New Drugs and Clinical Trials Rules, 2019: A Quick Guide for Sponsors

If you plan to run a clinical trial in India, the New Drugs and Clinical Trials Rules, 2019 (NDCT Rules) are your starting point. They replaced the old Schedule Y framework and made India's approval process more predictable and time-bound.

This is a practical overview for sponsors. It is not legal advice; always check the latest CDSCO notifications before you file.

Who regulates what

• CDSCO, headed by the Drugs Controller General of India as the Central Licensing Authority, grants permission to conduct clinical trials of new drugs and investigational new drugs.
• Ethics Committees, registered with CDSCO, review and approve each trial at each site.
• CTRI (Clinical Trials Registry – India) is where trials must be registered before the first participant is enrolled.

Approval timelines

One of the most valuable features of the NDCT Rules is defined timelines:

• 90 working days for the decision on a clinical trial application in general, including global trials.
• 30 working days for drugs discovered, researched and developed in India and proposed to be manufactured and marketed here – with deemed approval if CDSCO does not respond in time.

A 2024 amendment also allows waivers of local clinical trials in specified cases for drugs already approved in certain reference countries and regions (the US, UK, Japan, Australia, Canada and the EU), under the conditions in the Rules.

Ethics Committees

Every trial needs approval from a registered Ethics Committee before it begins at a site. EC registration is valid for five years. Sponsors should confirm that each EC's registration is current and its composition meets the Rules – a point I check in every site audit.

Safety reporting

The Rules set clear timelines for serious adverse events. The investigator must report an SAE quickly (within 24 hours of becoming aware of it) to the licensing authority, the sponsor and the Ethics Committee, followed by an analysed report within 14 days. Getting these timelines right is one of the most common compliance challenges in India. (I will cover SAE reporting in detail on 19 November.)

Compensation and medical management

India is one of the few countries with a defined framework for compensation for trial-related injury or death, and for free medical management of participants who suffer an injury in the trial. Sponsors must budget for this and ensure consent forms explain it. (Full post on 30 November.)

Informed consent

Written informed consent is mandatory, and audio-video recording of the consent process is required in certain cases, particularly for vulnerable participants.

What sponsors most often get wrong

1. Treating CTRI registration as an afterthought.
2. Not checking EC registration status and composition.
3. Underestimating the compensation provisions in budgets and contracts.
4. Assuming global SAE processes automatically meet Indian timelines.

The takeaway

The NDCT Rules have made India a more predictable place to run trials. But predictability depends on getting the details right the first time. A short regulatory readiness review before submission can save weeks of queries.

Need help preparing a compliant trial in India? Write to me at anup.cra@gmail.com.

– Anup Kumar, Independent Clinical Research Auditor & Consultant, New Delhi

10 GCP Findings I See Most Often at Indian Sites – and How to Prevent Them

After years of auditing investigator sites across India, I notice that most findings are not dramatic. They are small, repeated process gaps that add up. The good news: almost all of them are preventable.

Here are the ten I see most often.

1. Informed consent errors

Missing dates or signatures, an outdated consent version used after an amendment, or no note in the source showing how consent was taken. Prevent it: a version-control log at the site and a consent checklist completed for every participant.

2. Delegation log gaps

Staff performing study tasks before being added to the delegation log, or the PI not signing entries. Prevent it: no task until the log is signed. Monitors should check this on every visit.

3. Training records missing or out of date

GCP certificates expired, or no record of protocol training after amendments. Prevent it: a simple training matrix per study, updated at each amendment.

4. Source documents that don't support the CRF

Values in the CRF with no corresponding source, or source notes written long after the visit. Prevent it: agree a source document list at site initiation and follow ALCOA+ principles.

5. Eligibility not fully documented

Inclusion and exclusion criteria ticked as "met" without supporting lab reports or history. Prevent it: an eligibility checklist signed by the investigator, with evidence attached.

6. Late or incomplete SAE reporting

SAEs reported late, or reports missing causality and follow-up information. Prevent it: clear reporting timelines posted at site, and a named backup person when the PI is unavailable.

7. Investigational product accountability errors

Dispensing logs that don't reconcile, missing temperature records, or returned product not counted. Prevent it: reconcile at every monitoring visit, and keep continuous temperature logs with excursion procedures.

8. Protocol deviations not recognised

Visit windows missed or procedures skipped, but never recorded as deviations. Prevent it: a deviation log reviewed by the monitor and discussed with the site team.

9. Ethics Committee communication gaps

Amendments implemented before EC approval, or progress reports not submitted. Prevent it: a regulatory tracker listing every submission, approval and due date.

10. Weak PI oversight

The PI is busy and delegates almost everything, with little evidence of supervision. Prevent it: documented PI review of key data, SAEs and eligibility – and regular team meetings with minutes.

The pattern behind the findings

Most of these issues share one root cause: processes that depend on memory instead of systems. Busy sites with high patient loads need simple tools – checklists, logs and trackers – that make the right action the easy action.

For sponsors, the lesson is clear. Routine monitoring catches some of these issues, but an independent audit early in the study catches the patterns, so they can be fixed across all sites before they become inspection findings.

Want an independent audit of your sites in India? Write to me at anup.cra@gmail.com.

– Anup Kumar, Independent Clinical Research Auditor & Consultant, New Delhi

ICH E6(R3) in Plain English: What Changes for Sponsors Running Trials in India

The biggest change to Good Clinical Practice in nearly a decade is here. ICH adopted the E6(R3) Principles and Annex 1 on 6 January 2025. The EU made it effective in July 2025 and the US FDA published it as final guidance later that year. Regulators worldwide, including in India, are aligning with it.

If you sponsor trials in India – especially trials whose data will be used abroad – E6(R3) is now the standard your study will be judged against. Here is what it means in plain English.

1. Quality by design, not quality by inspection

E6(R2) introduced risk-based monitoring. E6(R3) goes further: quality must be built into the protocol from the start. Sponsors are expected to identify what is critical to quality – the data and processes that truly affect participant safety and the reliability of results – and focus effort there.

What to do: run a documented risk assessment at protocol stage, and revisit it as the study progresses.

2. Proportionality everywhere

The guideline repeatedly asks for approaches that are proportionate to risk. A low-risk nutraceutical study does not need the same level of monitoring as a first-in-human oncology trial. That is good news for smaller sponsors – but only if the reasoning is written down.

What to do: document why your monitoring, data checks and audit plan are right-sized for your trial.

3. Stronger sponsor oversight

E6(R3) makes it clear that sponsors must oversee every service provider – CROs, labs, technology vendors. Signing a contract is not oversight.

What to do: define oversight activities (meetings, metrics, audits) in an oversight plan and keep evidence that you did them.

4. Technology-neutral and data-focused

The new text is written to work for paper, electronic and hybrid trials. It gives detailed attention to data governance: audit trails, access control, system validation and the integrity of data across its whole life cycle.

What to do: ask your vendors for validation evidence, and make sure audit trails are reviewed, not just switched on.

5. Participant-centred conduct

E6(R3) puts more weight on the participant experience – clear consent information, reduced burden and flexibility such as remote consent or visits where appropriate and permitted locally.

What to do: review consent documents and visit schedules from the participant's point of view.

6. Essential records, not just essential documents

The focus shifts from a fixed list of documents to records that allow the trial to be reconstructed and evaluated. Your TMF must tell the story of the study.

What this means in India

Indian trials are governed by the New Drugs and Clinical Trials Rules, 2019 and Indian GCP guidance, and CDSCO has been moving its guidance in line with E6(R3) themes. For global sponsors, sites in India will be inspected against E6(R3) expectations by foreign regulators too.

The practical gap I see most often: sites and smaller CROs are still working with E6(R2)-era SOPs and training. A short gap assessment now can prevent findings later.

Quick E6(R3) readiness checklist

• Is there a documented risk assessment for each study?
• Is the monitoring plan clearly risk-based and justified?
• Is there a written vendor oversight plan with evidence of execution?
• Are computerised systems validated and audit trails reviewed?
• Have site and sponsor staff been trained on E6(R3)?

If you answered "no" or "not sure" to any of these, now is the right time to act.

Need an E6(R3) gap assessment or training for your team or sites? Write to me at anup.cra@gmail.com.

– Anup Kumar, Independent Clinical Research Auditor & Consultant, New Delhi

Why Every Sponsor Needs an Independent Auditor – Even If Your CRO Is Excellent

Many sponsors tell me the same thing: "Our CRO is very good. Why would we need an independent auditor?"

It is a fair question. Most CROs in India work hard and have experienced teams. But a good CRO and independent assurance are two different things – and regulators expect sponsors to have both.

The sponsor is always responsible

Under ICH GCP, a sponsor can transfer tasks to a CRO, but never responsibility. If an inspector finds that consent was taken incorrectly, data was changed without an audit trail, or safety reports were late, the finding lands on the sponsor. "Our CRO was handling it" is not a defence.

That is why ICH E6(R3) places strong emphasis on sponsor oversight of service providers. Oversight means you need your own evidence that the work is being done correctly – not just the CRO's reports telling you it is.

Why a CRO cannot audit itself

A CRO's internal QA team is valuable, but it has natural limits:

• Conflict of interest. Internal auditors report to the same management that is delivering your study. Even with the best intentions, there is pressure to soften findings.
• Shared blind spots. If the CRO's SOPs have a gap, internal QA trained on those same SOPs may not see it.
• Different priorities. The CRO's QA protects the CRO's quality system. An independent auditor protects your study, your data and your submission.

What an independent auditor actually gives you

1. An unbiased view. Findings are reported directly to the sponsor, graded by risk, with no filter.
2. Early warning. Problems found at month two cost far less to fix than problems found at database lock – or by an inspector.
3. Evidence of oversight. Audit reports and CAPA records show regulators that you actively supervised your trial.
4. Confidence for partners and buyers. If you plan to license your product, raise funds or file abroad, an independent audit trail strengthens due diligence.
5. Local knowledge. For overseas sponsors, an India-based auditor understands how sites, Ethics Committees and CDSCO processes really work on the ground.

When should you bring in an auditor?

You do not need to audit everything. A risk-based plan works best:

• Before the study: CRO and vendor qualification audits.
• Early in recruitment: an audit of the highest-enrolling or newest site.
• For cause: when you see unusual data patterns, frequent deviations or staff turnover.
• Before submission: TMF and Clinical Study Report audits.

For small and nutraceutical sponsors, even one or two well-timed audits can transform the credibility of a study.

The bottom line

A strong CRO and an independent auditor are not competitors – they are partners in quality. The CRO delivers the study; the auditor gives you proof that it was delivered right.

If your data will be judged by a regulator, a partner or the market, independent assurance is not a cost. It is insurance.

Planning or running a trial in India? I provide independent GCP audits, independent monitoring and GCP consulting for pharma, biotech and nutraceutical sponsors. Write to me at anup.cra@gmail.com for a free, confidential discussion.

– Anup Kumar, Independent Clinical Research Auditor & Consultant, New Delhi