Pharma and Clinical Research: A DPDP Act Impact Study

Executive summary

Headline impact rating: Medium-High. Pharma and clinical research already work under detailed consent and confidentiality rules: the New Drugs and Clinical Trials Rules, 2019 (NDCT Rules), CDSCO's Good Clinical Practice guidelines and the ICMR National Ethical Guidelines. The Digital Personal Data Protection Act, 2023 (the DPDP Act) does not displace them. It adds a layer with its own consent standard, penalties and regulator, the Data Protection Board of India, which is not a health regulator.

The impact is uneven. Trial operations, already disciplined by ethics review and monitoring, need adjustment rather than rebuilding. The largest gaps are in patient support programmes, adverse event intake through call centres and digital channels, and secondary research on trial and genomic data.

The three biggest changes are:

• A second consent with different rules. A trial informed consent form is designed to protect participants from research risk. A DPDP consent must be preceded by an itemised notice, be limited to necessary data and be as easy to withdraw as to give. One document can do both jobs, but only if it is redesigned.
• A research exemption that is narrower than many assume. Section 17(2)(b) does not cover processing used to make decisions about a participant, which is most of what happens during a trial. Where it does apply, Rule 16 and the Second Schedule still impose minimum standards.
• Accountability for long vendor chains. Sponsors answer for their processors whatever the contract says: CROs, electronic data capture providers, central laboratories, call centres and patient support vendors.

The main obligations commence on 13 May 2027. Trials approved now will run past that date, so their consent forms and contracts should be DPDP-ready.

Background

The data principals (the individuals the data is about) in this sector include trial participants and their legally acceptable representatives, healthy volunteers in bioavailability and bioequivalence studies, patients enrolled in support programmes, people who report adverse events, caregivers, investigators and other healthcare professionals, and ethics committee members.

The data is among the most sensitive any business holds: medical histories, test results, samples and derived data, genomic sequences, adverse event narratives, and in support programmes, prescriptions and income documents. The DPDP Act has no special category for health or genetic data, but what counts as "reasonable" security rises with sensitivity.

Data flows are typically:

• Trials. Sites (hospitals and their investigators) hold source records with full identity. They enter coded data into electronic case report forms run by the sponsor or its CRO. Central laboratories receive samples with codes. The sponsor, often outside India, receives coded datasets, safety reports and monitoring reports. CDSCO and ethics committees receive reports and can inspect records.
• Pharmacovigilance. Adverse events reach a company through medical representatives, call centres, social media, literature, support programmes and HCPs. Cases are entered into a global safety database and reported to regulators. The Pharmacovigilance Programme of India (PvPI), run by the Indian Pharmacopoeia Commission, collects reports from healthcare professionals and the public.
• Patient support programmes. Vendors enrol patients, provide nurse counselling, adherence reminders, diagnostic support or access schemes, and report aggregated results to the company.
• Commercial operations. CRM systems hold data about doctors, including sample records the marketing code requires.

Typical vendors include CROs, site management organisations, eClinical and safety database providers, central labs, call centres and cloud providers.

Legal framework

The DPDP Act and Rules. A data fiduciary decides the purpose and means of processing; a data processor acts on its behalf. Processing needs consent (s.6) or a legitimate use under section 7. The key provisions are:

• s.5, s.6 and Rule 3: itemised notice with every consent request; consent that is free, specific, informed, unconditional, unambiguous and as easy to withdraw as to give.
• s.7(a), (d) and (f): data voluntarily provided for a specified purpose; a legal obligation to disclose information to the State; a medical emergency involving a threat to life or health.
• s.8: responsibility for processors irrespective of contract; valid processor contracts; reasonable security safeguards; breach intimation; erasure once the purpose is served unless law requires retention.
• s.9: verifiable parental consent for anyone under 18, and no tracking or behavioural monitoring of children. The Fourth Schedule exemption covers clinical establishments and healthcare professionals providing health services, not sponsors or CROs.
• s.10 and Rule 13: additional duties if a business is designated a Significant Data Fiduciary (SDF).
• s.16 and Rule 15: transfers abroad are allowed unless the government restricts a country (none is restricted), subject to any government order on making data available to foreign states.
• s.17(2)(b), Rule 16 and the Second Schedule: the research, archiving and statistics exemption.
• Rules 6 and 7: minimum safeguards, one-year logs, notice to affected persons and a 72-hour report to the Board.

Penalties run up to ₹250 crore for security failures and ₹200 crore for breach-notice and children's data failures.

Sector instruments.

• NDCT Rules, 2019 (G.S.R. 227(E), 19 March 2019). Trials need CDSCO permission and ethics committee approval, registration on the Clinical Trial Registry of India before the first enrolment, compliance with the protocol and Good Clinical Practice, and data integrity by sponsor and investigator (rule 25). Premises and records are open to inspection and seizure. Investigators report serious adverse events within 24 hours (rule 42). Ethics committees keep records for five years after a trial ends (rule 13). Bioavailability and bioequivalence centres keep records for five years after the study or two years after batch expiry, whichever is later. For vulnerable participants in trials of new chemical or molecular entities, the consent process is audio-video recorded.
• CDSCO Good Clinical Practice guidelines. Confidentiality means "maintenance of privacy of study subjects including their personal identity and all medical information". The consent information must explain the extent to which confidentiality of records can be safeguarded. Investigators must allow monitoring and auditing by the sponsor, ethics committee, CRO and regulators. The sponsor keeps study documents for three years after completion of the study or submission of data, whichever is later.
• ICMR National Ethical Guidelines for Biomedical and Health Research Involving Human Participants, 2017. These govern non-regulatory research and ethics committee practice. Records should be coded or anonymised and access limited. Donors own their biological samples; institutions are custodians. Donors may withdraw samples and data unless the data is needed for outcome measurement and the consent said so. Section 10 deals with genetic research (privacy, consent, storage for future research) and Section 11 with biobanking and datasets. Foreign-collaborative or foreign-funded proposals go to the Health Ministry's Screening Committee, and exchanges of biological material abroad need a material transfer agreement.
• Pharmacovigilance. PvPI's suspected adverse drug reaction form asks for patient initials, age, gender and weight, not full names, and states that the patient's identity is held in strict confidence. PvPI also publishes pharmacovigilance guidance for marketing authorisation holders (Version 2.0).
• Uniform Code for Pharmaceutical Marketing Practices, 2024 (Department of Pharmaceuticals, 12 March 2024). The Code governs samples, CME events, research and consultancy engagements with doctors, and complaints through industry ethics committees. It requires records of the doctor's name and samples given, and website disclosure of CME events and spending. It says nothing about patient data, privacy or patient support programmes. For those, the DPDP Act is the main rulebook.
• Biological Diversity Act, 2002. As amended in 2023, its definition of biological resources expressly excludes human genetic material. It does not regulate human genomic data.

How they fit together. Section 38 makes the DPDP Act apply in addition to these instruments and prevail in a conflict. Real conflicts are rare: the sector rules mostly add retention periods that section 8(7) respects and approval routes that section 16(2) leaves in place.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: Medium-High

One participant, two consents

A trial informed consent form already explains the study, its risks and how confidentiality is protected. The DPDP Act asks for something related but different. Rule 3 requires a notice that can be understood on its own, lists the personal data and the purpose for each item, and explains how to withdraw consent, exercise rights and complain to the Board.

In Trayambic's view the practical answer is a single consent pack with a distinct DPDP section, approved by the ethics committee with the rest of the form. That section should list the data collected at site, the coded data sent to the sponsor and its processors, the recipients abroad, the regulators who may inspect, how long records are kept, and the DPO or contact person. Separate, optional consents should cover future use of samples and data outside the protocol, and any genetic analysis not needed for the trial.

Withdrawal. Section 6(4) makes withdrawal as easy as giving consent, and withdrawal does not undo processing already done. Section 8(7) then requires erasure, unless retention is needed to comply with law. The NDCT Rules and GCP require trial records to be kept and data integrity preserved, so data already collected is retained for the regulatory period, but no new data is collected and samples are handled as the ICMR guidelines and the consent form allow. Consent forms should say this plainly.

Children. In paediatric trials, the parent's informed consent can double as verifiable parental consent under section 9(1) if the site checks that the parent is an identifiable adult, as Rule 10 requires. Section 9(3) bans tracking and behavioural monitoring of children. A site, as a clinical establishment, has a Fourth Schedule exemption to the extent necessary to protect the child's health; a sponsor running an app-based diary or wearable does not have its own. Protocols for paediatric digital endpoints should be reviewed with that in mind.

What section 17(2)(b) actually exempts

Section 17(2)(b) disapplies the Act for research, archiving or statistical processing, if the data is not used to take any decision specific to a data principal and the prescribed standards are met. Trayambic's articles on hospitals and on AI training cover the first limb in brief; for this industry the detail matters more.

During a trial, data is used to decide eligibility, dosing, safety follow-up and withdrawal for each participant. That processing is not exempt. The exemption is more realistic for later work: pooled analyses, registry studies or real-world evidence projects where outputs are aggregate and no individual is acted on.

Even then, Rule 16 and the Second Schedule set conditions. Processing must be lawful, limited to the data needed, reasonably accurate, kept only as long as needed or required by law, protected by reasonable security safeguards including at processors, and the person deciding purpose and means is accountable. In effect the exemption removes notice, consent and rights duties, not the duty to run a disciplined programme. Truly anonymous data is outside the Act, but a coded dataset whose key sits at the site is not anonymous, and genomic data can point back to a person and to relatives.

Pharmacovigilance and patient support programmes

Adverse event reporting is a legal duty for trial sponsors and investigators under rule 42 and a regulatory expectation for marketed products. The DPDP grounds fit reasonably well. A patient or doctor who calls a safety line provides data voluntarily for that purpose (s.7(a)). Onward reporting to CDSCO or PvPI fulfils an obligation to disclose to the State (s.7(d)). The weak points are elsewhere:

• Minimisation. PvPI's own form asks for initials, age and gender, not names. Safety databases and call-centre scripts often capture more. Collect only what case follow-up needs.
• Social listening and digital channels. Adverse events picked up from public posts may be outside the Act if the person made them public, but the data the company then adds to its systems, and any follow-up contact, is not.
• Support programmes. A patient support programme is a service the company designs, so the company is the fiduciary and the hub vendor its processor. Enrolment needs a full notice and consent. Using programme data to profile prescribers or market other products needs separate consent, and adherence monitoring of a child would run into section 9(3). Because the UCPMP is silent on patient data, ethics committees for marketing practices will not police this; the Board will.

Data leaving India

Most global trials send coded data to sponsors and vendors abroad, and samples to central laboratories. The DPDP Act does not prohibit this today: section 16(1) works as a negative list, and no country has been notified. Rule 15 lets the government impose requirements on transfers that would make data available to foreign states, and an SDF can be told to keep specified data in India.

The more immediate constraints are sector rules. Foreign-funded or collaborative research goes to the Health Ministry's Screening Committee under the ICMR framework, and biological material sent abroad needs a material transfer agreement covering confidentiality and data sharing. Section 16(2) keeps any stricter sector rule in force. Because the Biological Diversity Act excludes human genetic material, it is not the route for regulating human genomic data; the DPDP Act, ICMR guidance and contract terms are.

Sponsors should map every outbound flow and name the countries or categories of recipients in the participant notice. A mapped flow can be moved if a destination is later restricted; an unmapped one cannot.

Worked example: an Indian CRO running a global Phase III trial

Consider an unnamed Indian CRO running a Phase III oncology trial at 18 Indian sites for a foreign sponsor. It handles monitoring, data management and safety case processing, and an Indian vendor runs a patient app for symptom diaries.

1. 1.Roles. The sponsor is the fiduciary for trial data; sites are fiduciaries for source records; the CRO and app vendor are processors. The CRO's written delegation from the sponsor, which the NDCT Rules require, is extended to cover DPDP processor terms.
2. 2.Consent pack. The ethics committees approve a revised form with a DPDP section listing data, recipients abroad, retention and contact details, plus a separate optional consent for future genomic research on stored tumour samples.
3. 3.App. The diary app collects only protocol data, encrypts it in transit and at rest, and keeps access logs for a year. No participants are under 18, so section 9(3) is not engaged.
4. 4.Safety cases. Call-centre scripts capture initials, age and gender unless follow-up needs more.
5. 5.Breaches. Sites and vendors must report incidents to the CRO within hours, so the sponsor can notify participants and the Board, and CERT-In's six-hour window can be met.
6. 6.Retention. The CRO keeps its study files for the regulatory period and then returns or deletes them on the sponsor's instruction, with a deletion certificate.

Compliance framework

Phased roadmap to 13 May 2027

• Now to December 2026: data map, role classification, gap assessment and a decision on consent form redesign for trials starting in 2027.
• January to March 2027: consent templates through ethics committees, PSP and safety intake changes, contract amendments, breach playbook.
• April to May 2027: retention schedule, secondary research documentation, transfer inventory, training for site staff and field teams.
• Ongoing: vendor audits, review of new protocols for children and digital endpoints, and monitoring of Board guidance, SDF notifications and any transfer restrictions.

Recommendations

1. 1.Add a distinct DPDP section to every trial consent form, and get it approved with the rest of the form.
2. 2.Treat section 17(2)(b) as covering aggregate secondary research only, and document compliance with the Second Schedule when relying on it.
3. 3.Make patient support programmes consent-based from enrolment, with separate consent for any marketing use.
4. 4.Collect the minimum in adverse event intake, following PvPI's initials-and-demographics model.
5. 5.Contract every CRO, eClinical provider, lab and hub as a processor, with fast incident reporting and deletion terms.
6. 6.Review paediatric protocols for app or wearable monitoring that section 9(3) could catch.
7. 7.Map every flow of data and samples abroad now, so that future restrictions can be absorbed.

Key takeaways

• Pharma and clinical research are rated Medium-High: trial rules already protect data, but patient support, safety intake and secondary research have gaps.
• Trial consent forms need a distinct DPDP section listing data, recipients abroad, retention and contact details.
• The s.17(2)(b) research exemption does not cover in-trial processing used for decisions about participants, and the Second Schedule still applies where it does.
• The UCPMP 2024 is silent on patient data, so the DPDP Act governs patient support programmes.
• Cross-border trial data flows are lawful today, but sponsors should map them against ICMR approval routes and possible future restrictions.