India

This Article examines the impact of the Digital Personal Data Protection Act, 2023 (“DPDP Act/Act”) on pharmaceutical companies in so far as the collection, processing, storage and sharing of personal and sensitive health data is concerned. While the Act strengthens a patient’s privacy, and data protection, it also poses operational, legal and financial challenges, especially for multinational players handling cross-border data transfers and legacy data systems. INTRODUCTION On 13th November, 2025, the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 (“Rules”). The Rules impose strict regulations regarding how the organizations should collect, store, process, transfer and safeguard the personal data of individuals. The implementation of these Rules has directly impacted several healthcare stakeholders, including hospitals, pharmaceutical companies and digital health platforms since the core activities of pharmaceutical companies are data intensive and involves handling sensitive patient data. The Act has introduced certain legal and strategic implications to ensure that the personal data of the patients remains safeguarded while also recognizing the need to process and use such data for lawful purposes.[1] With the passing of the DPDP Act, the pharmaceutical companies will be required to exercise additional care, especially during investigations to ensure the integrity and confidentiality of personal data. LOSS FACED BY PHARMACEUTICAL COMPANIES DUE TO DATA BREACHES In case of pharmaceutical companies, the patient whose personal health/trial data is being used is the ‘Data Principal’ and the drug manufacturer, hospital or pharmaceutical industry which are responsible for processing the data, under most circumstances, operate as a ‘Data Fiduciary’. According to IBM 2021 Cost of a Data Breach Report, the pharmaceutical industry suffered a huge loss amounting to over $5 million, due to breach of data, ranking third highest among all industries. There has been a significant rise in the number of data breaches impacting several big pharmaceutical companies in recent years. The data breach of patient records has led to several consequences including identity theft, financial fraud, and in some cases, the patients have even suffered physical harm where the medical information has fallen into wrong hands. Therefore, it is imperative that pharmaceutical companies should prioritize data privacy and implement measures to safeguard sensitive information.[2]   IMPLICATIONS OF DATA PRIVACY BREACHES ON PHARMACEUTICAL COMPANIES Financial Losses- Data privacy breaches can result in revenue losses due to operational disruptions and significant legal expenditure Legal Liabilities- The patients, healthcare providers and regulatory bodies may initiate legal proceedings against the pharmaceutical companies if such companies fail to protect the sensitive data received. Reputational damage- Breaches of data protection obligations can compromise the goodwill of a company and may adversely affect its relationships across the healthcare ecosystem. KEY CHALLENGES FOR PHARMACEUTICAL COMPANIES UNDER DPDP ACT Under Section 6(4) of the DPDP Act the Data Principal has the right to withdraw their consent with respect to processing of their personal data at any time. Once the Data Principal withdraws their consent, the Data Fiduciary is under an obligation to stop processing their data unless they are lawfully permitted to do so. The granting of this right to the Data Principal can be very challenging for the healthcare industries since medical history serves as an important tool for providing quality medical care. For example, where a doctor requires access to prior medical history of a patient in order to prescribe appropriate medication, withdrawal of consent for processing such medical history may significantly impair the ability of the doctor to provide optimal treatment.   Section 8(7) of the DPDP Act requires a Data Fiduciary to erase the personal data if the Data Principal withdraws consent or where it is determined that the purpose for which such data was processed is no longer being served. For example, a patient may withdraw consent to disclose medical records to a particular doctor, while continued retention of those records remains essential for sharing with other treating doctors in the future.[3] FRAMEWORK FOR PROTECTION OF PERSONAL DATA The protection of personal and sensitive data in the pharmaceutical sector may be supported through the following practices: Data Minimization- Companies may limit the collection and retention of personal data to what is necessary for legitimate business purposes. The practice of data minimization reduces the volume of personal data processed and retained, thereby lowering the risk of unauthorized access, accidental disclosure or misuse. Access Controls- Robust role-based access controls may be implemented including multi-factor authentication and periodic access reviews. Additionally, regular audits shall be conducted to ensure that only authorized personnel can access the personal data. Encryption- Personal Data, both in transit and at rest shall be encrypted using current industry standard, algorithms and protocols, in order to prevent the risk of unauthorized access and data breaches. Secure data storage- Personal data shall be stored only in secure, encrypted databases or reputable DPDP compliant cloud environments that enforce strict access controls, logging and monitoring with appropriately designed backup and recovery mechanisms. Employee training- Personnel of the Company may receive structured and periodic training on data privacy and security best practices, including secure handling of personal data identifying and reporting any possible breach, fostering a culture of awareness regarding privacy. Third Party Risk Management- Pharmaceutical companies shall conduct due diligence exercises and carefully monitor third-party vendors and partners accessing personal data ensuring that such third parties are bound by strict contractual, technical and organizational data‑protection and security requirements and are periodically assessed for compliance.   CONCLUSION Data privacy is both a legal and ethical commitment within the pharmaceutical industry and a need for a stringent healthcare safety and privacy setup is a matter of utmost priority. It is crucial to preserve confidentiality and ensure data privacy in medical records since healthcare information is directly linked to public confidence. Keeping in view the recent cyber-attacks on healthcare organizations such as AIIMS and ICMR, it has become necessary that the security and regulation of healthcare personal data within India is strengthened and the DPDP ensures that this takes place by giving patients broader rights and increasing compliance obligations on Data Fiduciaries. [1] Sahil Kanuga and Sara Sundaram, “Reshaping investigations in the pharma industry: Ensuring compliance under the DPDP Act”, Express Pharma, https://www.expresspharma.in/reshaping-investigations-in-the-pharma-industry-ensuring-compliance-under-the-dpdp-act/ (accessed 19th December, 2025). [2] “Data Privacy Challenges and Solutions for Pharmaceutical Companies”, Privacy Pillar, https://privacypillar.com/data-privacy-for-pharmaceutical-industry/ (accessed 19th December, 2025). [3] AMLEGALS, “Data Privacy”, AMLEGALS STRATEGIC LAWYERING, https://amlegals.com/impact-of-the-digital-personal-data-protection-act-2023-on-the-healthcare-industry/ (accessed 22nd December, 2025).

New Delhi, January 08, 2026: Lakshmikumaran & Sridharan Attorneys acted as legal advisor to BlueScope Steel Limited, Australia, in connection with the sale of its shareholding in an Indian joint venture to Tata Steel Limited, India, in a transaction valued at approximately INR 1,100 crore (USD 125 million). The transaction involved the sale of shares held by BlueScope Steel Limited through its Australian subsidiary in the Indian joint venture, marking a significant cross-border divestment in the steel sector. The LKS team provided advisory support on direct tax and foreign exchange (FEMA) implications arising from the transaction and assisted BlueScope on a time-to-time basis throughout the deal lifecycle. A key highlight of the transaction was LKS assisting BlueScope Steel Limited in obtaining a lower withholding tax certificate within a period of 10 days, which resulted in a reduction of tax withholding by Tata Steel Limited to the extent of approximately INR 60 crore on the share purchase consideration. This engagement underscores the firm’s capability in handling complex cross-border transactions, particularly those involving intricate tax and FEMA considerations in high-value M&A deals. The transaction team from LKS was led by Ravi Sawana (Partner) and comprised Asish Philip (Executive Partner), Neha Sharma (Associate Partner), Tanmay Bhatnagar (Associate Partner), Apurva Chaudhary (Senior Associate) and Shreyasi Chakraborty (Senior Associate). About Lakshmikumaran & Sridharan attorneys Lakshmikumaran & Sridharan (LKS) is a premier full-service law firm in India, specializing in areas such as corporate & M&A/PE, dispute resolution, taxation and intellectual property. The firm, through its 14 offices across India, works closely on Corporate, M&A, litigation and commercial law matters, advising and representing clients both in India and abroad. Over the last 4 decades the firm has worked with over 15,500 clients which range from start-ups, small & medium enterprises, to large Indian corporates and multinational companies. The professionals within the firm bring diverse experience to service clients across sectors such as automobiles, aviation, consumer electronics, e-commerce and retail, energy, EPC, financial services, FMCG, hospitality, IT/ITeS, logistics, metals, mining, online gaming, pharma and healthcare, real estate and infra, telecom and media, and textiles. The firm takes pride in the value-based, client-focused approach that combines knowledge of the law with industry experience to design bespoke legal solutions. The firm’s driving principles to achieve our vision are integrity, knowledge and passion.

Ryan International, a leading operator of K-12 educational institutions in India, has set up nine greenfield educational institutions across Ambala, Amritsar, Bengaluru, Hyderabad, Mumbai, and Pune in 2025. Universal Legal advised the Ryan Group on the acquisition of approximately 9 lakh square feet of land across these six cities through a combination of outright land purchases and long-term lease arrangements. The mandate included comprehensive title due diligence, transaction structuring, negotiation, documentation, and closing support. The transactions were led by Partners Neha Sehgal and Rashi Kapoor Mehta, with support from Associate Partner Angshuman Chaliha, Senior Associate Ruchita Krishnan, and Associate Preksha Shah. 161/162-A Mittal Court, A Wing, Jamnalal Bajaj Marg, Nariman Point, Mumbai- 400 021Tel: +91-22-66664292-93 E-mail: [email protected]: www.universallegal.firm.in

By Abdullah Hussain, Kanika Chaudhary Nayar & Ishan Handa   A Privilege Reaffirmed The recent judgement of the Supreme Court of India in Re: Summoning Advocates who give legal opinion[1] is not merely a legal ruling; it is a profound jurisprudential restatement of the very foundations of a robust justice delivery system. At its heart, the case concerned a seemingly innocuous notice issued by the Ahmedabad Police under Section 179 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023, to an advocate who had secured bail for his client. The notice peremptorily directed the advocate to appear ‘to know true details of the facts and circumstances’ of the case. The Supreme Court, exercising its suo motu powers, seized the issue, recognising that the casual summoning of counsel by investigating agencies strikes at the root of attorney-client relationship, a relationship that the Apex Court has previously[2] described as one of “trust and confidence”. The resulting judgement is a powerful reaffirmation of legal professional privilege (LPP) in India.   For practitioners in the complex and high-stakes arena of competition law, this judgement carries particularly significant weight. It fortifies the defences around client communications at a time when the investigative powers of regulators, including the Director General (DG) under the Competition Act, 2002, are increasingly expansive.   The Core of the Supreme Court’s Ruling: A Multi-Layered Shield The Court’s judgement meticulously dismantles the arguments for unbridled power to summon lawyers and, in doing so, erects a multi-layered shield to protect privileged communications. The Primacy of Section 132, BSA: The Court unambiguously held that the privilege under Section 132 of the Bharatiya Sakshya Adhiniyam (BSA), 2023, is a statutory mandate. No advocate can be compelled to disclose any communication made to him in the course and for the purpose of his/her professional engagement, unless such disclosure falls within the following narrow exceptions: Express consent of the client; Communication made in furtherance of an illegal purpose; or A fact observed showing the commission of a crime or fraud after the commencement of the engagement. The Court emphasised that this privilege, though conferred on the client, grants the advocate an immunity from coercion to disclose. It is not a mere procedural rule but a substantive right integral to the administration of justice.   A Resounding ‘No’ to Fishing Expeditions: Answering the first core question before it, the Court declared with an emphatic ‘No’ that an investigating agency cannot directly summon a lawyer ‘to elicit the details of the case’. Such an act is an ‘abject failure of the investigating agency’ and a blatant attempt to breach the ‘solemn privilege’ under Section 132.   Procedural Safeguards for Invoking Exceptions: Recognising that the exceptions could be misused, the Court instituted crucial procedural filters. If a summons is to be issued based on an exception (e.g., alleging the lawyer's involvement in a crime), it must: Explicitly state the facts justifying the invocation of the exception; Receive prior written approval from a hierarchical superior not below the rank of a Superintendent of Police, who must record their satisfaction in writing.   Robust Judicial Review: Any such summons is expressly made ‘amenable to judicial review’ under Section 528[3] of the BNSS. This provides an immediate and effective remedy for an aggrieved advocate or client.   Clarification on Documents and Digital Devices: The Court made a vital distinction between the disclosure of communication (protected) and the production of documents (not protected per se). However, it built in robust safeguards: A direction to produce documents must be complied with by production before the Court, not the investigating officer; The court must then decide on any objections regarding admissibility and privilege after hearing the client and the advocate; For digital devices, which contain a treasure trove of data concerning multiple clients, the process is even more rigorous. The device can only be examined in the presence of the advocate and the client, with the assistance of a digital expert of their choice, and the court must ensure the confidentiality of data relating to other clients is not impaired.   The Unfortunate Exclusion of In-House Counsel: In a significant, albeit contentious, part of the judgement, the Court held that in-house counsel, being full-time salaried employees, do not qualify as ‘Advocates’ under the Advocates Act, 1961, and are thus not entitled to claim the privilege under Section 132, BSA. Relying on its Constitution Bench ruling in Rejanish K.V. v. K. Deepa[4] and the reasoning of the European Court of Justice in Akzo Nobel[5], the Court found that in-house counsel lack the requisite degree of independence from their employer, being influenced by ‘commercial strategies’ and ‘close ties’. This creates a stark dichotomy between the protection afforded to external and internal legal advice, a point we will revisit in the competition law context.   III. The Ghost of the Competition (Amendment) Bill, 2020 This Supreme Court judgement must be viewed against the backdrop of a recent legislative attempt that sent shockwaves through the competition law community. The Competition (Amendment) Bill, 2020, proposed a radical amendment to Section 41 of the parent Act. The existing Section 41 empowers the DG, while investigating a contravention of the Act, to summon and enforce the attendance of any "person", examine them on oath, and compel the production of documents and records. The 2020 Bill sought to add an explanation stating that the term ‘person’ for the purposes of this section ‘shall include an advocate, a chartered accountant, a company secretary, and a cost accountant’. The intent was unambiguous: to arm the DG with the explicit power to question legal advisors and compel them to provide evidence, potentially including their communications with clients during a dawn raid or investigation. The pushback from the industry bodies and legal experts was swift and severe. The proposal was criticised as a direct assault on LPP, which would fundamentally undermine the ability of companies to seek frank and candid legal advice on complex competition law issues such as merger control, leniency applications and compliance programmes. It was argued that such a power would place Indian businesses at a severe disadvantage compared to jurisdictions that fiercely protect LPP. Facing this staunch opposition, the government, in its wisdom, withdrew this specific proposal before the Bill was passed as the Amendment Act in 2023.   The Supreme Court's judgement in Re: Summoning Advocates effectively slams the door shut on any future resurrection of such a proposal. By grounding the privilege in statutory interpretation, the Court has made it clear that any statutory amendment that seeks to casually abrogate LPP would face an insurmountable constitutional challenge. Implications for Competition Law Investigations: A New Fortress The principles laid down by the Supreme Court have direct and immediate application to the conduct of competition law investigations in India. Dawn Raids and On-Site Inspections: During a dawn raid, DG officials have the power to search premises and seize documents. It is common practice for companies to immediately involve their external legal counsel. This judgement empowers counsel to firmly resist any attempts by the DG to question them about the advice they have provided to the company regarding the investigation or the underlying conduct. Any such questioning would fall squarely within the prohibited realm of seeking ‘details of the case’ from the advocate.   Summons to External Lawyers: The DG can no longer issue a routine summons to an external competition lawyer who is advising a company under investigation, seeking their version of events or their understanding of the client's conduct. The Supreme Court's ‘emphatic No’ applies with full force. If the DG believes that the lawyer is no longer merely an advisor but a participant in a cartel or a fraud (e.g., drafting a sham agreement to conceal a cartel), the heavy burden is on the DG to first satisfy the procedural requirements, recording specific facts and obtaining high-level internal approval, before a summons can even be issued.   Seizure of Legal Communications: The judgement provides strong ammunition to challenge the seizure of documents and emails between a company and its external lawyers. While the DG may seize a document physically, its admissibility and the ability to use it as evidence can be contested on grounds of LPP.   The Persistent Vulnerability of In-House Counsel: This remains the Achilles’ heel for corporations. The Supreme Court's denial of Section 132 privilege to in-house counsel means that communications with internal legal teams enjoy a significantly lower level of protection. The DG is on far firmer ground to summon an in-house counsel for questioning and to seize their internal communications and notes. This reinforces the critical best practice for companies: sensitive legal advice, particularly on competition law compliance, cartel risks, and leniency strategy, must be sought from and documented in communications with external counsel. Internal legal advice should be framed with the understanding that it may not be privileged from disclosure to the DG.   A Comparative Lens: The Enduring Dichotomy and the Indian Echo of Akzo Nobel The Indian Supreme Court’s reliance on the Akzo Nobel ruling of the European Court of Justice reveals a deliberate alignment with a well established international position on legal professional privilege. In the EU, as in India, the decisive factor is not the nature of the legal advice given, but the status of the advisor. The core reasoning, consistently upheld, is that in-house lawyers, by virtue of their employment relationship, lack the requisite independence from their employer. This economic and structural dependency is seen as fundamentally incompatible with the kind of detached professional judgment required for communications to be deemed ‘privileged’.   This creates a clear rule, privilege attaches to the channel of communication (external lawyer), not necessarily to the content (legal advice). For companies, this means that the strategic choice of advisor, internal versus external, remains the primary determinant of whether their communications are protected from disclosure to authorities. The judgement thus entrenches a practical imperative, to secure privilege, sensitive competition law advice must be sought from outside the corporate structure.   Conclusion: A Fortified Bulwark, A Clarified Frontier The Supreme Court’s ruling serves as a powerful affirmation of legal professional privilege for the independent Bar, strengthening a fundamental pillar of the justice system. For competition law practice, it provides much-needed certainty and robust procedural safeguards against the compelled disclosure of communications with external counsels. The ghost of the 2020 amendment has been decisively laid to rest. However, the judgement also draws a bright and unambiguous line in the sand, one that mirrors the long-standing position in jurisdictions like the European Union. By explicitly adopting the Akzo Nobel rationale, the Court has clarified that in India, as in the EU, privilege is a function of the advisor’s independence, not merely the content of the advice. This formalistic distinction prioritizes a clear rule over a nuanced assessment of an in-house lawyer’s actual function. The practical outcome is a two-track system of legal protection. External legal advice enjoys a fortified, near-absolute shield. In-house counsel, despite their critical role in governance and compliance, operate in a zone of far greater exposure. Their communications and work product will be subject to scrutiny by the Director General. Consequently, the strategic imperative for corporations is unmistakable. To create an inviolable space for candid legal discussion on high-stakes competition matters, be it cartel defence, merger strategy, or leniency applications; engagement with external counsel is not just advisable; it is now essential. The judgement does not diminish the value of in-house teams but sharply defines the limits of the confidentiality they can guarantee. Moving forward, effective competition law risk management in India will hinge on a deliberate and disciplined channelling of sensitive communications across this newly clarified boundary. [1] Suo Motu Writ Petition (Criminal) No.2 of 2025 [2] State of U.P. and Ors. v. U.P. State Law Officers Association & Ors ; (1994) 2 SCC 204 [3] Saving of inherent powers of High Court. [4] 2025 SCC OnLine SC 2196 [5] European Court Reports 2010 I-08301