity clauses and documentation of any disputes or claims.
34. Inspection pack assembly
    • A single indexed inspection pack or binder cross-referencing PSMF sections, SOPs, the SDEA and operational evidence.
    • A cover sheet summarising contractual responsibilities and a one-page process map showing information flows for the product(s) under the SDEA.

Inspection relevance: For each item, have a traceable path from the clause in the SDEA to the SOP and to an executed case or report. Inspectors expect to see "paper to practice" linkage.

Sample SDEA Template

Below is a comprehensive, inspection-focused SDEA template intended for practical use. It includes headings and suggested clause language to support operationalisation, auditing and inspection. Replace bracketed placeholders with company-specific details.

Note: This template is illustrative. Legal review is required before execution. It is presented here to demonstrate the depth of content inspectors expect.

Title: Safety Data Exchange Agreement (SDEA) Version: [vX.Y] Effective date: [YYYY-MM-DD] Parties: [MAH] and [Partner/Vendor/Distributor/CRO] Products and indications: [List products/brand/generic names, indications] Territories: [List covered countries/regions] Term and termination - Effective date and expiry - Renewal process - Termination for convenience and for cause - Transition obligations on termination (data transfer, case ownership) Definitions - Define key terms: ICSR, SAE, SUSAR, MAH, PV Database, E2B(R3), Serious, Unexpected, etc. Scope - Activities covered (e.g., case intake, data entry, medical review, expedited reporting, literature screening, aggregate reporting, signal detection) Roles and responsibilities - Detailed mapping (see sample mapping table below) - Statement of MAH ultimate responsibility Reporting obligations and timelines - Reference applicable regulations per territory - Operational timelines for internal handoffs and regulatory submissions Data exchange specifications - Required minimum data elements for case transfer - Data format (E2B(R3) XML preferred where applicable) and version - Transmission methods (secure portal, SFTP, API, manual forms) and proof of delivery - File naming conventions and validation rules Escalation and communication - Escalation matrix by issue type and severity with timelines - Routine communications: governance meetings, frequency, attendees, agenda templates Reconciliation - Reconciliation scope (cases, submissions, literature findings) - Frequency (e.g., monthly), matching fields, thresholds for discrepancies - Dispute resolution procedure and timeline to close discrepancies Audit, inspection and access rights - Right to audit (frequency, notice periods, remote/on-site) - Cooperation during regulatory inspections and access to records Quality and oversight - KPIs and SLAs (timeliness, completeness, duplicate reporting rates, reconciliation metrics) - Root cause analysis and CAPA expectations Change control and amendments - Amendment process (change request, impact assessment, approval) - Regulatory-driven changes (e.g., new law) and implementation timelines Training and personnel - Training requirements and qualification records to be maintained - Access controls and segregation of duties Confidentiality and data protection - Confidentiality clauses - Data Processing Agreement (if personal data processed) and compliance with GDPR/local law Record retention and archiving - Retention periods per territory (e.g., per regulation or longer if required) Business continuity and disaster recovery - Minimum recovery time objectives and contingency arrangements for processing safety data Subcontracting - Restrictions and approval process for subcontractors Liability and indemnity - Liability caps, indemnity clauses, insurance requirements Performance management - KPI definitions, reporting frequency, remediation plan for missed targets Dispute resolution - Governing law, escalation path, mediation/arbitration clauses Signatures - Name, title, date for authorised signatories on both parties

Appendices A. Contact details and escalation matrix (operational and executive) B. Data transfer specification and example E2B(R3) mapping C. SOP cross-reference table (SDEA clause → SOP ID) D. Reconciliation template and discrepancy log format E. KPI definitions and sample report layout F. Sample case transfer form (if manual transfer required)

Sample Mapping Table: Activities to Accountable Parties and Timelines

The table below is a worked example mapping common pharmacovigilance activities to the accountable party and suggested operational timelines. Final timelines must be aligned with applicable regulatory requirements and internal SOPs. Use this table as a starting point to create the activity matrix in your SDEA and PSMF.

Notes: - "Accountable" denotes the party legally responsible or ultimately owning compliance for the activity. - "Performing party" may be a delegate; the SDEA must specify delegation and the MAH must ensure adequate oversight. - Tailor regulatory timelines to the territories covered; include explicit references to the applicable statutes/regulations in the SDEA.

Practical Implementation Details

This section outlines pragmatic steps to implement an SDEA and operationalise the mapping table and governance clauses so the arrangement is demonstrably compliant and inspection-ready.

1. Contract development and alignment
2. Draft the SDEA with input from PV, legal, IT, QA, business owners and the QPPV.
3. Include PSMF and SOP references; map each SDEA activity to an SOP.

4. Ensure the SDEA cites specific regulatory frameworks applicable to each territory.

5. Operationalisation

6. Create an activity matrix (the mapping table) and include it as an appendix to the SDEA.
7. Produce SOPs or work instructions reflecting the SDEA operational timelines and handoffs.

8. Configure the PV database and interfaces according to the Data Transfer Specification and validate transfers (test cycles and production cutover).

9. Governance and oversight

10. Establish a governance cadence: monthly operational reviews, quarterly business reviews, and annual contract reviews.
11. Define KPIs, thresholds and escalation triggers (e.g., >5% missed timeliness incidents triggers root cause analysis).

12. Record meeting minutes, assigned actions, owners and closure dates in a governance tracker.

13. Reconciliation process

14. Agree reconciliation fields (case ID, suspect drug, reaction, reporting source, date of receipt, regulatory submission status).
15. Use a standard reconciliation template with version control.
16. Perform reconciliations at least monthly (more frequent for high volume or risk products).

17. Maintain a discrepancy log that records investigation, root cause, remediation and closure.

18. Audit and inspection preparation

19. Maintain an inspection pack aligned to the checklist above.
20. Conduct periodic readiness exercises and mock inspections focusing on SDEA fulfilment.

21. For each SDEA clause, maintain at least one operational artifact showing how the clause is implemented.

22. Change control and continuous improvement

23. Treat SDEA amendments like regulated change: impact assessment, approval and update of related SOPs and PSMF.

24. Track regulatory changes and proactively update SDEA timelines and procedures.

25. Training and competence

26. Maintain training matrices for MAH and vendor staff on SDEA obligations, SOPs and systems.

27. Record training and competency assessments; include records in inspection pack.

28. Data protection and privacy

29. Execute a Data Processing Agreement where personal data is processed.
30. Implement technical and organisational controls to secure transmissions and storage.

31. Ensure logs of access and transfers are maintained for inspection.

32. Incident management and breach response

33. Define incident severity levels and required notifications.
34. Include contractual timelines for notification of breaches to the MAH and regulators if required.
35. Keep incident reports, root cause analyses, and CAPA records accessible.

Governance Discussion: Roles, Oversight and the QPPV

Governance should be tiered and transparent:

• Executive Sponsor: senior leader with contract authority; responsible for escalation of material issues.
• QPPV: maintains oversight of pharmacovigilance compliance; reviews SDEA performance and governance outputs and certifies compliance where required.
• PV Governance Board: representatives from MAH PV, legal, QA, commercial and vendor leadership; reviews KPIs, audit results and high-risk issues.
• Operational Owners: PV operations, clinical, medical safety, regulatory and IT teams responsible for day-to-day performance.

Key governance tasks: - Confirm that the SDEA accurately reflects delegation and non-delegable responsibilities. - Review reconciliation outputs and unresolved discrepancies. - Approve CAPAs and ensure timely completion. - Ensure inspection readiness: maintain the inspection pack, prepare spokespeople, and rehearse likely inspector requests.

Inspection relevance: Inspectors will look for evidence of active governance — meeting minutes, actions assigned and closed, trend analyses and demonstration that the QPPV and MAH can intervene when vendor performance jeopardises compliance.

Inspection Scenarios and Evidence Examples

Inspectors commonly test scenarios such as:

• Show me an example of a serious unexpected ICSR and all records demonstrating receipt, assessment, transfer, submission and follow-up. Evidence: timestamped database entries, email escalations, submission receipts.
• Show the reconciliation between vendor and MAH for the last three months and unresolved discrepancies. Evidence: reconciliation reports, discrepancy logs with root cause and CAPA.
• Provide evidence that the SDEA is current and matches operations. Evidence: signed SDEA, SOP cross-reference table, minutes from governance meetings confirming operational processes.
• Demonstrate audit history and response to findings. Evidence: audit report, corrective action plan, evidence of closure.
• Show how the MAH ensures regulatory reporting timelines are met when the vendor performs case processing. Evidence: KPI reports, examples of on-time submissions, escalation records when timelines were at risk.

Preparing these bundles in advance, cross-referencing clauses to operational evidence, and labelling all artifacts improves inspection efficiency and reduces findings.

Concluding Notes

An SDEA is a central governance instrument for distributed pharmacovigilance responsibilities. To be inspection-ready, an SDEA must be clear, operational, supported by SOPs, observed in day-to-day practice, and evidenced by records (reconciliations, KPIs, audit reports, submission acknowledgements). The materials provided here — the inspection-ready checklist, sample SDEA template, activity-to-accountability mapping and practical implementation guidance — are intended to help organisations convert contractual obligations into demonstrable compliance.

References

1. EMA Good Pharmacovigilance Practices (GVP) Module I – Pharmacovigilance Systems and Their Quality Systems.
2. EMA Good Pharmacovigilance Practices (GVP) Module II – Pharmacovigilance System Master File.
3. EMA Good Pharmacovigilance Practices (GVP) Module III – Pharmacovigilance Inspections.
4. Regulation (EC) No 726/2004.
5. Directive 2001/83/EC.
6. Commission Implementing Regulation (EU) No 520/2012.
7. ICH E2 series (E2A, E2D, E2B(R3), E2E) and ICH E6.