Not sure. Others might have some good ideas.
The data from trial participants is maintained by the investigator and is under their control and only a copy is given to the sponsor. So the big question is does the PI have "control" over the data? Is there a signed agreement between the investigator and the provider who holds the data for the investigator? Does the investigator have oversight over that provider? Does the provider provide secure retention of the data for the required retention period and under GCP compliant conditions? Can the PI and the provider provide easily available and directly accessible availability for inspections? Has the provider got all the computer validation documentation easily available for inspection and retained for the full retention period?

How are corrections/amendments to subject data (by the subject) handled? Is there a work-round of documentation for these corrections/amendment?

There is lots of stuff on this on both the MHA websites (& blogs) and the EMA website (see other replies in the IT computer section of this forum).