DPDP Act for Pharma, Biotech & Clinical Research Companies
Pharmaceutical companies, biotech firms, contract research organisations, e-pharmacies and medical-device makers work with patient and doctor data across trials, safety reporting, patient-support programmes and sales. The DPDP Act and Rules apply alongside drug, device and research regulation.
Pharma companies are rarely the treating provider, but they handle patient data indirectly and in large volumes. The Act has no special category for health data, so the same rules apply, with higher risk. A conditional research exemption exists, but it is narrow and depends on meeting the Rules' standards. Trial data, safety reports and cross-border sharing with sponsors need careful mapping, and sector laws continue to apply. Most duties take effect on 13 May 2027.
Who this covers
Pharma and biotech companies are Data Fiduciaries for trial participants, patient-programme members, doctors and employees.
Contract research organisations (CROs) and trial sites can be processors for a sponsor, or fiduciaries for their own purposes.
E-pharmacies and telehealth-linked pharmacies are fiduciaries for prescriptions and orders.
Medical-device and diagnostics makers hold device, usage and patient data, often through connected devices.
Healthcare-professional marketing teams hold doctor details, prescribing and engagement data.
Personal data you are likely to hold
Key provisions for Pharma & Life Sciences
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
Research, archiving or statistical processing can be exempt when it meets the Rules' standards and is not used for decisions about the individual.
Itemised notice and consent for trial participation, patient programmes and marketing.
Legitimate uses include voluntarily provided data, legal-disclosure duties and medical emergencies.
Security, accuracy, erasure, breach intimation and processor contracts.
Paediatric trials and children's programmes need verifiable parental consent, subject to exemptions.
Sharing data with overseas sponsors and regulators is allowed unless a country is restricted.
Drug, trial and ethics rules continue to apply alongside the Act.
01Clinical trials and the research exemption
Clinical trials already rest on informed consent, ethics-committee approval and good clinical practice. The DPDP Act adds its own layer. Keep trial consent forms and DPDP notices aligned: tell participants what personal data is collected, why, who sees it, how long it is kept and how to withdraw or complain.
Section 17 exempts processing necessary for research, archiving or statistical purposes where the data is not used to take decisions specific to a Data Principal and the processing follows the Second Schedule standards, as Rule 16 describes. It does not exempt an organisation that merely labels its work as research. Document why each activity qualifies and check how it fits with ethics-committee conditions and the participant's right to withdraw.
02Pharmacovigilance, adverse events and legal reporting
Companies must collect and report adverse events to regulators. Handle those reports with strong access control, use them for safety purposes only and share them with regulators and partners as the law requires. Disclosures to the State required by law are covered by the legal-obligation legitimate use in Section 7, subject to the law requiring them. Keep records for the periods drug laws demand and erase them afterwards.
03Patient-support programmes and e-pharmacy
Patient-support programmes, adherence apps and e-pharmacies collect health data directly. Make participation voluntary, explain the purposes in a short notice, and ask for separate consent for anything beyond the service, such as sharing with other brands or marketing. Do not use programme data to push products to patients without consent, and keep it separate from sales and promotion systems.
For children, Section 9 and Rule 10 require verifiable parental consent, subject to the exemptions in Rule 12 for healthcare providers.
04Doctor and pharmacist data, field teams
Doctors and pharmacists are Data Principals too. Collect their details for stated purposes, such as scientific updates, with consent for promotional channels, and let them withdraw. Field-force apps that record visits, location and call notes need a clear notice and tight access controls.
05Global sponsors, CROs and security
Trials and safety work usually involve overseas sponsors, labs and cloud systems. Section 16 allows transfers abroad unless restricted, and Rule 15 keeps that model. Put contracts in place covering purpose, security, onward transfers and deletion, and make sure CROs and sites work under written agreements.
Apply the Rule 6 baseline to trial databases and sample records, and prepare a breach plan under Rule 7 that also covers regulators and sponsors.
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Follow the trial protocol and drug rules on what must be kept for scientific integrity and safety, keep only that, and tell the participant what remains and why.
That is its own purpose. The sponsor contract should forbid it, and the CRO would need its own lawful basis.
Programme data was collected for the programme. Marketing needs separate consent.
Share what the law and group safety processes need, under a written agreement, with security measures in place.
Treat it as a possible breach. Assess exposure, notify participants and the Board as required, and inform the sponsor under the contract.
Compliance checklist
Common mistakes to avoid
Calling everything "research" to avoid consent.
Mixing patient-support data with sales data.
Leaving CROs and trial sites without written contracts.
Keeping trial data forever without a defined period.
Sharing doctor and patient data with partners without notice.
Common questions
Does the research exemption cover clinical trials automatically?
No. It applies only where the processing is necessary for research, is not used for decisions about the individual and meets the Second Schedule standards. Trial ethics and drug laws also apply.
Is genetic data treated differently?
The Act has no special category. All personal data follows the same rules, but genetic and health data are high-risk, so safeguards should match.
Can we use patient-programme data for marketing?
Only with separate consent. Programme data was collected for the programme.
Who is responsible if a CRO leaks participant data?
The sponsor, as Data Fiduciary, remains responsible for processing done on its behalf, so contracts and oversight matter.
Can we share data with overseas sponsors?
Yes, unless the Central Government restricts the country, and subject to other laws. Put a written contract in place.
Do pharma sales teams need doctors' consent?
For promotional channels such as email and WhatsApp, yes. Doctors are Data Principals and can withdraw.