Consent for the trialis not consent for the product.

Research earns trust by staying inside the purpose it named.

In one line: Using trial participants' personal data for marketing is a new purpose. It would generally require fresh, specific consent under DPDPA.

The estate · Healthcare & PharmaHover to inspect

The protocol ends. The purpose ends with it.

The scene

The trial closed in 2021. The participant list survived in the medical affairs team's drive. In 2024 the brand team used it to invite ‘patients like you’ to a launch webinar. Every invitation was a new purpose, and not one had a consent behind it.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
Trial participants are our patients now. They consented to a protocol, not to a relationship. Ring-fence trial data from commercial systems.
The CRO handles the data. The sponsor that decides the purpose is the fiduciary; the CRO processes for it. Contract, audit and close out with every CRO.

Close-out as a data event

At trial close-out, decide what the law requires to be retained, for how long, and where. Everything else should be erased or returned, with a certificate.

Monday morning

  1. 01Search commercial systems for any trial participant data.
  2. 02Map every CRO and site that still holds copies.
  3. 03Add data close-out to the trial close-out checklist.

Questions, answered plainly

Can pharma companies reuse clinical trial data for marketing?

Using trial participants' personal data for marketing is a new purpose. It would generally require fresh, specific consent under DPDPA.

Is a CRO a Data Processor under DPDPA?

Where a CRO processes participant data on the sponsor's instructions, it generally acts as a Data Processor, and the sponsor as Data Fiduciary remains responsible.

Sector · Healthcare & PharmaThe Act has no 'sensitive' category. Your patients do.Read → Healthcare & Pharma · Deep diveTreatment is not a blank cheque.Read → Healthcare & Pharma · Deep diveThe report on WhatsApp is still your report.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner