How do you layer DPDP consent onto GCP and ICMR clinical trial consent? A clinical trial consent framework has to satisfy three requirements at once: Good Clinical Practice (GCP) informed consent to the trial procedures and risks, ICMR National Ethical Guidelines and Schedule Y ethics requirements, and DPDP Act 2023 consent to processing the participant's personal and health data. GCP/ICMR informed consent authorises participation in the study; it does not by itself satisfy DPDP, which requires free, specific, informed and withdrawable consent for each data-processing purpose. The correct approach is a DPDP data-processing consent layered onto — not replacing — the existing informed consent document, typically as an Ethics-Committee-reviewed data annexure, with distinct handling for withdrawal, minors and long regulatory retention. This clinical trial consent framework builds that layered structure for sponsors, CROs and investigator sites.
Build a consent framework that satisfies GCP informed consent, ICMR ethics requirements and DPDP data-processing consent together — with withdrawal, minor-participant and retention handling.
A compliant clinical trial consent framework is best understood as three layers that must all be satisfied, not one document that tries to do everything. The first layer is GCP informed consent — the participant's agreement to undergo the trial's procedures, interventions and risks, the safety-and-ethics consent that most Indian trials run to ICH-GCP standard for global acceptability. The second layer is ICMR ethics compliance — the National Ethical Guidelines for Biomedical and Health Research and Schedule Y requirements, reviewed and approved by the institutional Ethics Committee. The third layer is DPDP data-processing consent — free, specific, informed and withdrawable consent to how the participant's personal and health data is collected, used, stored, shared and retained.
The critical insight is that a signed GCP/ICMR informed consent form does not automatically satisfy DPDP, because the two consents authorise different things: one authorises participation in the study, the other authorises processing of personal data. The framework keeps the trusted GCP/ICMR informed consent document intact and adds a DPDP data-processing layer to it — usually as an annexure reviewed by the same Ethics Committee — so the site does not have to rebuild its consent process or re-approve running studies, but every data-processing purpose now has an explicit, DPDP-valid basis.
The data-processing annexure is the practical heart of the framework. It is a structured addition to the informed consent document that itemises, in plain language, each purpose the participant's personal data will be processed for — clinical data collection, safety monitoring, transfer to the sponsor or CRO, statistical analysis, regulatory submission, and any secondary or future research use — and captures consent for each purpose rather than a single blanket acceptance. Each item states what data is involved, who processes it, whether it leaves India, and how long it is retained, mapping directly to DPDP's requirement that the Data Principal be informed of the data processed and the purpose.
The annexure also names the Grievance Officer or data contact for the trial, explains the participant's rights to access and correct their data, and — critically — explains the two kinds of withdrawal a participant may exercise: withdrawing from the trial (a GCP right) and withdrawing DPDP consent for further data processing. Because trial-data-integrity rules and regulatory retention obligations may require already-generated results to be kept even after a participant withdraws, the annexure sets out clearly what continues to be retained and on what basis, so the participant is not promised deletion the site cannot lawfully deliver.
Data-processing purposes selected for your framework:
Clinical research in India already runs on a mature consent regime — ICH-GCP informed consent and ICMR's National Ethical Guidelines, overseen by institutional Ethics Committees. The DPDP Act 2023 does not replace any of that; it adds a horizontal data-protection layer that applies to trial data the same way it applies to any other personal data. The gap most sponsors and CROs discover is that their carefully drafted informed consent form authorises participation and procedures, but says little or nothing about the specific, purpose-wise, withdrawable consent DPDP requires for processing the participant's personal and health data — and a signature on the informed consent form is not, on its own, DPDP-valid data consent.
This gap matters most for multi-site and multi-country trials, where a single unmapped consent form or an undocumented cross-border transfer can affect every active study at once. A framework that layers DPDP onto the existing GCP/ICMR structure — rather than a bolt-on generic privacy consent that ignores trial realities like long retention and vulnerable participants — is what keeps a research organisation defensible without disrupting studies already underway.
The practical path for sponsors, CROs and research hospitals is additive, not disruptive: attach a DPDP data-processing annexure to the existing informed consent document, take it through the same Ethics Committee review, and extend the site's existing withdrawal, breach and retention SOPs to cover the DPDP dimension. This gets an organisation to compliance without pausing recruitment or re-consenting participants in running studies beyond what the Ethics Committee directs, and it fits naturally into the next study start-up cycle.
With enforcement expected around May 2027, clinical trial consent should be treated as a parallel workstream to protocol and site set-up, not a one-time retrofit. Niti Bharat runs fixed-price DPDP compliance engagements (₹75,000–₹3.2 lakh) for pharma sponsors, CROs and research hospitals that need the framework mapped against their specific trial portfolio, sponsor relationships and Ethics Committee processes.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
