Quick Answer
Clinical trials processing health data of Indian participants must comply with the DPDP Act 2023 alongside ICMR guidelines and clinical trial regulations. Health data is not classified as a separate sensitive category under the DPDP Act (unlike GDPR), but consent requirements are strict and purpose limitation applies. Sponsor organisations and CROs must review their informed consent forms and data transfer agreements for DPDP compliance.
Quick AnswerClinical trial sites and CROs must align DPDP consent requirements with ICMR ethical guidelines, implement data minimisation in trial databases, and ensure cross-border data transfer to global sponsors complies with DPDP restrictions.
DPDP Compliance Checklist
- Align DPDP consent with ICMR informed consent requirements — both must be satisfied
- Map all data flows from participant to CRO to global sponsor to regulatory authority
- Implement data minimisation — collect only protocol-required data per visit
- Implement pseudonymisation for trial databases — link participant identity only where needed
- Review cross-border data transfer to global sponsors — comply with DPDP transfer restrictions
- Publish privacy notice for trial participants in local language
- Implement data retention schedule aligned with GCP guidelines and DPDP storage limitation
- Train site staff and coordinators on participant data rights and DSAR handling
- Conduct DPIA before initiating any new trial — DPDP requires risk assessment for sensitive data
- Review IRB/EC approval process to incorporate DPDP review
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Do clinical trials need DPDP consent in addition to ICF?+
Yes. DPDP consent obligations apply independently of the Informed Consent Form under ICMR guidelines. Both must be satisfied — the ICF does not automatically satisfy DPDP requirements.
Can trial data be shared with overseas sponsors?+
With appropriate safeguards and participant consent, cross-border transfer is permissible. Sponsors should include DPDP compliance obligations in site agreements.
What is the DPDP penalty risk for clinical trial data breaches?+
Clinical trial data is sensitive health data. Breaches can attract maximum penalties under DPDP — up to ₹250 crore — plus regulatory consequences under CDSCO.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
