How to set up a biobank

Table Of Contents

To establish a human biobank that collects, stores, and shares biological samples and associated data from patients for use in future research studies, a step-by-step process is required. 

Disclaimer. The following workflow provides a simplified, generic roadmap for establishing a human biobank. It is based on European best practices but the precise sequence of steps, competent authorities, licensing requirements, ethics review procedures, and governance obligations vary across jurisdictions. Institutions should therefore always verify applicable national and local requirements before establishing a biobank.  

Step-by-step process for setting up a biobank  #

Step 1 – Define the mission and scope  #

The first step is to clearly define the purpose of the biobank. 

This includes identifying: 

  • the scientific objectives;  
  • the types of biological materials to be collected;  
  • the categories of associated data;  
  • the target donor population;  
  • the intended users of the biobank;  
  • whether the biobank will support a single project or serve as a long-term research infrastructure.  

Step 2 – Identify the applicable legal and regulatory framework  #

Before collecting any samples, identify the legal framework applicable to the proposed activities. 

Step 3 – Establish the legal entity and governance structure  #

Determine which organisation will operate the biobank and establish its governance framework. 

This should include: 

  • governance bodies;  
  • scientific oversight;  
  • ethics oversight;  
  • access committee;  
  • quality management responsibilities. 

Step 4 – Determine whether authorisation or accreditation is required  #

In many jurisdictions, establishing a biobank requires registration, notification, licensing, accreditation, certification, or authorisation by a competent authority. 

International quality standards such as ISO 20387: Biotechnology – Biobanking are increasingly recognised as good practice.  

Step 5 – Develop the ethical and governance framework  #

Before recruitment begins, establish the ethical framework governing the biobank. 

This should include policies on: 

  • informed consent;  
  • participant information;  
  • privacy;  
  • withdrawal procedures;  
  • return of individual research results;  
  • incidental findings;  
  • access to samples and data. 

Step 6 – Develop the data protection framework  #

Where personal data are processed, ensure compliance with the GDPR and applicable national legislation. 

Key activities include: 

  • identifying the legal basis for processing;  
  • determining controller and processor roles;  
  • defining data retention policies;  
  • establishing security measures;  
  • conducting a Data Protection Impact Assessment (DPIA), where required.  

Step 7 – Develop Standard Operating Procedures (SOPs)  #

Prepare documented procedures covering the entire lifecycle of biological materials and associated data. 

These typically include: 

  • participant recruitment;  
  • sample collection;  
  • transportation;  
  • processing;  
  • storage;  
  • quality control;  
  • data entry;  
  • coding and pseudonymisation;  
  • access procedures;  
  • destruction.  

Step 8 – Establish quality management  #

Implement a quality management system appropriate for the biobank. 

Many research infrastructures align their quality systems with ISO 20387 or equivalent standards. 

Step 9 – Prepare participant documentation  #

Develop all participant-facing documentation before recruitment begins. 

This may include: 

  • Participant Information Sheet;  
  • informed consent form;  
  • privacy notice;  
  • policies regarding future research use. 

Step 10 – Establish secure sample and data management  #

Implement systems for the secure management of biological materials and associated data. 

Digital infrastructure should support interoperability and FAIR data principles where appropriate. 

Step 11 – Define access and sharing policies  #

Establish transparent procedures governing access to samples and data. 

Policies should specify: 

  • eligibility criteria;  
  • Material Transfer Agreements (MTAs);  
  • Data Transfer Agreements (DTAs);  
  • intellectual property arrangements;  
  • publication policies, etc. 

Step 12 – Prepare for collaboration and international data sharing  #

If samples or data will be shared with external partners, establish appropriate legal arrangements. 

Depending on the collaboration, this may involve: 

  • Material Transfer Agreements;  
  • Data Transfer Agreements;  
  • Data Processing Agreements;  
  • Joint Controller Agreements;  
  • Consortium Agreements.  

Step 13 – Recruit participants and collect samples  #

Only once all regulatory, ethical, organisational, and technical requirements have been satisfied should recruitment commence. 

Step 14 – Operate, monitor, and continuously improve  #

Biobanks require continuous governance throughout their lifecycle. 

This includes: 

  • monitoring compliance;  
  • reviewing SOPs;  
  • updating governance documents;  
  • conducting internal audits;  
  • maintaining quality standards;  
  • periodically reviewing ethical and data protection safeguards.  

BBMRI-ERIC resources:  #

Biobanking Development, ELSI
Updated on 21 July, 2026