Informed consent in a clinical trial has always been an ethics requirement under Good Clinical Practice and ICMR guidelines. The DPDP Act 2023 now adds a data-protection dimension: the participant must give free, specific, informed and unambiguous consent to the processing of their personal data, be told every purpose it will be used for, and be able to withdraw data consent without that affecting their safety-related rights. A GCP-compliant consent form is not automatically DPDP-compliant — it needs a specific data-use description, disclosure of sharing and cross-border transfer, and a withdrawal mechanism. This checker assesses whether your informed-consent process meets the combined bar.
A GCP-valid consent form is not automatically DPDP-valid. Check whether your trial informed-consent process meets the combined ethics and data-protection bar.
Good Clinical Practice and ICMR informed-consent requirements are built around protecting the participant's safety, autonomy and understanding of the medical intervention. The DPDP Act 2023 approaches consent from a data-protection angle: it asks whether the participant gave free, specific, informed and unambiguous consent to each use of their personal data, was told who the data is shared with and whether it leaves the country, and can withdraw data consent. A consent form can be perfectly GCP-compliant on the medical side yet fall short on these data-specific points.
The practical fix is not a separate DPDP consent form but a review and enrichment of the existing informed-consent document so that a single participant journey satisfies both regimes. The data-use section needs to become specific and purpose-by-purpose, sharing and cross-border transfer need to be disclosed, and a data-consent withdrawal route needs to be described. Niti Bharat helps sponsors, sites and ethics committees align their informed-consent templates to the combined GCP-ICMR-DPDP standard.
Withdrawal is where trial consent and DPDP consent most obviously interact. Under the DPDP Act, a participant must be able to withdraw consent for the processing of their personal data, and withdrawal must be as easy as giving consent was. In a trial context this is nuanced: a participant may withdraw from the intervention while certain safety and regulatory record obligations continue for data already collected. The consent process should explain this clearly — what withdrawal stops, what must be retained for safety and regulatory reasons, and how to make the request.
Getting this right protects both the participant's rights and the sponsor's position. A vague or missing withdrawal mechanism is a visible compliance gap that a regulator or the Data Protection Board could flag, and clinical data is exactly the sensitive category where enforcement exposure is highest. Niti Bharat's fixed-price DPDP engagements help life-sciences organisations build defensible consent and withdrawal processes ahead of enforcement expected around May 2027.
A PDF checklist and annotated model clauses for upgrading a GCP/ICMR informed-consent form to meet the DPDP Act's specific-purpose, disclosure and withdrawal requirements.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
