Pharma companies and CROs process participant and patient data across trials, pharmacovigilance and patient-support programmes.
In short
The Act layers onto the New Drugs and Clinical Trials Rules and ICMR ethics: trial consent is not the same as DPDP consent, and de-identification is your best friend. Penalties reach ₹250 crore.
What changes for this sub-sector.
Ethics-committee informed consent for a trial does not replace DPDP consent for processing personal data; you need both.
Pseudonymise or anonymise participant data wherever the science allows, to cut exposure.
Adverse-event and safety data still contain personal data and fall under the Act.
PSPs and adherence apps collect ongoing health data; treat them as in-scope.
CROs, trial sites, labs and sponsors abroad are processors; watch cross-border flows and contracts.
Long trial-record retention rules coexist with erasure; document the legal basis for holding data.
Niche guides for this area, each naming the specific regulation.
Separate trial consent from data consent, then design in de-identification.
The readiness check surfaces consent, de-identification and cross-border gaps.
Take the readiness check →