Pharmaceutical data rarely fits neatly into a single legal category. A clinical-trial dataset may contain patient information, investigator records, statistical outputs, regulatory material, proprietary methodologies and commercially valuable know-how. The same dataset may then move from an Indian sponsor to a contract research organisation, from the CRO to an overseas laboratory, and eventually to a European affiliate seeking to analyse the results. The legal difficulty is therefore not simply whether the data can be “licensed”. It is determining what exactly is being transferred, which rights attach to each component, and which legal regime governs the transfer at every stage.
Digital Personal Data Protection Act, 2023 introduces an important new layer to this structure. Yet its practical significance must be understood alongside pharmaceutical regulation, confidentiality and intellectual-property rules, and, where European individuals are involved, the GDPR.
Whether the asset being licensed is actually personal data
The phrase “clinical-trial data” conceals several distinct legal assets. Patient identifiers, health information and other information relating to identifiable individuals can constitute digital personal data under the DPDP Act. By contrast, genuinely anonymised datasets, aggregate statistical results and certain forms of non-personal research material may fall outside the statute. The licensing agreement therefore cannot sensibly treat the entire database as one undifferentiated asset. India’s statutory framework regulates processing of digital personal data according to the purpose and legal basis for processing, rather than conferring an ownership right in data comparable to copyright or a patent.
This distinction changes the drafting exercise. A pharmaceutical company may have contractual rights to use a dataset without having an unrestricted right to determine how identifiable patient information within that dataset can be processed. “Ownership of data” in the commercial contract therefore cannot override statutory restrictions applicable to personal data. The agreement must instead distinguish proprietary interests in the dataset from the separate legal obligations governing the information contained within it.
Clinical-trial data makes purpose limitation commercially difficult
The tension becomes sharper with clinical research. Patient information is often collected for a precisely defined research protocol, while pharmaceutical businesses may later wish to use the resulting dataset for secondary analyses, safety monitoring, regulatory submissions, companion diagnostics or development of algorithmic models. Those later uses may have commercial value but cannot automatically be assumed to fall within the original processing purpose.
The problem is especially significant because Indian clinical-trial regulation already operates through a detailed regulatory structure. The New Drugs and Clinical Trials Rules, 2019 govern clinical trials, investigators, sponsors, ethics requirements and regulatory processes administered through the drug-control framework. Privacy compliance therefore does not replace pharmaceutical regulation. It operates alongside it.
Indian ethical guidance has also moved towards facilitating carefully controlled commercial use of de-identified or anonymous research material. The 2024 joint MoHFW-ICMR guidelines on leftover de-identified or anonymous samples demonstrate that the regulatory environment recognises commercial research value while conditioning use on ethical safeguards. The contractual question should consequently be framed as one of controlled permissible use, rather than unrestricted commercial ownership.
Health information becomes substantially more difficult when the EU is involved
For EU-linked clinical trials, the GDPR introduces a qualitatively different layer. Article 9 treats health information as a special category of personal data, meaning that processing requires not merely the general legal basis applicable to personal data but a specific condition permitting processing of special-category data. Cross-border movement adds another layer. Chapter V of the GDPR requires international transfers to satisfy prescribed conditions, including an adequacy decision or, where appropriate, safeguards such as standard contractual clauses.
This has an immediate drafting consequence for an Indian pharmaceutical company receiving European clinical data. The contract cannot be limited to an ordinary assignment or data-processing clause. The parties must establish the exporter and importer roles, the transfer mechanism, permitted processing purposes, security measures, onward transfers and procedures for dealing with governmental access requests.
The European Court of Justice’s Schrems II judgment reinforces the point. Standard contractual clauses are not a contractual magic wand. The parties must consider whether the law and practices of the destination country undermine the level of protection required by EU law and, where necessary, adopt supplementary safeguards.
For pharmaceutical licensing, this means that an agreement should be capable of supporting a transfer-impact assessment rather than merely reciting that the recipient “shall comply with applicable law”.
Standard Contractual Clauses should be treated as part of the transaction architecture
The European Commission’s 2021 Standard Contractual Clauses were deliberately designed for complex processing chains involving controllers, processors and onward transfers. They require specific information about the parties, purposes, categories of data and security measures, and incorporate obligations concerning data-subject rights and public-authority access.
This has practical implications for a licensing agreement involving an Indian pharmaceutical company, a European sponsor and multiple service providers. The licence should identify whether the Indian party is receiving the data as an independent controller, processor or another legally recognised role. It should also avoid allowing a general sublicensing clause to become an uncontrolled onward-transfer mechanism.
A well-structured arrangement should instead connect the commercial licence with a processing schedule. The schedule should specify permitted purposes, categories of data, retention periods, approved locations, subprocessors, security requirements and deletion or return obligations. Where algorithmic models are involved, it should additionally address whether the model may retain information derived from the licensed dataset after the underlying records are deleted.
Privacy does not eliminate the separate IP value of regulatory data
The privacy analysis is still only part of the picture because pharmaceutical datasets may also carry substantial confidential commercial value. Article 39.3 of TRIPS requires protection of undisclosed test or other data submitted for approval of pharmaceutical or agricultural chemical products against unfair commercial use, subject to the conditions contained in the provision. It does not, by itself, create a universal data-exclusivity regime equivalent to the patent system.
That distinction is highly relevant to India. The India-EU trade negotiations concluded in January 2026, and the Indian Government has stated that the agreed framework does not impose a TRIPS-plus pharmaceutical data-exclusivity obligation. The value of clinical and regulatory data must therefore often be protected through a combination of confidentiality, contractual restrictions, regulatory rules and other applicable intellectual-property mechanisms rather than assuming that the dataset enjoys an independent proprietary monopoly.
For licensing agreements, this means the parties should identify whether the licensed material consists of patient data, regulatory submissions, confidential know-how, analytical methods, source documentation or aggregated research outputs. Different legal protections attach to each category.
Conclusion
The India-EU framework is moving towards interoperability, not automatic uniformity. It has acquired a more significant digital dimension. Negotiations for the India-EU Free Trade Agreement concluded on 27 January 2026, and the agreement contains digital-trade provisions concerning data flows and personal-data protection while preserving regulatory space for both parties. The current published text also makes clear that the agreement is not itself a substitute for each side’s applicable data-protection law and requires completion of domestic procedures before it becomes legally binding.
The practical implication for pharmaceutical businesses is that regulatory convergence may gradually reduce transaction friction, but it will not remove the need for jurisdiction-specific compliance. A single master licence should therefore contain a flexible compliance architecture capable of operating across Indian and EU requirements.
The central drafting principle is simple - license the commercial rights contractually, but govern the personal data independently through purpose, lawful processing, security and transfer mechanisms.
References
- Ministry of Electronics and Information Technology, Notification GSR 843(E), ‘Enforcement Timeline for the Digital Personal Data Protection Act, 2023’ (13 November 2025) (https://www.dpdpact2023.com/Section_1)
- Ministry of Health and Family Welfare, New Drugs and Clinical Trials Rules, 2019, Central Drugs Standard Control Organization (https://cdsco.gov.in/opencms/resources/UploadCDSCOWeb/2022/new_DC_rules/NEW%20DRUGS%20ANDctrS%20RULE,%202019.pdf)
- Indian Council of Medical Research and Ministry of Health and Family Welfare, Joint MoHFW-ICMR Guidelines for Ethical Use of Leftover De-identified/Anonymous Samples for Commercial Purpose (2024) (https://www.icmr.gov.in/icmrobject/uploads/Guidelines/1732704229_guidelinesforethicaluse.pdf)
- Regulation (EU) 2016/679 (General Data Protection Regulation), Article 9.
- Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 44-46.
- Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems (Case C-311/18) EU:C:2020:559.
- European Commission, Commission Implementing Decision (EU) 2021/914, 4 June 2021 (https://op.europa.eu/en/publication-detail/-/publication/55862dbf-c72b-11eb-a925-01aa75ed71a1)
- European Parliament, Parliamentary Question P-002961/2023, 6 December 2023 (https://www.europarl.europa.eu/doceo/document/P-9-2023- 002961_EN.html)
- European Commission, ‘Joint Communication on the EU-India Strategic Partnership’ and related EU-India digital cooperation materials (2025) (https://www.europarl.europa.eu/legislative-train/theme-europe-as-a-stronger-global-actor/file-eu-india-agenda)
- Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS), Article 39.3.
- Government of India, Press Information Bureau, ‘Questions & Answers on India-EU Free Trade Agreement’ (2026) (https://www.pib.gov.in/PressReleasePage.aspx?PRID=2220413®=48&lang=2)
- European Commission and Government of India, India-European Union Free Trade Agreement, concluded 27 January 2026 (https://ec.europa.eu/commission/presscorner/detail/en/ip_26_184)
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
