Patient Consent - How is it different under medical ethics and data protection?

In the ethical and legal framework of medicine and law, consent has always existed. Within healthcare, it signifies the individual's right to be informed and to choose. However, in the digital era, consent assumes a broader function; it becomes the foundation for lawful processing of personal data. For the pharma and clinical-research sectors, this distinction carries significant implications. The Digital Personal Data Protection Act, 2023 (DPDPA), has redefined how personal and health-related data must be managed. This article explores why consent under data-protection law differs from medical consent, drawing lessons from the irregularities uncovered in the Ahmedabad clinical trials, and outlines the emerging compliance responsibilities under the DPDPA.

- 

In late 2025, the Ahmedabad Crime Branch exposed extensive irregularities in the conduct of clinical drug trials. Investigations revealed that multiple pharmaceutical companies and intermediary clinical research organisations (CRO) had engaged unauthorised agents to recruit volunteers, often offering small sums of money. Most participants were enrolled in trials concurrently, often without medical oversight, full disclosure to the volunteers, adequate sanitation, or safety precautions. Substandard testing practices raised immediate concerns about volunteer safety. What was initially viewed as a failure of medical ethics soon revealed a deeper structural weakness - the negligent handling of participants' personal data. Every clinical trial generates sensitive information health records, biological samples, test results, and demographic identifiers. When such data is processed without appropriate consent or oversight, the consequences extend beyond physical harm to include reputational damage and social discrimination. A data leak revealing a participant's genetic condition or infertility, for instance, can trigger stigma or even loss of livelihood. The Ahmedabad case, therefore, highlights not just ethical failure in clinical research, but also systemic disregard for data governance, a gap the DPDPA now seeks to bridge.

Distinguishing between medical and personal data consent