Industry Practice · Delhi NCR
Healthcare Law Firm in India
Healthcare is among India's most closely regulated sectors. Plan for the regulator from day one.
1940
Drugs & Cosmetics Act
2017
Medical Devices Rules
2023
DPDP Act
The Industry Landscape
India's healthcare sector operates under one of the most complex regulatory environments in the world — the Drugs and Cosmetics Act, Medical Devices Regulations, Clinical Establishments Act, National Medical Commission Act, Biomedical Waste Rules, and the intersecting requirements of DPDP Act for health data. Hospital acquisitions and healthcare M&A carry specific diligence requirements. Pharmaceutical companies face drug pricing regulation, clinical trial compliance, and FDI restrictions. Corpus Juris Legal advises healthcare businesses — hospitals, pharma companies, medical device manufacturers, and health-tech platforms — on the full legal spectrum.
- Healthcare M&A — hospital acquisitions, pharma transactions
- Drug regulation — Drugs and Cosmetics Act compliance
- Medical device regulatory compliance and MDR 2017
- Clinical trials — CDSCO approval and patient consent frameworks
- Health data privacy — DPDP Act and patient data management
- FDI in healthcare — automatic route sectoral compliance
Frequently Asked Questions
What regulatory approvals does a hospital acquisition in India require?+
A hospital acquisition requires: NCLT merger or share purchase execution, CCI approval if thresholds are met, state clinical establishment authority approvals for change of ownership, drug licence transfer or fresh application, bio-medical waste management licence transfer, and NABH/JCI accreditation status review.
What is the FDI policy for the healthcare sector in India?+
100% FDI is permitted under the automatic route in hospitals (subject to price cap conditions), pharmaceutical manufacturing, and medical devices manufacturing. Brownfield pharma investment above 74% requires government approval. Greenfield pharma is on automatic route at 100%. FDI in medical tourism, health insurance, and health-tech varies by category.
How must Indian healthcare organisations handle patient health data under the DPDP Act?+
Unlike GDPR, the DPDP Act does not create a separate sensitive category — health data is personal data that needs notice-based consent or a specified legitimate use, although its sensitivity drives the security safeguards expected. Telemedicine platforms, hospital management systems, and health apps must build consent management frameworks, implement data minimisation, and comply with the breach notification requirements of the DPDP Rules 2025.
Talk to Our Healthcare Legal Team
Speak directly with a partner. No juniors, no call centres, no runaround.