Skin
Free gap analysis · Pharma

DPDP Gap Analysis for Pharmaceutical and Life Sciences Companies

Measure your company’s compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules. You get an overall score, the gaps found and the corrective steps for each.

Applicable to pharmaceutical manufacturers and marketers, clinical trial sponsors, contract research organisations, biotechnology companies, vaccine makers and other life sciences companies operating in India.

35 questions 8 sections 10–15 minutes No login needed
Progress 0 of 35 answered
Yes Fully implemented Partially Implemented, but gaps remain No Not implemented Not Applicable Does not apply
1. Governance and Accountability
01 Has the company assigned clear responsibility for compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and Rules?
02 Has the company identified when it acts as a Data Fiduciary and when as a Data Processor, for example as a trial sponsor, with contract research organisations or for a global parent company?
03 Are data protection responsibilities defined across medical affairs, clinical operations, pharmacovigilance, sales and marketing, HR and IT?
04 Does management periodically review data protection risks, compliance gaps and corrective actions?
2. Personal Data Inventory and Mapping
05 Has the company identified the personal data it holds about trial participants, patients, healthcare professionals, employees and other individuals?
06 Has the company documented the purposes for processing personal data, including clinical research, pharmacovigilance, patient support, healthcare-professional engagement and marketing?
07 Has the company mapped how personal data flows between trial sites, contract research organisations, safety databases, sales systems and group companies?
08 Does the company maintain an inventory of systems, databases and vendors that store or process personal data?
09 Has the company identified personal data shared with regulators, ethics committees, contract research organisations, distributors, group companies and other recipients?
3. Notices and Consent
10 Does the company give clear privacy notices to trial participants, patients, healthcare professionals and employees?
11 Has the company identified which processing relies on consent and which on a legitimate use under the DPDP Act, such as an obligation under law to report adverse events?
12 Is consent for data processing in trials and patient programmes specific, separate from other consents, and recorded?
13 Can individuals withdraw consent easily, and does the company stop the relevant processing while keeping what the law or the integrity of a trial requires?
14 Is healthcare-professional data used for engagement, events and marketing collected with a notice and, where needed, consent?
4. Clinical Trials, Safety and Patient Programmes
15 Is trial participant data pseudonymised, with the key held separately and access limited to those who need it?
16 Does the company identify children in trials and patient programmes and obtain verifiable parental consent where the DPDP Act and Rules require it?
17 Are adverse event and product complaint reports handled so that only the personal data needed for safety reporting is collected and shared?
18 Are patient support programmes run by vendors under contracts, with patient data kept separate from sales and marketing?
19 Is further use of trial or real-world data for new research covered by consent, de-identification or another documented basis?
5. Data Principal Rights and Retention
20 Can individuals obtain a summary of their personal data, correct or update it, and request erasure where the law allows?
21 Does the company have documented procedures for verifying, tracking and responding to requests and grievances?
22 Has the company defined retention periods for trial records, safety reports, patient programme data, healthcare-professional data and employee records?
23 Does the company erase personal data when it is no longer required and no applicable law requires its retention?
24 Can the company implement and verify deletion across its systems, group companies and Data Processors?
6. Data Security and Breach Management
25 Has the company implemented appropriate technical and organisational security safeguards to protect personal data?
26 Is access to trial, safety and patient programme data restricted, monitored and logged?
27 Does the company have documented procedures to detect, investigate, respond to and record personal data breaches?
28 Can the company notify affected individuals and the Data Protection Board of India about personal data breaches within applicable statutory timelines?
7. Vendors, AI and Cross-Border Processing
29 Does the company assess the data protection practices of contract research organisations, trial sites, patient programme vendors, agencies and IT providers?
30 Do contracts with Data Processors include provisions for data protection, security, breach reporting and deletion?
31 Has the company assessed privacy risks of Artificial Intelligence (AI), analytics on real-world data and digital tools such as apps and wearables?
32 Has the company identified personal data transferred outside India, for example to global safety databases, sponsors or group companies, and assessed DPDP restrictions?
8. Training and Compliance Monitoring
33 Are employees, field force, medical and clinical staff trained on their responsibilities under the DPDP Act?
34 Does the company assess privacy risks before new studies, programmes, apps or significant changes to processing, including Data Protection Impact Assessments (DPIAs) where legally required?
35 Does the company periodically review its data protection controls, track corrective actions and maintain evidence of compliance?
Ready to see your report? Unanswered questions count as No. Your answers are used only to calculate this report. Nothing is stored.