India is the world’s third-largest pharmaceutical producer by volume and tenth by value, supplying over 20% of global generic medicine exports. Operating in this sector requires more than commercial acumen; it demands precise compliance with an evolving, multi-layered legal framework that spans drug regulation, intellectual property, clinical trials, data protection, and foreign investment. This guide, prepared by Altacit Global, maps every critical legal obligation facing pharma companies, hospitals, biotech startups, and healthcare investors operating in India in 2026.
Key Takeaways
- The Drugs and Cosmetics Act, 1940 remains the primary legislation governing drug manufacturing and distribution; the proposed Drugs, Medical Devices and Cosmetics Bill, 2023 has not yet been enacted but signals significant regulatory change.
- Section 3(d) of the Patents Act, 1970 restricts evergreening of pharmaceutical patents, as confirmed by the Supreme Court of India in the landmark Novartis/Gleevec ruling of 2013.
- FDI in pharmaceutical companies is permitted at 100% (automatic route) for greenfield projects and up to 74% (automatic route) for brownfield projects, with government approval required above 74%.
- The Digital Personal Data Protection Act, 2023 (DPDP Act) classifies patient health data as sensitive personal data, with full enforcement expected by May 2027.
- Hyderabad (Genome Valley) and Chennai are India’s two most strategically significant pharma hubs, each presenting distinct regulatory and IP considerations for business structuring.
Key Laws Governing Healthcare and Pharma in India
India’s healthcare and pharmaceutical sector is governed by a layered set of central statutes, subordinate rules, and regulatory guidelines. Understanding how these instruments interact is foundational to any compliance strategy.
Drugs and Cosmetics Act, 1940 (and the Proposed Bill, 2023)
The Drugs and Cosmetics Act, 1940 is the cornerstone legislation governing the import, manufacture, distribution, and sale of drugs and cosmetics in India. It establishes schedules for drug classification, mandates Good Manufacturing Practices (GMP), and vests enforcement authority in both central and state drug authorities.
The Central Drugs Standard Control Organisation (CDSCO) operates as the national regulator under this Act. State Drug Controllers administer licensing and manufacturing approvals at the state level.
The proposed Drugs, Medical Devices and Cosmetics Bill, 2023 has been introduced to modernize this framework. It consolidates drug and medical device regulation into a single statute, introduces a risk-based classification system for medical devices, and strengthens penalties for spurious drugs. As of 2026, the Bill has not been enacted; the 1940 Act and its associated rules remain operative.
New Drugs and Clinical Trials Rules, 2019 (Amended 2023)
The New Drugs and Clinical Trials Rules, 2019 (NDCT Rules) govern the approval of new drugs and the conduct of clinical trials in India. These rules significantly reduced approval timelines, enabling simultaneous global clinical trials and fast-tracked approvals for drugs addressing unmet medical needs.
The 2023 amendments introduced stricter informed consent requirements, enhanced post-market surveillance obligations, and updated provisions for biologics and biosimilars. Sponsors must maintain complete trial master files and comply with mandatory pharmacovigilance reporting under Schedule Y.
Patents Act, 1970: Section 3(d) and Compulsory Licensing
The Patents Act, 1970 governs pharmaceutical patent rights in India. Two provisions are particularly significant for pharma companies.
Section 3(d) prohibits the grant of patents for new forms of known substances (such as salts, polymorphs, or esters) unless the applicant demonstrates significantly enhanced therapeutic efficacy. The Supreme Court of India upheld this provision in Novartis AG v. Union of India (2013), rejecting Novartis’s patent application for Gleevec (imatinib mesylate). This ruling has defined the standard for pharmaceutical patent eligibility in India ever since.
Section 84 permits any person to apply for a compulsory license three years after a patent is granted if: (a) the reasonable requirements of the public have not been met; (b) the patented invention is not available at a reasonably affordable price; or (c) the patented invention is not worked in India. Natco Pharma v. Bayer (2012) established the first compulsory license granted in India, covering Nexavar (sorafenib tosylate).
Medical Devices Rules, 2017 (MDR 2017)
The Medical Devices Rules, 2017 established a dedicated framework for the regulation of medical devices in India, separating them from the broader drugs framework for the first time. Devices are classified into four risk-based classes (A, B, C, and D), each requiring a corresponding level of regulatory scrutiny prior to import or manufacture.
Class A and B devices require state-level licensing, while Class C and D devices require CDSCO approval. All device manufacturers must comply with Schedule 5 (Quality Management System requirements) and, for imported devices, demonstrate compliance with ISO 13485.
National Medical Commission Act, 2019 (NMC Act)
The National Medical Commission Act, 2019 replaced the Medical Council of India with the National Medical Commission (NMC) as the apex regulatory body for medical education and practice. The NMC Act introduced the National Exit Test (NEXT) for medical graduates, revised ethical guidelines for registered medical practitioners, and established a more transparent framework for medical college accreditation.
For hospitals and healthcare service providers, NMC regulations directly govern physician conduct, professional ethics, and continuing medical education obligations.
Clinical Establishments (Registration and Regulation) Act, 2010
The Clinical Establishments (Registration and Regulation) Act, 2010 mandates registration of all clinical establishments (including hospitals, nursing homes, diagnostic centers, and clinics) operating in India. It empowers the National Council for Clinical Establishments to prescribe minimum standards for infrastructure, staffing, and services.
State governments that have adopted the Act enforce registration requirements through State Councils. Hospitals, diagnostic chains, and outpatient facilities must ensure current registration and compliance with applicable minimum standards.
DPDP Act, 2023: Patient Data Obligations
The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a comprehensive data protection framework for all personal data processed in digital form. Patient health data is treated as a category requiring heightened protection under the DPDP Act.
Hospitals, diagnostics companies, and health-tech platforms that collect and process patient data must: (a) obtain free, specific, and informed consent before processing; (b) limit data collection to stated purposes; (c) implement reasonable security safeguards; and (d) establish mechanisms for patients to exercise their data rights. Full enforcement under the DPDP Act is expected by May 2027, though companies are advised to begin compliance structuring immediately.
Drugs, Medical Devices and Cosmetics Bill, 2023: What Changes for Pharma?
The Drugs, Medical Devices and Cosmetics Bill, 2023 represents the most significant proposed overhaul of India’s pharmaceutical regulatory framework in over eight decades. Key changes proposed under the Bill include:
Feature | Drugs and Cosmetics Act, 1940 | Proposed Bill, 2023 |
Medical Device Regulation | Governed under MDR 2017 (subordinate rules) | Integrated into primary legislation |
Drug Classification | Schedule-based | Risk-based, tiered classification |
Penalties for Spurious Drugs | Imprisonment up to life | Enhanced penalties including minimum mandatory terms |
E-Pharmacy Regulation | Not covered | Dedicated provisions proposed |
Combination Products | Not addressed | Addressed under new definitions |
Until the Bill is enacted and notified, all pharma companies and medical device manufacturers must continue full compliance with the Drugs and Cosmetics Act, 1940, the Medical Devices Rules, 2017, and associated CDSCO guidelines.
CDSCO: The Pharma and Medical Device Regulator
The Central Drugs Standard Control Organisation (CDSCO) functions under the Directorate General of Health Services, Ministry of Health and Family Welfare. CDSCO is responsible for:
- Granting approval for new drugs and clinical trials under the NDCT Rules, 2019.
- Regulating import and export of drugs, cosmetics, and medical devices.
- Setting quality standards in coordination with the Indian Pharmacopoeia Commission.
- Overseeing post-market surveillance and pharmacovigilance.
- Evaluating applications under the Medical Devices Rules, 2017.
CDSCO maintains zonal offices across India, with key offices in Mumbai, Chennai, Kolkata, Hyderabad, and Ahmedabad. Pharma companies based in Hyderabad’s Genome Valley and Chennai’s pharmaceutical manufacturing corridor interact frequently with CDSCO’s Southern zonal office.
New drug approval applications are submitted through CDSCO’s Sugam online portal. The standard review timeline for a new drug application is twelve months; for priority reviews involving unmet medical needs, accelerated timelines of six months apply.
Patent Strategy for Pharma Companies
A robust patent strategy is a competitive and commercial necessity for pharmaceutical companies operating in India. Altacit Global advises clients across three core dimensions:
1. Patentability Assessment Under Section 3(d)
Before filing, applicants must assess whether the compound or formulation clears the Section 3(d) threshold. Where the active ingredient is a known substance, the applicant must compile data demonstrating significantly enhanced therapeutic efficacy (not merely improved solubility or bioavailability alone).
2. Filing Strategy and PCT Applications
For new chemical entities (NCEs) with global commercialization plans, filing under the Patent Cooperation Treaty (PCT) with India as a designated state is advisable. This preserves the priority date while allowing parallel prosecution across jurisdictions.
3. Patent Term and Supplementary Protection
India does not currently provide Patent Term Extensions (PTEs) for regulatory delays. The standard patent term is 20 years from the date of filing. Pharma companies must factor this into commercialization timelines, particularly for compounds with lengthy clinical development phases.
For a detailed analysis of pharmaceutical patent prosecution strategy, refer to Altacit Global’s Pharma Patent Strategy Guide.
IP Strategy for Pharma and Healthcare Companies
Intellectual property strategy for healthcare and pharma companies extends well beyond patent filing. Altacit Global structures IP programs across four distinct areas.
Drug Brand Trademarks
Pharmaceutical brand protection in India requires careful selection and registration of drug brand names. The Trade Marks Act, 1999 governs registration, and the Drug Controller General of India (DCGI) requires that new drug brand names not be deceptively similar to existing approved drug names under Schedule D of the Drugs and Cosmetics Rules.
Companies must conduct dual clearance searches: one under the Trade Marks Registry and one against the CDSCO drug name database, before launching any branded pharmaceutical product.
Trade Secrets for Formulations
Proprietary formulations, process chemistry data, and manufacturing know-how that do not qualify for patent protection can be protected as trade secrets. India does not yet have a standalone trade secrets statute, but protections are available through confidentiality agreements, employment contracts, and common law remedies.
Pharma companies should implement formal trade secret classification protocols, restrict access to formulation data on a need-to-know basis, and ensure all third-party technology transfer agreements include robust confidentiality obligations.
Regulatory Data Protection
India does not currently provide formal data exclusivity for clinical trial data submitted in support of new drug approvals. The NDCT Rules, 2019 include limited provisions against reliance on undisclosed test data for commercial purposes, but these protections are narrower than the data exclusivity regimes in the United States or European Union.
This is a critical consideration for companies evaluating India as a launch market for NCEs, particularly in the context of follow-on generic competition. Altacit Global’s IP advisory practice regularly advises on structuring market entry strategies to account for this limitation.
IP Due Diligence in Pharma M&A
Pharmaceutical mergers and acquisitions require detailed IP due diligence covering: (a) freedom-to-operate analysis for core product lines; (b) validity assessment of acquired patents, including Section 3(d) risk; (c) status of pending patent oppositions (both pre-grant and post-grant); (d) trademark clearance and assignment; and (e) review of licensing agreements for change-of-control clauses.
Altacit Global conducts end-to-end IP due diligence for pharma M&A transactions, with particular expertise in deals involving companies headquartered in Hyderabad and Chennai.
Clinical Trial Compliance in India
Clinical trial sponsors must comply with the New Drugs and Clinical Trials Rules, 2019 at every stage of trial conduct. The compliance framework covers:
- Ethics Committee Approval: All trials must be approved by an CDSCO-registered Ethics Committee before commencement.
- CDSCO Permission: New drug trials require prior permission from the Drug Controller General of India (DCGI).
- Informed Consent: Written informed consent must be obtained in the participant’s language; video documentation is mandatory for Phase I trials.
- Compensation for Trial-Related Injury: Sponsors must provide financial compensation for trial-related injury or death, calculated as per CDSCO’s formula.
- Serious Adverse Event (SAE) Reporting: SAEs must be reported to CDSCO and the Ethics Committee within 14 days.
- Pharmacovigilance: Post-approval, companies must participate in India’s Pharmacovigilance Programme (PvPI) and submit periodic safety update reports.
For a complete compliance checklist, refer to Altacit Global’s Clinical Trial Compliance Guide .
Healthcare Company Structuring and Investment
Choosing the correct corporate structure is foundational for healthcare and pharma companies operating in India. The principal options are:
Structure | Best Suited For | Key Regulatory Consideration |
Private Limited Company | Startups, VC-backed companies | Companies Act, 2013 compliance; DPDP Act applicability |
Limited Liability Partnership (LLP) | Professional services, diagnostics | Not eligible for direct FDI in pharma manufacturing |
Joint Venture (JV) | Technology transfer, brownfield pharma | FDI policy compliance; compulsory licensing risk assessment |
Branch / Liaison Office | Foreign pharma market entry | FEMA compliance; restricted commercial activity |
FDI Rules for Pharmaceutical Companies (2026)
FDI in the pharmaceutical sector is governed by the Foreign Exchange Management Act, 1999 (FEMA), the Foreign Direct Investment Policy, and SEBI regulations for listed entities. The applicable rules are:
- Greenfield Pharmaceutical Projects: 100% FDI permitted under the automatic route.
- Brownfield Pharmaceutical Projects: Up to 74% FDI permitted under the automatic route. FDI above 74% requires prior government approval through the Foreign Investment Facilitation Portal (FIFP).
Medical device manufacturing is treated as a separate sector and currently permits 100% FDI under the automatic route for both greenfield and brownfield projects. For detailed guidance on pharma FDI structuring, refer to Altacit Global’s Corporate FDI Advisory.
DPDP Act and Patient Data: Compliance for Hospitals and Healthcare Companies
The Digital Personal Data Protection Act, 2023 introduces obligations that are particularly significant for hospitals, diagnostic centers, health-tech platforms, and any organization processing electronic patient health records.
Classification of Patient Health Data
Patient health information is personal data under the DPDP Act. Given its inherently sensitive nature, the Central Government is expected to designate health data as a category warranting heightened protection through rules to be notified prior to full enforcement in May 2027.
Key Obligations for Healthcare Data Fiduciaries
- Consent Management: Obtain explicit, purpose-specific consent before collecting or processing patient data. Consent must be as easy to withdraw as it is to give.
- Data Minimization: Collect only the data necessary for the stated healthcare purpose.
- Purpose Limitation: Do not repurpose patient data (such as for pharmaceutical research or marketing) without fresh consent.
- Security Safeguards: Implement appropriate technical and organizational measures. This includes encryption of health records, access control logs, and breach response protocols.
- Data Principal Rights: Establish mechanisms for patients to access their data, correct inaccuracies, and request erasure where legally permissible.
- Cross-Border Data Transfers: Until the Central Government notifies approved transfer frameworks, treat cross-border transfers of patient data with caution and seek legal opinion before proceeding.
Hospital networks, diagnostic chains, and health-tech companies operating in cities like Hyderabad, Chennai, Bangalore, Kochi, and Coimbatore should prioritize DPDP Act compliance programs now, ahead of full enforcement. Altacit Global’s DPDP Compliance team supports healthcare organizations at every stage of this process. For a detailed compliance roadmap, refer to Altacit Global’s DPDP Compliance Guide.
Build Your Pharma Compliance Program with Altacit Global
Operating a pharmaceutical company, hospital, or healthcare startup in India requires precise alignment with a regulatory framework that is simultaneously comprehensive and continuing to evolve. Altacit Global provides end-to-end legal and regulatory advisory services to pharma companies, medical device manufacturers, biotech startups, hospitals, and healthcare investors across India.
Our teams in Chennai, Hyderabad, Bangalore, Kochi, and Coimbatore work with compliance heads, legal directors, and senior management to structure IP strategies, navigate CDSCO approvals, address DPDP Act obligations, and advise on FDI-compliant corporate structures.
To schedule a consultation with Altacit Global’s healthcare and pharma practice, contact us at info@altacit.com.
Frequently Asked Questions: Healthcare Law India Pharma
Q1: What is the process for new drug approval in India?
New drug approval in India is governed by the New Drugs and Clinical Trials Rules, 2019 under the Central Drugs Standard Control Organisation (CDSCO). The process involves: (1) pre-submission consultation with CDSCO; (2) filing of a New Drug Application (NDA) through the Sugam portal with full clinical data, quality dossiers, and a proposed prescribing information document; (3) CDSCO scientific committee review; and (4) issuance of marketing approval by the DCGI. The standard timeline is 12 months, with a 6-month accelerated track available for drugs addressing unmet medical needs. Post-approval, the company must comply with post-market surveillance and pharmacovigilance obligations under Schedule Y of the Drugs and Cosmetics Rules.
Q1: Does India have data exclusivity protection for clinical trial data?
India does not have a formal data exclusivity regime comparable to the 5-year NCE exclusivity in the United States or the 8+2+1-year period in the European Union. The NDCT Rules, 2019 contain limited provisions that restrict unfair commercial use of undisclosed test data, but these protections do not prevent regulatory agencies from relying on originator data after approval. This is a material consideration for innovator pharma companies planning India launches for new chemical entities and should be factored into market entry and IP strategy.
Q1: What are the FDI rules for pharmaceutical companies in India?
For greenfield pharmaceutical manufacturing, 100% FDI is permitted under the automatic route, meaning no prior government approval is required. For brownfield pharmaceutical acquisitions, FDI up to 74% is permitted under the automatic route, while FDI above 74% requires prior approval from the Government of India through the Foreign Investment Facilitation Portal (FIFP). Medical device manufacturing (both greenfield and brownfield) permits 100% FDI under the automatic route. All FDI transactions must comply with the Foreign Exchange Management Act, 1999 and applicable SEBI regulations for listed entities.
Q1: What is Section 3(d) of the Patents Act and how does it affect pharma patents?
Section 3(d) of the Patents Act, 1970 provides that new forms of a known substance (such as new salts, polymorphs, hydrates, esters, or derivatives) are not patentable in India unless the applicant demonstrates significantly enhanced therapeutic efficacy over the known substance. This provision directly addresses the practice of “evergreening,” where companies seek secondary patents to extend effective market exclusivity beyond the original patent term. The Supreme Court of India upheld Section 3(d) in Novartis AG v. Union of India (2013), rejecting the patent application for imatinib mesylate (Gleevec). As a result, patent applications for modified forms of known drugs face a higher evidentiary threshold in India than in most other jurisdictions.
Q1: When will the new Drugs Bill replace the Drugs and Cosmetics Act, 1940?
The Drugs, Medical Devices and Cosmetics Bill, 2023 was introduced in Parliament to replace the Drugs and Cosmetics Act, 1940. As of 2026, the Bill has not been enacted. The 1940 Act, the Medical Devices Rules, 2017, the New Drugs and Clinical Trials Rules, 2019, and all associated CDSCO guidelines remain fully operative. Pharma companies should monitor parliamentary and Ministry of Health announcements for the Bill’s progress and plan for a transition period once enactment and notified effective dates are confirmed.
