The script
Hello, and good morning. This is Ravindra Warang, and you’re listening to Pharma Explained. In today’s episode, we’re looking at a 250 crore rupee penalty ceiling in India’s data protection law, and what it may mean for pharma. We’ll also cover a Supreme Court challenge to the law.
Think about how much personal information a single medicine touches on its way to you. A trial participant's medical history and lab results, a patient reporting a side effect, a refill-reminder app, a field team's list of doctors. All of it now sits under one dedicated law.
Here's how we got here. Parliament passed the Act on 11 August 2023, and then it waited. On 13 November 2025, the IT ministry published the Rules in the Gazette, notification G.S.R. 846(E), together with a separate notice that switches the Act on in three steps. The first step, in force since last November, set up the Data Protection Board. The second arrives around 13 November, about eight days from now, and it's narrow: it covers consent managers, registered Indian companies that let you manage your permissions in one place. The third step, around 13 May 2027, is the big one, because that's when most of the duties on companies, and the penalties, begin.
Now, how does it actually work? A company that decides why and how your data is used is called a data fiduciary, and you are the data principal. Before using your data, the company has to give you a plain-language notice saying what it wants and why, and your consent has to be specific and as easy to withdraw as it was to give. The Act's own example is a telemedicine app that also asks for your phone contacts. Contacts aren't needed to run a consultation, so your consent covers only what is.
The Rules add the practical parts. Companies must keep data safe, with encryption, access controls and activity logs kept for a year. If there's a breach, they must tell the affected people without delay, and send the Board a detailed report within 72 hours. Think of it as batch-record discipline applied to people's data: you should be able to show who touched what, and when.
So what changes for the person who takes the medicine?
On safety, the documented part is the security duties and the breach notices. We think that should make leaks easier to trace and harder to hide, though whether breaches actually fall is unknown. There's a tension too: the Act lets companies keep data when another law requires it, and we think that covers safety records like adverse-event reports, but nobody yet knows how the Board will treat clinical data.
On your daily life, the Act says you can read the notice in English or any language in the Constitution's Eighth Schedule, withdraw consent, and ask for corrections or erasure. Complaints must be answered within a period the company publishes, capped at 90 days. For children, a parent's verifiable consent is needed, but hospitals, clinics, doctors and other healthcare professionals are exempt when they're only providing health services to the child. That list doesn't name drug companies, so we think a company running a support programme for a child's therapy will need parental consent.
On your wallet, nothing in the Act or the Rules we read touches prices, and we won't guess whether compliance costs reach the counter. That one is unknown.
On the wider system, the Act also reaches companies abroad that offer goods or services to people in India. Sending data out of India is allowed unless the government restricts a country or sets conditions, and we haven't found any published so far, which matters for global trials. The Act has a research exemption, but only where the data isn't used to make decisions about a specific person. One law firm, King Stubb and Kasiva, argues that coded trial data shouldn't be assumed to fall outside the Act, which is its reading, not a regulator's. The penalty ceilings are 250 crore rupees for failing to protect data and 200 crore for not reporting a breach, and the Board must first find the breach significant.
Now both sides. The government says the framework is simple, citizen-focused and phased so companies can adapt. The Internet Freedom Foundation says the Rules leave long-standing concerns unanswered, including wide powers for the state.
What we don't know matters just as much. We haven't seen a list of significant data fiduciaries, the biggest data handlers, who would face extra audits. So here's a question to carry through your day: when a participant signs a trial consent form, have they also agreed to what happens to their data, and who will check?
The question to carryWhen a participant signs a trial consent form, have they also agreed to what happens to their data, and who will check?
Three things could still move this timetable. First, the Supreme Court. On 27 October it issued notice on a petition by the Digital News Publishers Association challenging parts of the Act and the Rules on press-freedom grounds, and it declined to pass an interim order before hearing the Centre. A ruling could reshape the Act.
Second, the clock. In January the IT ministry asked industry about cutting the eighteen-month window to twelve, reportedly mainly for the largest data handlers. We found no notification making that change. Third, the Board. We found no published appointments to it, and one report says the Kerala High Court expects it to be functional by about 2 December.
Around 13 November, the consent-manager rules start. On 17 November, the Supreme Court hearing. Around 2 December, when the Board may become functional. And around 13 May 2027, when the main duties begin. That's our explainer, not legal advice, so check with your counsel.
If you’d like the detailed story behind any of this, with the sources and the full numbers, you’ll find it on the Pharma Now website and in the Pharma Now mobile app. That’s Pharma Explained for today. Until next time, stay curious and stay well.