Clinical trials
Trial participants are Data Principals. Data processing consent must be clear and specific, and coded data should be all that leaves the trial site.
Pharmaceutical and life sciences companies
Trials, safety reports and doctor engagement all run on personal data. The DPDP Act covers every one.
Pharmaceutical companies hold health data from trials, adverse event reports and patient programmes, and profiles of thousands of healthcare professionals, often shared with vendors and global systems. vDPO helps you map it and close the gaps.
The DPDP Act
What it means for pharmaceutical companies
The Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 apply to every organisation that processes digital personal data in India. These are the areas that need the most attention in this sector.
Safety reporting
Reporting adverse events to regulators is an obligation under law, a legitimate use that does not depend on consent. Collect only what reporting needs.
Patient programmes
Support programmes collect health and contact data, usually through vendors. Keep it under contract and away from sales and promotion.
Healthcare professionals
Doctors’ profiles, visit records and event attendance are personal data. They need a notice, and consent for promotional messages.
Global systems
Safety databases, sponsors and group HR systems often sit outside India. Record each transfer and check it against the Act’s restrictions.
Breaches and vendors
A breach at a contract research organisation or agency is still your breach to report. Contracts must cover security, breach reporting and deletion.
vDPO
What vDPO gives pharmaceutical companies
Start with the free gap analysis. A client workspace then turns the gaps into an inventory, notices, assessments and registers you can keep up to date.
Gap analysis
Answer 35 questions written for pharmaceutical companies and get a score, the gaps found and the corrective action for each. Free, with no login.
Start gap analysisPersonal data inventory
Start from a list of the activities, systems and recipients typical of pharmaceutical companies, then confirm or edit each one.
Privacy notice and retention schedule
A plain-language privacy notice for each group of people, and a retention schedule, written from the inventory.
Data Protection Impact Assessments
Assess new systems and uses of personal data, with questions for pharmaceutical companies alongside the standard ones.
Risk register
Turn gap analysis answers into risks, and add the risks pharmaceutical companies commonly face as a starting list.
Breaches, requests and grievances
A breach register with the 72-hour countdown and draft notices, and a log of requests and grievances with their due dates.
What the DPDP Act Means for Pharmaceutical Companies
Clinical trials, safety reporting, patient programmes, doctors’ data and global systems: how India’s DPDP Act applies to pharmaceutical and life sciences companies.
Read the article