Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsPharma companies and CROs process participant and patient data across trials, pharmacovigilance and patient-support programmes.
In short
The Act layers onto the New Drugs and Clinical Trials Rules and ICMR ethics: trial consent is not the same as DPDP consent, and de-identification is your best friend. Penalties reach ₹250 crore.
What changes for this sub-sector.
Ethics-committee informed consent for a trial does not replace DPDP consent for processing personal data; you need both.
Pseudonymise or anonymise participant data wherever the science allows, to cut exposure.
Adverse-event and safety data still contain personal data and fall under the Act.
PSPs and adherence apps collect ongoing health data; treat them as in-scope.
CROs, trial sites, labs and sponsors abroad are processors; watch cross-border flows and contracts.
Long trial-record retention rules coexist with erasure; document the legal basis for holding data.
Niche guides for this area, each naming the specific regulation.
Separate trial consent from data consent, then design in de-identification.
The readiness check surfaces consent, de-identification and cross-border gaps.
Take the readiness check →Consultant-led and partner-backed.