Trials and CROs process participant health data under the New Drugs and Clinical Trials Rules and ICMR ethics, plus the DPDP Act.
In short
Clinical trials operate under the New Drugs and Clinical Trials Rules, 2019, CDSCO oversight and ICMR ethics, with the DPDP Act layered on. Ethics-committee trial consent is not DPDP consent; you need both, and de-identification is your best defence. Penalties reach ₹250 crore.
What changes for this niche, and the specific rule it turns on.
Informed consent for the trial under the NDCT Rules and ICMR ethics does not replace DPDP consent for processing personal data; obtain both.
Pseudonymise or anonymise participant data wherever the science allows to cut exposure.
Adverse-event and safety data still contain personal data and fall under the Act.
Sponsors and CROs abroad are processors; the DPDP cross-border default is permissive, but sectoral and ethics rules still apply.
Trial-record retention runs for years; reconcile it with erasure and document the legal hold.
Short, cite-able answers, mirrored in FAQPage schema.
Separate the two consents and design in de-identification first.
The readiness check flags consent, de-identification and cross-border gaps.
Take the readiness check →