DPDP Act 2023 Compliance for Pharma, Life Sciences & Healthtech Companies in India (2026 Guide)
Why Pharma & Life Sciences Data Protection Is Different
A pharmaceutical company, contract research organisation (CRO), or healthtech platform typically processes personal data across four distinct pools that don’t map onto our Hospital DPDP guide at all: clinical trial participant data (longitudinal, shared with global sponsors and ethics committees), pharmacovigilance data (adverse event reports tied to identifiable patients), healthcare provider (HCP) data used for sales force effectiveness and marketing, and — increasingly — training and validation data for medical AI and diagnostic tools.
Each of these has its own existing regulatory framework in India that predates DPDP: CDSCO’s New Drugs and Clinical Trials Rules, 2019 for trials, ICMR ethical guidelines for biomedical research, and increasingly your own AI governance policy for medical AI tools. DPDP doesn’t replace any of these — it adds an individual-rights and consent layer on top.
Many pharma companies treat clinical trial informed consent (a GCP/ethics requirement) as if it also satisfies DPDP consent requirements. The two serve different purposes — trial informed consent covers participation in the study itself, while DPDP consent covers the specific processing of personal data, including any secondary use beyond the trial’s original scope.
7 Core DPDP Obligations for Pharma & Life Sciences
1. DPDP Consent Alongside Trial Informed Consent
Trial informed consent forms, required in English and/or the participant’s vernacular language under the New Drugs and Clinical Trials Rules 2019, address study participation. A separate, DPDP-aligned data processing notice should cover how personal data collected during the trial will be used, stored, and shared — including with global sponsors.
2. Data Integrity Obligations Under CDSCO Rule 25
Rule 25(xvii) of the 2019 Rules requires sponsors and investigators to maintain data integrity of clinical trial data. This overlaps with, but doesn’t replace, DPDP’s Section 8(5) “reasonable security safeguards” standard — both apply simultaneously to the same trial data.
3. Data Processing Agreements With CROs and Trial Sites
Sponsors sharing participant data with CROs, trial sites, and central labs need a Data Processing Agreement under Section 8, clearly defining each party’s role as Data Fiduciary or Data Processor.
4. Purpose Limitation for Pharmacovigilance Data
Adverse event data collected for drug safety reporting has a specific regulatory purpose and should not be repurposed for marketing or unrelated research without a separate legal basis.
5. Rights Requests From Trial Participants and Patients
Participants can request access, correction, or erasure — but erasure of trial data is typically constrained by CDSCO’s data retention and integrity requirements, which function as a “legitimate use” basis under Section 7 for continued retention during and after the trial.
6. Governance Over HCP and Prescriber Data
Doctor and prescriber data used for sales force CRM, detailing, and marketing needs its own consent and purpose-limitation treatment, separate from patient data — see the dedicated section below.
7. DPIA for AI-Based Diagnostic and Clinical Decision Tools
Any AI model trained on or making inferences from patient-identifiable data should have a documented Data Protection Impact Assessment, even if your organisation isn’t formally designated a Significant Data Fiduciary.
DPDP Act vs CDSCO New Drugs and Clinical Trials Rules, 2019
The New Drugs and Clinical Trials Rules, 2019 govern clinical trials, bioequivalence studies, and academic health research in India, applying to sponsors, investigators, CROs, academic research institutions, and ethics committees. They were not written with digital personal data protection in mind, which is exactly why DPDP applies on top rather than instead.
| Requirement | DPDP Act 2023 | CDSCO NDCT Rules 2019 |
|---|---|---|
| Regulator | Data Protection Board of India | CDSCO / Ethics Committees |
| Consent focus | Processing of personal data for specified purposes | Participation in the trial, risks, and rights as a subject |
| Data integrity | “Reasonable security safeguards” (Section 8(5)) | Rule 25(xvii): sponsor/investigator must maintain data integrity |
| Vulnerable subjects | Special treatment for children (Section 9), not other vulnerable groups | Ethics Committee must exercise particular care for vulnerable subjects (minors, impoverished, incapacitated) |
| Individual rights | Access, correction, erasure, grievance, nomination | Not an individual-rights framework — focused on trial conduct and safety |
HCP & Prescriber Data Governance
Indian pharma companies run extensive medical representative (MR) and sales force CRM systems tracking doctor visit frequency, prescribing patterns, and engagement history — sometimes called “detailing” data. This is personal data belonging to the healthcare provider, not the patient, and it’s frequently under-governed because compliance attention tends to focus entirely on patient data.
- HCP data used for detailing and marketing needs a documented legal basis — typically legitimate business interest is not a recognised DPDP basis, so consent or a clearly scoped professional-context justification needs review
- Third-party HCP databases purchased or licensed from data aggregators need due diligence on how that data was originally collected and whether it can lawfully be used for marketing outreach
- MR-facing CRM and detailing apps often sit outside the IT team’s normal security review process — these need the same DPA and access control treatment as any other system holding personal data
Medical AI & Healthtech Considerations
Healthtech platforms building or deploying AI for diagnostics, imaging analysis, or clinical decision support sit at a particularly sensitive intersection: the underlying training data is often patient-identifiable medical imaging or records, and the output directly influences clinical decisions. Even where DPDP’s Significant Data Fiduciary threshold hasn’t formally been triggered, a documented DPIA for these systems is strong practice — both for DPDP defensibility and for the kind of global certification (ISO 27001, HIPAA) that international healthcare partners typically require before integration.
Cross-Border Trial Data
Multi-country clinical trials routinely transfer participant data to global sponsors, central labs, and trial registries outside India. Under Section 16, the DPDP Act does not impose default data localisation, but sponsor contracts, ethics committee requirements, and the trial protocol itself often specify data handling terms independent of DPDP — all of which need to be reconciled, not just the DPDP position alone.
Breach Notification
A breach involving clinical trial or patient data triggers notification to the Data Protection Board of India under Rule 7 of the DPDP Rules 2025, without a materiality threshold, alongside any separate reporting obligations to CDSCO, ethics committees, or sponsors specified in the trial protocol or master services agreement.
Penalties & Enforcement Risk
The Data Protection Board of India can impose penalties of up to ₹250 crore per violation under the DPDP Act — see our full penalties guide. Separately, CDSCO and ethics committees have their own enforcement powers over trial conduct, including the ability to suspend or terminate a trial for serious non-compliance, independent of any DPDP action.
15-Point DPDP Readiness Checklist for Pharma & Life Sciences
- DPDP-specific data processing notice exists separately from trial informed consent forms
- Data Processing Agreements are in place with every CRO, trial site, and central lab
- Pharmacovigilance data has a documented purpose limitation separate from marketing use
- HCP/prescriber data in MR CRM and detailing systems has a documented legal basis
- Third-party HCP databases have been reviewed for lawful collection basis
- Rights request workflows exist for trial participants, distinguishing DPDP rights from GCP consent
- Retention basis for trial data post-erasure-request is documented under Section 7
- A DPIA has been completed or considered for any AI-based diagnostic or clinical decision tool
- Cross-border data flows to global sponsors and central labs are mapped
- Security safeguards for trial and pharmacovigilance data meet both DPDP and CDSCO integrity standards
- Ethics Committee and DPO/Grievance Officer functions are coordinated, not siloed
- MR-facing apps and CRM systems have undergone the same security review as core IT systems
- Vendor contracts with data aggregators and marketing data providers include DPDP clauses
- Incident response plans account for both DPBI notification and sponsor/CDSCO reporting obligations
- Employee and investigator training covers DPDP principles alongside GCP and ethics requirements
Our Methodology
We assess pharma, life sciences, and healthtech organisations across each of the four data pools covered in this guide, rather than applying a generic healthcare checklist. A typical engagement covers:
- Data flow mapping across clinical trials, pharmacovigilance, HCP/marketing, and any AI systems
- Gap assessment against DPDP obligations alongside existing CDSCO and ethics committee requirements
- Contract review of CRO, trial site, and data vendor agreements for missing data protection clauses
- Remediation roadmap prioritised by regulatory exposure and trial/business impact
- Implementation support for consent flows, DPIAs, and incident response
We’ve helped healthtech and medical AI organisations achieve ISO 27001 and HIPAA compliance, including CARPL.ai, a global AI platform for radiology and medical imaging — supporting their information security programme as they scaled internationally. Read the CARPL.ai case study.
Get Your Pharma & Life Sciences DPDP Gap Assessment
Clinical trials, pharmacovigilance, HCP data, and medical AI — mapped in one assessment. Written, RAG-scored report in 5 business days.
Book My Free Assessment →Frequently Asked Questions
Does trial informed consent under CDSCO rules also satisfy DPDP consent requirements?
Not automatically. Trial informed consent addresses participation in the study — risks, procedures, and rights as a subject — while DPDP consent specifically addresses the processing of personal data. Best practice is a separate, clearly scoped DPDP data processing notice alongside the trial consent form, particularly covering any use of data beyond the trial’s original purpose.
Can a participant request erasure of their clinical trial data?
In most cases, sponsors can rely on the “legitimate uses” basis under Section 7 to retain trial data during and after the study, given CDSCO’s data integrity and retention requirements under Rule 25 of the 2019 Rules. This should be documented as a specific policy position, with a clear explanation given to the participant, rather than assumed.
Is healthcare provider (HCP) or doctor data treated differently from patient data under DPDP?
The DPDP Act doesn’t distinguish between HCP and patient personal data — both are personal data subject to the same obligations. In practice, HCP data used for sales and marketing purposes is frequently under-governed compared to patient data, since compliance attention tends to focus on clinical data rather than commercial CRM systems.
Do medical AI tools need a DPIA under the DPDP Act?
A DPIA is only formally mandatory for designated Significant Data Fiduciaries. However, for AI tools trained on or making inferences from patient-identifiable data, a voluntary DPIA is strongly advisable — both to demonstrate DPDP defensibility and because international partners and certifications like ISO 27001 or HIPAA typically expect this level of documented risk assessment.
Do multi-country clinical trials need special DPDP handling for cross-border data transfer?
The DPDP Act itself does not impose default data localisation under Section 16, so cross-border transfer to global sponsors is generally permitted. However, the trial protocol, sponsor contract, and ethics committee approval often specify their own data handling terms, which need to be reconciled alongside the DPDP position, not treated as a substitute for it.
Related Resources
- DPDP Act for Hospitals
- DPDP Act Compliance Checklist India 2026
- DPDP Act Glossary of Key Terms
- DPDP Act Penalties India 2026
- Data Processing Agreement Under DPDP Act
- HIPAA Compliance Services
- ISO 27001 Consulting & Implementation
- CARPL.ai Case Study
- DPDP Act Compliance Services
- Virtual CISO (vCISO) Services India
- ISO 27001 Consultant India — Cost, Timeline & Checklist
