DPDP Act for Pharma & Clinical Trials: Consent Across Sites, CROs & Regulators
A single informed consent form signed at a clinical trial site in Nagpur or Coimbatore rarely stays in one place. A scanned copy goes into the site's regulatory binder. A structured version of the same consent event gets keyed into the sponsor's eClinical system. The biological sample it authorizes travels to a central lab, sometimes overseas. The case report form built on top of it flows through a CRO's data management team, into a safety database, and eventually into a regulatory submission that a national authority somewhere will scrutinize years later. Every one of those handoffs touches the same participant's personal data, and under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), every one of those handoffs is a place where a compliance obligation can quietly break.
This is the uncomfortable reality that clinical operations, regulatory affairs, and data privacy teams in Indian pharma, biotech, and CRO organizations are now sitting with. The DPDP Rules, 2025 were notified on 13 November 2025, the Data Protection Board of India is already constituted, the Consent Manager framework becomes operative in November 2026, and full compliance across the Act falls due by 13 May 2027. That is no longer a distant horizon — for an industry that runs multi-year trials, protocols signed today will still be actively processing participant data when the Act is in full force. Clinical research cannot treat DPDP as a website cookie-banner problem. It has to be engineered into the consent lifecycle itself.
Two consent regimes, one participant, and no shared vocabulary
Clinical trials in India already run on a mature consent architecture — the Informed Consent Form (ICF) and Patient Information Sheet (PIS), built around the New Drugs and Clinical Trials Rules, 2019, ICH-GCP, and the ICMR's ethical guidelines for biomedical research. That consent is protocol-bound: it is written, reviewed, and approved by an Ethics Committee before a single participant is enrolled, and any material change requires a formal amendment and re-approval before it reaches a participant again.
DPDP consent runs on a completely different clock. Section 5 requires a standalone, plain-language notice — not folded into another document — that itemizes what data is collected, why, who it may be shared with, how long it will be kept, and how consent can be withdrawn. Section 6 requires that consent be free, specific, informed, unconditional, and given through clear affirmative action, and Rule 3 requires that notice be available in English or any of the 22 scheduled languages. Nothing in that framework cares about Ethics Committee timelines, protocol version numbers, or Schedule Y history.
The result is two consent instruments describing the same act of enrolment, built by different teams, on different timelines, in different systems, with no shared source of truth. When a protocol amendment changes how data will be used — a new biomarker analysis is added, a new CRO comes on board, a new country is added to the safety-reporting chain — the ICF gets a version bump through the Ethics Committee. The DPDP notice, in most organisations today, does not move at all, because nobody owns the job of keeping it synchronised.
Who is actually the Data Fiduciary when four organisations touch one sample?
Section 8(1) puts the accountability question bluntly: the Data Fiduciary is responsible for compliance regardless of whether it processes the data itself or through a processor. In a typical multi-country, multi-site trial, that single sentence has to be pointed at a sponsor headquartered abroad, a CRO running site management and data operations, an investigator site that physically enrols the participant, a central laboratory analysing biospecimens, an imaging core lab, and a courier moving samples between all of them. Most of these are not "processors" in the tidy IT-vendor sense the Act seems to imagine — several of them generate new personal data of their own (imaging read reports, lab values, adverse event narratives) and make independent decisions about how it is used.
Sponsors that have only ever thought about this through a GDPR "controller/processor" lens will find the DPDP framework simpler on paper but harder in practice: there is no joint-controller concept to fall back on, so the contractual chain has to explicitly assign who is discharging the Section 5 notice obligation, who is responding to a Section 11–14 rights request, and who answers to the Data Protection Board if something goes wrong — because "the CRO handled it" is not a defence the Act recognises.
Where the real friction shows up?
The consent process itself is now recorded, and that recording is personal data. For trials involving new chemical or molecular entities, and for vulnerable participant groups, Indian regulation requires audio-video recording of the informed consent process — capturing the participant's face, voice, and the investigator's explanation, sometimes alongside an impartial witness for participants who cannot read the ICF themselves. That recording is far more sensitive than the paper form it documents, yet in most sites it is treated as a regulatory artefact to be filed away, not as personal data requiring its own notice, access control, retention schedule, and eventual erasure path. Under DPDP, that recording is squarely personal data — and organisations that have never inventoried where these files live, who can open them, or when they get destroyed are exposed the day a participant exercises a Section 11 access request.
Sub-processor sprawl breaks the itemised notice. A Section 5 notice has to name, in substance, the categories of recipients data will flow to. A real trial's data supply chain includes the CRO, one or more central labs, an imaging vendor, a randomisation and drug-supply system, a pharmacovigilance vendor, translation vendors for the ICF itself, and often a biobank for future research use. Every time a sponsor swaps a vendor mid-trial — which happens constantly — the notice given to participants at enrolment becomes stale. Very few organisations have a live mechanism to detect that drift, let alone to re-notify.
Cross-border transfer doesn't run on the muscle memory global teams already have. Multinational sponsors have spent a decade building GDPR transfer mechanisms — adequacy decisions, standard contractual clauses, binding corporate rules. Section 16 of the DPDP Act doesn't work that way: it permits transfer to any country by default, restricting only those the government specifically notifies. That is operationally lighter, but it means the consent notice still has to say, in itemized terms, that data moves to a named destination for a named purpose (typically the sponsor's global safety database), and teams accustomed to leaning on their GDPR transfer paperwork often assume it automatically satisfies DPDP's separate, purpose-specific notice requirement. It doesn't.
Withdrawal can't unwind a trial database, and every site handles that differently. Section 6(4) is clear that consent can be withdrawn at any time, that prior processing remains lawful, and that only future processing must stop. In practice, a participant who withdraws mid-study still has case report data sitting in the trial database, contributing to an efficacy and safety analysis that a regulator will eventually review. Section 8(7) carves out an exception to erasure where retention is required by law, and clinical trial recordkeeping obligations generally satisfy that exception — but "generally" is not good enough when a Data Protection Board asks a specific site to show, for a specific participant, exactly which retained fields were legally mandated and which should have been purged. Most sites have no documented, consistent way to make that distinction at the point a withdrawal is recorded, so the exception gets applied as a blanket assumption rather than a defensible, case-by-case judgment.
Broad consent for future research collides with purpose specificity. Biobanking and secondary-use research are built around broad consent — participants agree, once, to future unspecified research using their samples and data, with ICMR guidelines permitting this model provided re-consent triggers exist for materially different future uses. DPDP's Section 6 requires consent to be specific to a stated purpose. A biorepository consent that says data "may be used for future research" does not obviously meet that bar, and organizations running long-lived sample repositories are only beginning to work out whether that requires a fresh, itemized consent event before each new research use, or a more layered notice architecture built at the point of original collection.
Significant Data Fiduciary status is creeping up on CROs faster than compliance teams realise. Section 10 imposes additional obligations — a Data Protection Officer, annual Data Protection Impact Assessments, independent audits — on entities the government notifies as Significant Data Fiduciaries, based on factors like volume and sensitivity of data processed. A large CRO or central lab running dozens of concurrent trials across therapeutic areas is processing exactly the volume and sensitivity profile that criterion is designed to catch, yet clinical operations teams have generally treated SDF status as a "big tech" problem rather than something their own organization needs to actively assess.
Breach clocks and safety clocks run at different speeds, and teams default to the wrong one. Under Rule 7, a data breach requires an initial intimation to the Data Protection Board without delay, followed by a detailed report within 72 hours. Clinical safety reporting under the New Drugs and Clinical Trials Rules, 2019 runs on a 14-calendar-day window for serious adverse events. Site and CRO safety teams are drilled on the 14-day rhythm; a data breach involving the same participant's records — a misdirected email with unblinded data, a stolen laptop with an EDC export — needs a response measured in hours, not weeks, and very few pharmacovigilance-trained teams have a parallel muscle for that.
Why this can't wait for the 2027 deadline?
Full DPDP compliance is due by 13 May 2027, but trials enrolling participants today will still be actively processing their data on that date — case report forms will still be open, safety databases still being updated, regulatory submissions still pending review. Retrofitting consent notices, data-flow maps, and processor contracts onto a trial that is already mid-enrolment is far harder than building them in at protocol design. Sponsors and CROs that start now are designing the notice and the ICF together; the ones that wait will be trying to reconcile years of inconsistent consent artefacts against a live regulator.
Where Vaultdef fits into this?
This is precisely the gap Vaultdef is built to close for organizations that can't afford to treat DPDP as a document-drafting exercise bolted onto an already-complex clinical operations stack. Vaultdef helps pharma sponsors, CROs, and research sites map exactly where personal and sensitive clinical data lives — from the paper ICF and its AV recording, through EDC and lab systems, to the sub-processors and cross-border destinations it eventually reaches — and keeps that map current as vendors and protocol amendments change it.
On consent specifically, Vaultdef helps translate protocol-driven ICF changes into DPDP-compliant, itemized notices without forcing clinical and privacy teams to maintain two disconnected documents, and gives organizations a structured, auditable way to record the exact legal basis — consent versus retention-required-by-law — behind every data field kept after a participant withdraws. For organizations approaching or already crossing the volume thresholds that could trigger Significant Data Fiduciary status, Vaultdef supports the DPIA and audit trail work needed to demonstrate readiness before the Board asks the question. And because a breach in a clinical data environment has to be assessed on a 72-hour clock that most safety teams aren't built for, Vaultdef helps put a breach-response workflow in place that runs independently of — and faster than — the pharmacovigilance reporting timeline it will inevitably overlap with.
The DPDP Act doesn't ask pharma and clinical research to abandon the consent architecture they've spent two decades building around GCP and Schedule Y. It asks them to make that architecture legible to a new regulator, in a new language, with a paper trail that survives every handoff between a site, a CRO, and the authorities standing behind them. Organisations that build that connective layer now will spend 2027 defending their compliance. The ones that don't will spend it reconstructing it under scrutiny.
