Clinical trials, safety reports, patient programmes and thousands of doctors’ profiles: pharmaceutical companies run on personal data. The Digital Personal Data Protection (DPDP) Act covers all of it.
The Act and the Digital Personal Data Protection Rules, 2025 apply to every pharmaceutical and life sciences company that processes digital personal data in India, whether as a sponsor, a manufacturer or a marketer. Here is where the Act bites hardest.
1. Clinical trials
Trial participants are Data Principals. The data processing part of informed consent must be clear and specific, and optional uses, such as future research, need their own choice. Outside the trial site, participants should appear only as codes, with the key held separately under restricted access. Contract research organisations and analytics vendors should receive coded data only.
2. Safety reporting
Reporting adverse events to regulators is an obligation under law, which the Act treats as a legitimate use: it does not depend on consent and does not stop when consent is withdrawn. The challenge is minimisation. Safety information reaches medical representatives, call centres and email inboxes, and copies stay there long after the report is filed. Define the minimum data a report needs and remove the copies.
3. Patient support programmes
Adherence, nurse support and access programmes collect health and contact data, usually through vendors. Keep the data under contract, in systems separate from sales and marketing, and audit the vendors. Patient programme data reaching sales teams is one of the fastest ways to lose patient and regulator trust.
4. Healthcare professionals
Doctors’ profiles, visit records, prescribing insights and event attendance are personal data. Doctors should be told how their data is used when field teams, events or digital channels collect it, and promotional messages need consent that is recorded and honoured.
5. Global systems and transfers
Global safety databases, sponsors and group HR systems often sit outside India. Record each transfer, the countries and recipients, and check each against the Act’s restrictions on transfers to countries the Government restricts.
6. Children
Paediatric trials and programmes involve children, who under the Act are anyone under 18. Verifiable parental consent is needed where the Rules require it, and sites and vendors must be able to show how it was obtained.
7. Vendors and breaches
A breach at a contract research organisation, agency or programme vendor is still the company’s breach to handle. The Act requires reasonable security safeguards, and a breach must be reported to the Data Protection Board of India and the people affected, with a detailed report within 72 hours. Contracts with every Data Processor must cover security, breach reporting and deletion.
A practical starting point
- Map trials, safety reporting, patient programmes and doctor engagement in a personal data inventory.
- Check that only coded trial data leaves sites.
- Separate patient programme data from sales systems.
- Give healthcare professionals a notice and record marketing consent.
- Record every cross-border transfer.
- Add a data processing addendum to every vendor contract.
vDPO’s free DPDP gap analysis for pharmaceutical companies asks 35 questions written for the sector and gives you a score, the gaps found and the corrective action for each. A client workspace then gives you an inventory to start from, DPIAs with pharmaceutical questions, a risk register and a breach register.
This article is general information, not legal advice.