In research of new medicine in our discovery process we process personal health data. These data are in pseudonymized de-identified form where Novo Nordisk does not have the key to re-identify the data. Therefore please be referred to our Notice of Personal Data Processing below with information on how we process and protect the data. 

At Novo Nordisk we use personal data and human biosamples (HBS) for our Research and Development (R&D) activities. Personal data and HBS are crucial to help us search for and develop medicinal products and gain a better disease awareness, including new knowledge for the fight against diseases.

We therefore would like to thank all patients and research participants who have donated their personal data and HBS to us.  See more on:

Novo Nordisk A/S is required by law to protect your personal data and human biosamples.

This Privacy Notice explains how we process (e.g. collect, use, store, delete and share) personal data about you for R&D purposes. The data and information we collect about you as part of our research will as a general rule be pseudonymized* and kept confidential. As a rule, Novo Nordisk A/S will not try to identify you as part of our research activities.

*A process whereby direct personal identifiers (e.g. name or address) in a set of information are replaced with artificial identifiers (e.g. numbers), or pseudonyms.

This Privacy Notice is only relevant to you, if we are not able to identify you directly and provide you with a specific Privacy Notice. This is e.g. the case where Novo Nordisk A/S receives your personal data from our partners or research suppliers in a pseudonymized form only. 


The company responsible for processing your personal data is:

Novo Nordisk A/S
Novo Allé, 2880 Bagsværd Denmark
Company number 24256790
Tel: +45 44 44 88 88

You can always contact Novo Nordisk A/S or the Novo Nordisk Data Privacy Officer at with questions or concerns about how we process your specific personal data.  

We get personal data from the following sources:

  • Universities
  • Hospitals and clinics
  • Research organisations
  • Suppliers and Partners we collaborate with
  • Research institutions and practitioners as part of a Novo Nordisk sponsored study
  • Public and private databases
  • Medical devices, apps and eDevices 

We process personal data about you for the purpose of carrying out scientific research and to:

  • Generate new knowledge and insights
  • Identifying unmet medical needs e.g. Epidemiological research
  • Plan how to do future studies, e.g. inclusion and exclusion criteria optimisation
  • Cross-study analyses of same disease or efficacy
  • Assessment of laboratory measurements to understand trends
  • Verify trends in demographics of subjects enrolled in trials, e.g. across trials to improve understanding of geographic and ethnic differences
  • Optimize access to medicines
  • Reuse of regulatory submission packages and other obligations to authorities
  • Use as control arm supplement, e.g. use of clinical data from an arm of one study as an arm in another study to reduce the needed enrolment of placebo subjects
  • Tool or analytical method development to advance research
  • Enhance safety signal interpretation, e.g. build models from in vitro/ vivo/ clinical trial data to predict safety
  • Develop disease modelling capabilities/biomarker development/development of assays or spectra
  • Develop statistical programming models, e.g. to enhance precision power
  • Develop of Algorithms and Artificial intelligence, e.g. for health apps/medical eDevice development
  • Health economics outcomes
  • Data sharing for research purposes, e.g. fulfil request to share coded data and lab samples from a clinical trial with an external researcher or scientist
  • Research partnership
  • On-market (real world data) research

For the purposes described in section 2, we will only process pseudonymized personal data. This means that we will not be able to directly identify you based on the data available. The pseudonymized personal data may include:

  • Information about health
  • Demographic data such as age, gender and nationality
  • Information about race or ethnic origin
  • Information about religious beliefs
  • Information about sex life and sexual orientation
  • Information about use of a Novo Nordisk product or service, hereunder preferences
  • Biosamples that you have donated for use in R&D activities (e.g. blood, skin, hair, liquids, primary cells, stem cells, urine, tissues) and genetic data. 

Our processing of your personal data requires a legal basis.

Depending on the data, we will process your personal data because it is necessary for our legitimate interests in being able to conduct scientific research within the core areas in which we operate (see:

To get insights on how our products and services are used, in order to further develop and improve them and make them available to patients across the globe we process personal data in accordance with GDPR art. 6(1)(f), GDPR art. 9(2)(j) and/or section 10 of the Danish data protection act. In each such case we have assessed that our legitimate purpose is not overwritten by your interests.   

In some cases, the pseudonymized personal data we process about you will be based on your consent, which you have provided to the source from which we obtained your data, e.g. by the consent you have provided to our partners or research institutions or as part of a Novo Nordisk sponsored research study, cf. GDPR art. 6(1)(a) and GDPR art. 9(2)(a). In such a case Novo Nordisk ensures that any further use of your data for research purposes will be compatible with the original purpose for collecting the data.

We may share your pseudonymized personal data with:

  • Suppliers and suppliers that assist our company (e.g. consultants, IT service providers, law firms, and Contract Research Organisations (CROs)
  • Hospitals and clinics
  • Public authorities if needed
  • Other Novo Nordisk entities (e.g. Novo Nordisk entities in other countries)
  • In collaboration with other pharmaceutical or tech companies but only for research purposes
  • External researchers who are investigating the same or related disease area or drug product

For the purposes described above in section 2, we may transfer your personal data to countries outside the European Economic Area (EEA).

We use one of the following safeguards, as required by law, to protect your personal data in case of such transfer:

  • The transfer is to a Novo Nordisk entity covered by Novo Nordisk’s Binding Corporate Rules, available at:
  • The destination countries are deemed by the EU Commission to have an adequate level of protection of personal data
  • We have entered into Standard Contractual Clauses for the Transfer of Personal Data to Third Countries. You can get a copy of the Clauses by contacting us as described in section Who we are.

We will keep your pseudonymized personal data as long as relevant for the intended use for which it was collected and in accordance with Novo Nordisk A/S’ data retention and deletion procedures.


  • Data related to technical complaints will be kept for 12 years
  • HBS will be kept as long as we are allowed, depending on the arrangement we have with our external parties. Sometimes it is for 3 years, but it can also go up to 15 years,
  • Pharmacovigilance data and regulatory documents relating to individual authorised medicinal products will be stored for as long as the marketing authorisation exists and for at least a further 10 years after the marketing authorisation has ceased to exist

In general, you have the following rights:

  • You can get information of what identifiable personal data we have about you
  • You can get a copy of your personal data in a structured, commonly used and machine-readable format
  • You can get an update or correction to your personal data
  • You may request to have your personal data deleted or destroyed
  • You may request us stop or limit processing of your personal data
  • Where the personal data is collected on the basis of your consent you may withdraw your consent
  • You can submit a complaint about how we process your personal data to a Data Protection Authority

Under applicable law, limits on these rights exist when data is processed purely for scientific purposes. This means that in such circumstances, the above rights on insight into the data, right to correction or destroy of data and right to stop processing are limited.

Contact us as described in section “Who we are” with questions or requests relating to these rights.