India

In recent years, stablecoins have emerged as one of the most significant innovations in the digital asset ecosystem. A stablecoin is a digital token pegged to a stable asset such as fiat currencies or commodities like gold. By combining blockchain efficiency with the stability of the underlying asset, especially in fiat-backed models, stablecoins claim to enable faster, cheaper payments and e-commerce transactions.  Supporters argue that stablecoins offer a predictable underlying value and are therefore, relatively less volatile than other cryptocurrencies, making them a preferred mode of payment for cross-border settlements. It is because of these qualities that stablecoins with sovereign backing are becoming popular in various jurisdictions and have gained legislative momentum. The United States of America (US) has passed landmark legislation in the form of the Guiding and Establishing National Innovation for US Stablecoins Act (“GENIUS Act”) to regulate stablecoins. Under the GENIUS Act, only approved ‘Permitted Payment Stablecoin Issuers’ (“PPSIs”) are allowed to issue stablecoins pegged to the United States Dollar (USD). Such stablecoins issued by the PPSIs are required to maintain a 1:1 ratio of the reserves backed by high quality liquid assets like the US currency and US Treasury Bills.  Similarly, Hong Kong enacted its Stablecoin Ordinance[1] which is effective from August 2025. Under this regime, the licensed issuers of fiat-referenced stablecoins are required to maintain high quality reserve assets pool free of any charge at least equal to the par value of the outstanding stablecoins in circulation. Indian Regulatory Landscape For more than a decade, there has been a regulatory vacuum in India with respect to the usage of cryptocurrencies. In 2013, the Reserve Bank of India (“RBI”) issued its official public advisory[2] which warned the users of the potential risks associated with the use of cryptocurrency including the concerns pertaining to security and consumer protection, volatility and possibility of money laundering among others. In 2018, the RBI issued a decisive regulatory circular[3] wherein it prohibited banks and other financial institutions from aiding individuals or entities dealing in cryptocurrencies or any other form of virtual digital assets (“VDAs”). However, this circular was challenged before the Hon’ble Supreme Court of India in the case of Internet and Mobile Association of India v. Reserve Bank of India[4]. The apex court held that such blanket restriction was irrational, given that there was no empirical evidence of any actual harm. It pointed out that there was a need for a more practical and nuanced approach to regulate the use of cryptocurrencies and other VDAs in the country which would help in balancing the innovation with the risk management. However, rather than enacting a comprehensive regulation, the government issued a 30% (thirty percent) tax on gains from VDAs under Section 115BBH of the Income Tax Act, 1961, effective from April 1, 2022. In 2017, an inter-ministerial committee was set up by the Ministry of Finance, to study the issues related to virtual currencies and propose specific actions to be taken in this matter. The committee published its report in February 2019 recommending implementation of law banning all private cryptocurrencies except the ones issued by the State. Stablecoin- A currency? As per the present foreign exchange framework, the treatment of stablecoins becomes a tricky factor thereby leading to ambiguity. They do not fall under the definition of ‘currency’ as provided under Section 2(h) of the Foreign Exchange Management Act, 1999 (“FEMA”) as they are neither currency notes, postal notes, postal orders, money orders, cheques, drafts, travellers cheques, letters of credit, bills of exchange and promissory notes or credit cards nor have they have been notified by RBI as currency separately. Therefore, it is possible for the RBI to notify stablecoins as a currency if there is policy alignment. Stablecoin- A security? Further, stablecoins are often compared to investment instruments such as mutual funds and exchange-traded funds (ETFs). Both mutual funds and ETFs are recognized ‘securities’ under Section 2(h)(i) of the Securities Contracts (Regulation) Act, 1956[5]. However, stablecoins differ from both mutual funds and ETFs, because they do not represent a claim on a pool of securities or any market-traded index, instead, they are a direct representation of the underlying reserve asset. Thus, unlike mutual funds and ETFs, they fall into a regulatory vacuum.  Additionally, they do not fall under the definition of ‘security’ under Section 2 (za) of FEMA.  It is pertinent to note that the Income Tax Act, 1961 defined VDAs, which encompasses cryptocurrencies and stablecoins. This underlines the legislative intent to treat stablecoins distinctly from securities. Recently, the Hon’ble Madras High Court in the case of Rhutikumari vs. Zanmai Labs Private Limited[6] has observed that ‘cryptocurrency’ is not a currency. However, it is a ‘property’, which is capable of being enjoyed and possessed (in a beneficial form) and is capable of being held in trust. A critical issue for cross border transactions FEMA distinguishes between current account transactions (payments for trade, remittances, services not creating assets/liabilities) and capital account transactions (those altering assets/liabilities in or outside India). Stablecoins create classification uncertainty, i.e. if treated as currency, they fall under current account rules; if viewed as investments or asset holdings, they trigger capital account restrictions under FEMA. Since the stablecoins do not clearly qualify as any instrument under FEMA, the need for a specific classification becomes crucial to eliminate the ambiguity and use stablecoins for cross-border transactions. It may be pointed out that despite regulatory uncertainties, India has an active investor base for cryptocurrencies, and such transactions now form a significant proportion of the total cross border remittances. Policy direction for regulation The debate around the regulation of stablecoin has gained momentum in the backdrop of global regulation. In India, the government should consider whether stablecoins can be used as a tool to strengthen the Indian Rupee. This would require a wider debate amongst all stakeholders. Indian regulators are now at a crossroad, and a choice will have to be made. Either we can continue with caution and impose a blanket ban on stablecoins, which may eventually disincentivize fintech innovation or we can develop a framework for regulation which is suitable to Indian requirements with required level of ring-fencing to preserve the traditional financial systems. *** The article is authored by: Mr. Siddharth Suresh (Partner), DSK Legal ([email protected]) Mr. Prateek Kumar Singh (Senior Associate), DSK Legal ([email protected]) Siddharth Suresh is a partner, and Prateek Kumar Singh is a senior associate at DSK Legal. [1] https://www.elegislation.gov.hk/hk/2025/17!en [2] https://www.rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=30247 [3] https://www.rbi.org.in/commonman/English/Scripts/Notification.aspx?Id=2632 [4] Writ Petition (Civil) NO. 528 of 2018 [5] Securities include shares, scrips, stocks, bonds, debentures, debenture stock or other marketable securities of a like nature in or of any incorporated company or a pooled investment vehicle or other body corporate. [6] O.A.No.194 of 2025    

This Article examines the impact of the Digital Personal Data Protection Act, 2023 (“DPDP Act/Act”) on pharmaceutical companies in so far as the collection, processing, storage and sharing of personal and sensitive health data is concerned. While the Act strengthens a patient’s privacy, and data protection, it also poses operational, legal and financial challenges, especially for multinational players handling cross-border data transfers and legacy data systems. INTRODUCTION On 13th November, 2025, the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 (“Rules”). The Rules impose strict regulations regarding how the organizations should collect, store, process, transfer and safeguard the personal data of individuals. The implementation of these Rules has directly impacted several healthcare stakeholders, including hospitals, pharmaceutical companies and digital health platforms since the core activities of pharmaceutical companies are data intensive and involves handling sensitive patient data. The Act has introduced certain legal and strategic implications to ensure that the personal data of the patients remains safeguarded while also recognizing the need to process and use such data for lawful purposes.[1] With the passing of the DPDP Act, the pharmaceutical companies will be required to exercise additional care, especially during investigations to ensure the integrity and confidentiality of personal data. LOSS FACED BY PHARMACEUTICAL COMPANIES DUE TO DATA BREACHES In case of pharmaceutical companies, the patient whose personal health/trial data is being used is the ‘Data Principal’ and the drug manufacturer, hospital or pharmaceutical industry which are responsible for processing the data, under most circumstances, operate as a ‘Data Fiduciary’. According to IBM 2021 Cost of a Data Breach Report, the pharmaceutical industry suffered a huge loss amounting to over $5 million, due to breach of data, ranking third highest among all industries. There has been a significant rise in the number of data breaches impacting several big pharmaceutical companies in recent years. The data breach of patient records has led to several consequences including identity theft, financial fraud, and in some cases, the patients have even suffered physical harm where the medical information has fallen into wrong hands. Therefore, it is imperative that pharmaceutical companies should prioritize data privacy and implement measures to safeguard sensitive information.[2]   IMPLICATIONS OF DATA PRIVACY BREACHES ON PHARMACEUTICAL COMPANIES Financial Losses- Data privacy breaches can result in revenue losses due to operational disruptions and significant legal expenditure Legal Liabilities- The patients, healthcare providers and regulatory bodies may initiate legal proceedings against the pharmaceutical companies if such companies fail to protect the sensitive data received. Reputational damage- Breaches of data protection obligations can compromise the goodwill of a company and may adversely affect its relationships across the healthcare ecosystem. KEY CHALLENGES FOR PHARMACEUTICAL COMPANIES UNDER DPDP ACT Under Section 6(4) of the DPDP Act the Data Principal has the right to withdraw their consent with respect to processing of their personal data at any time. Once the Data Principal withdraws their consent, the Data Fiduciary is under an obligation to stop processing their data unless they are lawfully permitted to do so. The granting of this right to the Data Principal can be very challenging for the healthcare industries since medical history serves as an important tool for providing quality medical care. For example, where a doctor requires access to prior medical history of a patient in order to prescribe appropriate medication, withdrawal of consent for processing such medical history may significantly impair the ability of the doctor to provide optimal treatment.   Section 8(7) of the DPDP Act requires a Data Fiduciary to erase the personal data if the Data Principal withdraws consent or where it is determined that the purpose for which such data was processed is no longer being served. For example, a patient may withdraw consent to disclose medical records to a particular doctor, while continued retention of those records remains essential for sharing with other treating doctors in the future.[3] FRAMEWORK FOR PROTECTION OF PERSONAL DATA The protection of personal and sensitive data in the pharmaceutical sector may be supported through the following practices: Data Minimization- Companies may limit the collection and retention of personal data to what is necessary for legitimate business purposes. The practice of data minimization reduces the volume of personal data processed and retained, thereby lowering the risk of unauthorized access, accidental disclosure or misuse. Access Controls- Robust role-based access controls may be implemented including multi-factor authentication and periodic access reviews. Additionally, regular audits shall be conducted to ensure that only authorized personnel can access the personal data. Encryption- Personal Data, both in transit and at rest shall be encrypted using current industry standard, algorithms and protocols, in order to prevent the risk of unauthorized access and data breaches. Secure data storage- Personal data shall be stored only in secure, encrypted databases or reputable DPDP compliant cloud environments that enforce strict access controls, logging and monitoring with appropriately designed backup and recovery mechanisms. Employee training- Personnel of the Company may receive structured and periodic training on data privacy and security best practices, including secure handling of personal data identifying and reporting any possible breach, fostering a culture of awareness regarding privacy. Third Party Risk Management- Pharmaceutical companies shall conduct due diligence exercises and carefully monitor third-party vendors and partners accessing personal data ensuring that such third parties are bound by strict contractual, technical and organizational data‑protection and security requirements and are periodically assessed for compliance.   CONCLUSION Data privacy is both a legal and ethical commitment within the pharmaceutical industry and a need for a stringent healthcare safety and privacy setup is a matter of utmost priority. It is crucial to preserve confidentiality and ensure data privacy in medical records since healthcare information is directly linked to public confidence. Keeping in view the recent cyber-attacks on healthcare organizations such as AIIMS and ICMR, it has become necessary that the security and regulation of healthcare personal data within India is strengthened and the DPDP ensures that this takes place by giving patients broader rights and increasing compliance obligations on Data Fiduciaries. [1] Sahil Kanuga and Sara Sundaram, “Reshaping investigations in the pharma industry: Ensuring compliance under the DPDP Act”, Express Pharma, https://www.expresspharma.in/reshaping-investigations-in-the-pharma-industry-ensuring-compliance-under-the-dpdp-act/ (accessed 19th December, 2025). [2] “Data Privacy Challenges and Solutions for Pharmaceutical Companies”, Privacy Pillar, https://privacypillar.com/data-privacy-for-pharmaceutical-industry/ (accessed 19th December, 2025). [3] AMLEGALS, “Data Privacy”, AMLEGALS STRATEGIC LAWYERING, https://amlegals.com/impact-of-the-digital-personal-data-protection-act-2023-on-the-healthcare-industry/ (accessed 22nd December, 2025).

New Delhi, January 08, 2026: Lakshmikumaran & Sridharan Attorneys acted as legal advisor to BlueScope Steel Limited, Australia, in connection with the sale of its shareholding in an Indian joint venture to Tata Steel Limited, India, in a transaction valued at approximately INR 1,100 crore (USD 125 million). The transaction involved the sale of shares held by BlueScope Steel Limited through its Australian subsidiary in the Indian joint venture, marking a significant cross-border divestment in the steel sector. The LKS team provided advisory support on direct tax and foreign exchange (FEMA) implications arising from the transaction and assisted BlueScope on a time-to-time basis throughout the deal lifecycle. A key highlight of the transaction was LKS assisting BlueScope Steel Limited in obtaining a lower withholding tax certificate within a period of 10 days, which resulted in a reduction of tax withholding by Tata Steel Limited to the extent of approximately INR 60 crore on the share purchase consideration. This engagement underscores the firm’s capability in handling complex cross-border transactions, particularly those involving intricate tax and FEMA considerations in high-value M&A deals. The transaction team from LKS was led by Ravi Sawana (Partner) and comprised Asish Philip (Executive Partner), Neha Sharma (Associate Partner), Tanmay Bhatnagar (Associate Partner), Apurva Chaudhary (Senior Associate) and Shreyasi Chakraborty (Senior Associate). About Lakshmikumaran & Sridharan attorneys Lakshmikumaran & Sridharan (LKS) is a premier full-service law firm in India, specializing in areas such as corporate & M&A/PE, dispute resolution, taxation and intellectual property. The firm, through its 14 offices across India, works closely on Corporate, M&A, litigation and commercial law matters, advising and representing clients both in India and abroad. Over the last 4 decades the firm has worked with over 15,500 clients which range from start-ups, small & medium enterprises, to large Indian corporates and multinational companies. The professionals within the firm bring diverse experience to service clients across sectors such as automobiles, aviation, consumer electronics, e-commerce and retail, energy, EPC, financial services, FMCG, hospitality, IT/ITeS, logistics, metals, mining, online gaming, pharma and healthcare, real estate and infra, telecom and media, and textiles. The firm takes pride in the value-based, client-focused approach that combines knowledge of the law with industry experience to design bespoke legal solutions. The firm’s driving principles to achieve our vision are integrity, knowledge and passion.

Ryan International, a leading operator of K-12 educational institutions in India, has set up nine greenfield educational institutions across Ambala, Amritsar, Bengaluru, Hyderabad, Mumbai, and Pune in 2025. Universal Legal advised the Ryan Group on the acquisition of approximately 9 lakh square feet of land across these six cities through a combination of outright land purchases and long-term lease arrangements. The mandate included comprehensive title due diligence, transaction structuring, negotiation, documentation, and closing support. The transactions were led by Partners Neha Sehgal and Rashi Kapoor Mehta, with support from Associate Partner Angshuman Chaliha, Senior Associate Ruchita Krishnan, and Associate Preksha Shah. 161/162-A Mittal Court, A Wing, Jamnalal Bajaj Marg, Nariman Point, Mumbai- 400 021Tel: +91-22-66664292-93 E-mail: [email protected]: www.universallegal.firm.in