Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsTrials and CROs process participant health data under the New Drugs and Clinical Trials Rules and ICMR ethics, plus the DPDP Act.
In short
Clinical trials operate under the New Drugs and Clinical Trials Rules, 2019, CDSCO oversight and ICMR ethics, with the DPDP Act layered on. Ethics-committee trial consent is not DPDP consent; you need both, and de-identification is your best defence. Penalties reach ₹250 crore.
What changes for this niche, and the specific rule it turns on.
Informed consent for the trial under the NDCT Rules and ICMR ethics does not replace DPDP consent for processing personal data; obtain both.
Pseudonymise or anonymise participant data wherever the science allows to cut exposure.
Adverse-event and safety data still contain personal data and fall under the Act.
Sponsors and CROs abroad are processors; the DPDP cross-border default is permissive, but sectoral and ethics rules still apply.
Trial-record retention runs for years; reconcile it with erasure and document the legal hold.
Short, cite-able answers, mirrored in FAQPage schema.
Separate the two consents and design in de-identification first.
The readiness check flags consent, de-identification and cross-border gaps.
Take the readiness check →Consultant-led and partner-backed.