The Indian clinical trials or clinical research market is valued at about USD 1.5 billion and is expected to grow at CAGR of 8.0% over the next few years. Large and diverse population, progressive government initiatives, facilitative and streamlined regulatory environment, cost-efficiency (compared to developed markets), etc, are some of the factors which provide tailwinds to the clinical trials industry.

Clinical trials and other studies are conducted to generate valuable data, which is used in relation to the development and commercialisation of drugs. Such data involves sensitive personal information about the patients or participants, and such data is required to be shared with other relevant stakeholders (such as researchers, etc) so that it can be used appropriately. Naturally, it becomes critical to protect such data. 

In the clinical trial or research process, data protection and privacy of participants is inter alia governed under the Drugs and Cosmetics Act, 1940, New Drugs and Clinical Trials Rules, 2019 (NDCT Rules), Good Clinical Practice Guidelines (GCP Guidelines), National Ethical Guidelines for Biomedical and Health Research Involving Human Participants 2017 (BMHR Guidelines), the Information and Technology Act, 2000, Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and Digital Personal Data Protection Act, 2023 which is yet to be notified. This article focuses on the requirements under NDCT Rules, GCP Guidelines and BMHR Guidelines.

GCP Guidelines and BMHR Guidelines provide that privacy is an individual’s right to control or influence the information that can be collected and stored, and by whom and to whom that information may be disclosed or shared. It is the obligation of the stakeholders to safeguard such information.

Stakeholders such as sponsors, clinical research organisations (CRO), ethics committees, investigators and patients or participants should carefully evaluate the legal requirements applicable to such data being generated and used in the entire process. It is also pertinent to note that many companies (including multi-national companies) carry out clinical trials in India (including as a part of their global clinical trial) and may want to share the same with other stakeholders in and outside India. 

As is required under NDCT Rules, the relevant stakeholders are required to obtain informed consent from the participants. Such informed consent becomes an important document concerning the collection and sharing of participant data. Informed consent needs to be obtained through a document referred to as the  “informed consent document” (ICD), which has two parts: (a) participant information sheet (PIS), which includes relevant details about clinical research; and (b) informed consent form, which is an acknowledgement of PIS. 

CROs and investigators are generally responsible for collecting and sharing the participants’ data with sponsors. Sponsors may be a part of a larger group of companies conducting clinical research and may want to share data with their Indian and/or foreign affiliates or third parties or publish such data in and outside India. In this context, it would be important to examine the legal and regulatory framework, including the consent obtained in ICD to assess if such data can be shared.

Also Read :- India–UK Free Trade Agreement: Big Wins and Bigger Warnings for Indian Healthcare Players

The ethics committee needs to ensure that adequate measures to protect privacy and confidentiality are adopted by the sponsor and CRO. The form of the ICD is approved by an ethics committee before the commencement of clinical research. The sponsor and the CRO should also ensure that the ICD sets out circumstances wherein: (a) the privacy and confidentiality of participants’ data cannot be protected; and (b) there will be a future use of the participants’ data, to safeguard them from impending consequences. The ICD also mentions the name of the parties to which the participant’s data will be shared, along with the way it shall be shared.

If the ICD does not set out what information can be shared and with whom, the sponsors and/or CROs may need to obtain fresh consent from the participants before sharing such data. Obtaining such fresh consent from participants (who may be large in numbers) may not be practically feasible. 

It is, therefore, important to ensure that the form of ICD approved by the ethics committee sets out the data that will be shared, and with whom such data will be shared, by the sponsor. The confidentiality of patient or participant data, which could potentially lead to their identification, must be rigorously safeguarded, with data shared only with authorised individuals. Nevertheless, there may be instances where such data can be disclosed for scientific or legal purposes, particularly when the right to life takes precedence over the right to privacy. Such disclosures should occur only after thorough consultation with the stakeholders involved.

Views expressed by: ​​Bhavik Narsana, Partner, and Sanchit Khurana, Associate, Khaitan & Co.

Like 1

Dislike

Be a part of Elets Collaborative Initiatives. Join Us for Upcoming Events and explore business opportunities. Like us on Facebook , connect with us on LinkedIn and follow us on Twitter , Instagram.

"Exciting news! Elets technomedia is now on WhatsApp Channels Subscribe today by clicking the link and stay updated with the latest insights!" Click here!