Safety Data Exchange Agreements: Role & Importance

Introduction 

In today’s global pharmaceutical environment, medicinal products are often developed, manufactured, marketed, and distributed across multiple countries and by several organizations. As a result, important safety information may be generated by different parties, including Marketing Authorisation Holders (MAHs), license partners, distributors, manufacturers, co-development partners, clinical research organizations, and local pharmacovigilance service providers. 

Ensuring that this safety information reaches the appropriate pharmacovigilance function accurately and within the required timelines is essential for protecting patients and maintaining regulatory compliance. 

A Safety Data Exchange Agreement (SDEA) is a formal written agreement that defines how safety information is exchanged between two or more parties involved in the lifecycle of a medicinal product. Although the exact regulatory expectations vary by country and contractual relationship, written agreements are an important mechanism for clearly documenting pharmacovigilance responsibilities and controlling outsourced or shared activities. In the European Union, for example, the Marketing Authorisation Holder may delegate certain pharmacovigilance activities but retains ultimate responsibility for its pharmacovigilance system. EMA guidance therefore emphasizes detailed written agreements defining roles and responsibilities. 

An effective SDEA is therefore much more than a contractual document. It is a practical framework that connects the different parties within the pharmacovigilance system and helps ensure that safety information is identified, assessed, exchanged, followed up, and reported appropriately. 

1. What Is a Safety Data Exchange Agreement?

A Safety Data Exchange Agreement is a written agreement between parties that establishes the procedures and responsibilities for the collection, assessment, documentation, exchange, and follow-up of safety information. 

Depending on the business relationship, an SDEA may be established between: 

• An MAH and a licensing partner 

• An MAH and a distributor 

• Two MAHs sharing rights to a medicinal product 

• An MAH and a contract service provider 

• A pharmaceutical company and a manufacturer 

• A global organization and its local affiliate 

• Parties involved in co-development or co-marketing arrangements 

The terminology can differ between organizations. Agreements may be referred to as Pharmacovigilance Agreements (PVA), Safety Data Exchange Agreements (SDEA), Pharmacovigilance System Agreements (PSA), or Pharmacovigilance Agreements (PVA). 

Regardless of the terminology, the fundamental objective remains the same: to establish a controlled mechanism for the exchange of safety information and define who is responsible for each pharmacovigilance activity. 

2. Why Are SDEAs Important?

The safety profile of a medicinal product is continuously evolving. New information can arise from spontaneous reports, medical information inquiries, literature, clinical studies, post-marketing surveillance, regulatory authorities, product complaints, patient support programs, digital channels, and other sources. 

When several organizations are involved, the absence of clearly defined responsibilities can create gaps in the safety reporting process. 

For example, consider a distributor that receives a report from a healthcare professional concerning an adverse reaction. If the agreement does not clearly define: 

• Who receives the report? 

• How quickly must it be forwarded? 

• Who performs the medical assessment? 

• Who enters the case into the safety database? 

• Who performs follow-up? 

• Who reports the case to the authority? 

• Who communicates important safety findings to the other party? 

then the case may be delayed or handled inconsistently. 

An SDEA reduces this risk by establishing a predefined process. 

ICH’s post-approval safety guidance emphasizes the importance of standardized approaches to gathering, managing, and reporting post-approval safety information. The current ICH E2D(R1) guideline, adopted in September 2025, further updates the international framework for post-approval safety data and individual case safety report management. 

3. Core Objectives of an SDEA

A well-designed SDEA generally has several key objectives. 

3.1 Establish Clear Responsibilities 

The agreement should clearly identify which party is responsible for each pharmacovigilance activity. 

Responsibilities may include: 

• Adverse event collection 

• ICSR intake and processing 

• Case validation 

• Medical review 

• Follow-up 

• Regulatory reporting 

• Literature monitoring 

• Signal detection 

• Aggregate reporting 

• Risk management activities 

• Safety-related regulatory communications 

• Safety database reconciliation 

• Training 

• Audits and inspections 

Clearly assigning these responsibilities prevents duplication and, more importantly, prevents activities from being overlooked. 

3.2 Define Safety Information Exchange Timelines 

An SDEA should establish specific timelines for exchanging safety information. 

For example, the agreement may define: 

• Timeline for forwarding ICSRs 

• Timeline for providing follow-up information 

• Timeline for notifying important safety issues 

• Timeline for sharing regulatory authority communications 

• Timeline for notifying safety signals or emerging risks 

The timelines should be aligned with applicable regulatory requirements and should allow sufficient time for the responsible pharmacovigilance function to complete its assessment and regulatory obligations. 

3.3 Establish a Consistent Communication Process 

The agreement should specify: 

• Who sends safety information 

• Who receives it 

• Which email address or system should be used 

• Required forms or templates 

• Emergency communication channels 

• Escalation contacts 

• Backup contacts 

This is particularly important for organizations operating across different countries and time zones. 

4. Roles and Responsibilities of the Parties

One of the most important elements of an SDEA is the allocation of responsibilities. 

4.1 Marketing Authorisation Holder 

The MAH generally retains ultimate responsibility for fulfilling its pharmacovigilance obligations, even when certain activities are delegated to another organization. 

For example, within the EU, EMA states that an MAH may subcontract pharmacovigilance activities but retains ultimate responsibility for the completeness and accuracy of its pharmacovigilance system master file and the overall pharmacovigilance system. 

The MAH’s responsibilities may include: 

• Maintaining the overall pharmacovigilance system 

• Ensuring appropriate safety reporting processes are established 

• Maintaining oversight of delegated activities 

• Ensuring regulatory reporting requirements are fulfilled 

• Ensuring appropriate agreements are in place 

• Monitoring compliance with agreed timelines 

• Conducting reconciliation and quality oversight 

• Ensuring appropriate training 

• Performing audits where applicable 

• Ensuring inspection readiness 

4.2 License Partner or Distributor 

A license partner or distributor may be responsible for collecting safety information from its local market. 

Its responsibilities may include: 

• Receiving adverse event reports 

• Identifying potential safety information 

• Forwarding reports within the agreed timelines 

• Providing relevant product and patient information 

• Supporting follow-up activities 

• Informing the MAH about local regulatory safety communications 

• Escalating urgent safety concerns 

• Ensuring relevant personnel are appropriately trained 

A distributor may not necessarily perform the full pharmacovigilance assessment, but it must understand what information constitutes safety information and how quickly it must be transferred. 

4.3 Local Pharmacovigilance Contact 

In countries where a local pharmacovigilance contact or Local Person Responsible for Pharmacovigilance is required, the SDEA should clearly describe the interaction between the local function and the global MAH pharmacovigilance system. 

Responsibilities may include: 

• Local safety information collection 

• Local regulatory communication 

• Support for local reporting 

• Local literature monitoring, where applicable 

• Communication of safety-related regulatory changes 

• Support during inspections 

• Maintenance of local pharmacovigilance records 

The agreement should also define backup arrangements to ensure continuity when the primary contact is unavailable. 

5. What Safety Information Should Be Exchanged?

An SDEA should not focus only on confirmed adverse reactions. 

Depending on the applicable legislation and the scope of the agreement, safety information may include: 

Individual Case Safety Reports 

Examples include: 

• Adverse events 

• Adverse drug reactions 

• Serious adverse events 

• Medication errors 

• Overdose 

• Misuse 

• Abuse 

• Off-label use 

• Occupational exposure 

• Pregnancy exposure 

• Lack of efficacy, where applicable 

• Product quality complaints associated with adverse events 

Other Safety Information 

The agreement may also cover: 

• Safety signals 

• Emerging safety concerns 

• Regulatory authority requests 

• Regulatory safety communications 

• Changes to safety information 

• Product recalls or withdrawals 

• Risk minimization measures 

• Significant literature findings 

• Aggregate safety reports 

• Benefit-risk changes 

• Safety-related clinical trial information 

The exact scope should be adapted to the products, territories, parties, and regulatory obligations covered by the agreement. 

6. ICSR Exchange and Reconciliation

ICSR exchange is one of the most operationally important elements of an SDEA. 

The agreement should establish the process from the moment a potential case is received until the information is transferred to the responsible pharmacovigilance function. 

A typical process may include: 

Receipt of information → Case identification → Initial assessment → ICSR forwarding → Case processing → Follow-up → Regulatory reporting → Reconciliation 

The agreement should define: 

• Minimum information required for transmission 

• Reporting timelines 

• Transmission method 

• Follow-up responsibilities 

• Serious and non-serious case handling 

• Special situation reporting 

• Duplicate management 

• Case numbering, where applicable 

• Reconciliation frequency 

Regular reconciliation is particularly important when two organizations maintain separate safety databases or tracking systems. It helps identify cases that may have been received by one party but not recorded by the other. 

7. Regulatory Reporting Responsibilities

An SDEA should clearly distinguish between exchange responsibilities and regulatory reporting responsibilities. 

For example, Party A may be responsible for collecting and forwarding cases, while Party B may be responsible for regulatory submission. 

The agreement should therefore specify: 

1. Who assesses the case? 

1. Who determines reportability? 

1. Who performs the regulatory submission? 

1. Which authority receives the report? 

1. What are the applicable reporting timelines? 

1. Who performs follow-up? 

1. Who maintains the regulatory reporting records? 

1. How are submission confirmations communicated? 

This distinction is essential because transferring a safety report to another party does not automatically mean that the transferring party has fulfilled every applicable obligation. 

8. Literature, Signals and Aggregate Reports

A comprehensive SDEA should address more than ICSRs. 

Literature Monitoring 

Where literature monitoring responsibilities are shared, the agreement should specify: 

• Which party performs the search 

• Which databases or sources are used 

• Search frequency 

• Screening responsibilities 

• Case identification and processing 

• Exchange of relevant literature findings 

Signal Management 

The agreement should define how potential signals are communicated and escalated. 

For example: 

• Who performs routine signal detection? 

• Who evaluates potential signals? 

• How are emerging safety concerns escalated? 

• What information must be exchanged? 

• What are the timelines for urgent communication? 

Aggregate Reports 

Where applicable, responsibilities for reports such as PBRERs/PSURs should also be defined. 

The agreement may specify: 

• Data lock point responsibilities 

• Case reconciliation 

• Safety data exchange 

• Contribution to the report 

• Review and approval 

• Submission responsibility 

9. Regulatory Intelligence and Safety-Related Changes

Pharmacovigilance responsibilities can change as regulations and national requirements evolve. 

An effective SDEA should therefore include a mechanism for communicating: 

• New pharmacovigilance legislation 

• Regulatory guidance updates 

• New reporting requirements 

• Changes to local reporting procedures 

• Regulatory safety communications 

• New or amended risk minimization requirements 

EMA’s GVP framework is regularly reviewed and updated, and recent EU changes include the implementation of Commission Implementing Regulation (EU) 2025/1466 and updates associated with ICH E2D(R1). 

This demonstrates why agreements should not be treated as static documents. They should be reviewed when there are significant changes to the regulatory or operational environment. 

10. Data Privacy and Confidentiality

Safety information frequently contains personal data. Therefore, an SDEA should establish appropriate confidentiality and data protection requirements. 

The parties should consider: 

• Personal data protection 

• Secure data transmission 

• Access controls 

• Confidentiality 

• Data retention 

• Cross-border data transfers 

• Data breach escalation 

• Appropriate handling of patient-identifiable information 

For example, EMA notes that stakeholders processing EudraVigilance data have responsibilities concerning confidentiality and the protection of data subjects’ rights under applicable data protection legislation. 

The SDEA should therefore work together with applicable data protection agreements and organizational procedures rather than treating pharmacovigilance data exchange as an isolated contractual activity. 

11. Training, Quality Management and Audits

An agreement is only effective if the people responsible for implementing it understand their obligations. 

The parties should therefore establish appropriate training requirements covering: 

• Adverse event identification 

• Safety reporting 

• Special situations 

• Reporting timelines 

• Escalation procedures 

• Use of reporting forms 

• Confidentiality and data protection 

• Agreement-specific responsibilities 

Training records should be maintained and made available when required. 

The agreement should also address quality management and audit rights. EMA guidance emphasizes that outsourced pharmacovigilance activities should be appropriately defined, agreed, and controlled, with contractual arrangements sufficiently detailed to support oversight. 

12. Reconciliation and Compliance Monitoring

One of the strongest indicators that an SDEA is working effectively is the existence of routine compliance monitoring. 

Depending on the agreement, monitoring may include: 

• ICSR reconciliation 

• Safety information reconciliation 

• Timeliness checks 

• Missing case investigations 

• Follow-up completion 

• Regulatory submission reconciliation 

• Training compliance 

• Periodic review of contact details 

• Tracking of deviations 

For example, if Party A reports that it has forwarded 25 safety cases during a specific period while Party B has received only 23, the discrepancy should be investigated and documented. 

Reconciliation therefore provides an important control against information loss and supports continuous improvement of the pharmacovigilance system. 

13. What Happens When an SDEA Is Not Clear?

Poorly defined agreements can create significant compliance risks. 

Common weaknesses include: 

• Undefined responsibilities 

• Ambiguous reporting timelines 

• Missing escalation procedures 

• Outdated contact details 

• No backup contacts 

• Lack of reconciliation 

• No clear ownership of regulatory reporting 

• Inadequate follow-up procedures 

• Missing audit provisions 

• No process for regulatory changes 

• Unclear responsibility for special situations 

These gaps may result in delayed reporting, duplicated work, missed safety information, inconsistent documentation, or regulatory findings. 

The solution is not simply to make an agreement longer. The objective should be to make it clear, practical, measurable, and aligned with the actual pharmacovigilance workflow. 

14. Best Practices for Developing an Effective SDEA

A robust SDEA should be: 

Clear 

Responsibilities should be written in simple and unambiguous language. 

Specific 

Avoid general statements such as “the parties will exchange safety information promptly.” Where possible, define exactly what must be exchanged, by whom, through which channel, and within what timeframe. 

Operational 

The agreement should reflect the actual processes used by the organizations rather than being purely contractual. 

Regulatory-Aligned 

The requirements should be reviewed against applicable legislation, guidelines, and local regulatory requirements. 

Measurable 

Responsibilities should be linked to measurable timelines and compliance checks. 

Current 

Contact details, products, territories, responsibilities, and procedures should be periodically reviewed. 

Auditable 

The agreement should provide sufficient documentation and oversight mechanisms to demonstrate that the agreed activities are being performed. 

15. When Should an SDEA Be Reviewed or Updated?

An SDEA should be reviewed when there is a significant change that could affect pharmacovigilance responsibilities. 

Examples include: 

• New product launch 

• New country or territory 

• Change in MAH 

• Change in distributor 

• Change in licensing arrangement 

• Acquisition or divestment 

• Change in safety database 

• Change in reporting process 

• New regulatory requirements 

• Change in QPPV or local PV contact 

• Change in responsibilities 

• New service provider 

• Findings from audits or inspections 

The agreement should also be periodically reviewed according to the organization’s quality system and contractual requirements. 

16. SDEA as a Tool for Patient Safety

Ultimately, an SDEA should not be viewed merely as a legal or administrative requirement. 

Its real purpose is to ensure that important safety information moves efficiently through the pharmacovigilance system and reaches the people responsible for protecting patients. 

When responsibilities are clearly defined, safety information can be transferred more efficiently, regulatory timelines can be better controlled, and organizations can maintain stronger oversight of their pharmacovigilance activities. 

This is particularly important in today’s pharmaceutical environment, where a single medicinal product may involve multiple MAHs, distributors, manufacturers, service providers, local contacts, and global pharmacovigilance teams. 

A well-designed SDEA creates a structured connection between these stakeholders. 

Managing safety information across multiple organizations requires more than a well-written agreement. It requires clear processes, effective oversight, and a pharmacovigilance system that ensures responsibilities are understood and consistently implemented. Through its pharmacovigilance services, Baupharma helps pharmaceutical companies establish and maintain effective safety processes, supporting activities such as ICSR management, safety data exchange, signal management, and compliance monitoring. This enables organizations to maintain stronger oversight of their pharmacovigilance activities and support patient safety throughout the product lifecycle. 

Key Takeaways 

• An SDEA establishes a structured framework for exchanging safety information between organizations. 

• Clear allocation of responsibilities is essential to prevent gaps, duplication, and delays. 

• ICSR exchange timelines should be clearly defined and aligned with applicable regulatory requirements. 

• The agreement should cover more than ICSRs, including signals, literature, regulatory communications, aggregate reports, and other relevant safety information where applicable. 

• MAHs retain appropriate oversight and ultimate responsibility for their pharmacovigilance obligations even when activities are delegated, depending on the applicable regulatory framework. 

• Reconciliation and compliance monitoring are essential tools for detecting missing or delayed safety information. 

• Training, audit rights, quality oversight, and escalation procedures should be incorporated into the agreement. 

• Data privacy and confidentiality must be considered whenever safety information containing personal data is exchanged. 

• SDEAs should be living documents, reviewed and updated when products, responsibilities, partners, processes, or regulatory requirements change. 

• Most importantly, an effective SDEA supports the ultimate objective of pharmacovigilance: protecting patients through timely identification, assessment, and communication of medicinal product risks.