The Complete Compliance Checklist for Pharma and Medical Devices

Pharma and medical device companies in India operate under one of the country's most layered compliance regimes, combining drug and device licensing with standard labour, environmental and data obligations. This checklist walks through the areas that matter most.

Key facts at a glance

• Drug manufacturing requires a licence under the Drugs and Cosmetics Act, issued by the State Drug Control Authority or CDSCO depending on the product.
• Schedule M sets Good Manufacturing Practice (GMP) standards that manufacturing sites must meet to hold a licence.
• Medical devices are regulated separately under the Medical Device Rules 2017, with risk-based classification (Class A to D).
• EPF applies once a company has 20 or more employees, on wages up to Rs 15,000/month.
• ESI applies once a company has 10 or more employees, on wages up to Rs 21,000/month.
• Facilities generating clinical or pharmaceutical waste need Biomedical Waste Management authorisation from the State Pollution Control Board.
• DPDP Act substantive obligations for handling patient and clinical data become enforceable from 13 May 2027.

Drug manufacturing and sale licensing

Manufacturing, selling or distributing drugs in India requires a licence under the Drugs and Cosmetics Act, 1940 and its rules. Manufacturing licences are typically issued by the State Drug Control Authority, while certain categories (like some biologicals and new drugs) route through the Central Drugs Standard Control Organisation (CDSCO). Wholesale and retail drug sale also each need their own licence, and pharmacists on record must hold valid registration.

Schedule M of the Drugs Rules lays out GMP requirements covering plant and equipment, quality control systems, documentation and personnel qualifications. Meeting Schedule M standards is a precondition for holding and renewing a manufacturing licence, and inspections check for ongoing compliance, not just a one-time approval.

Medical Device Rules 2017

Medical devices follow a separate regulatory track under the Medical Device Rules 2017, administered by CDSCO. Devices are classified by risk from Class A (low risk) to Class D (high risk), and the classification determines whether registration happens at the state or central level and how much clinical evidence is required. Companies manufacturing or importing devices need to track which class their product falls under, since documentation and inspection intensity scale with risk class.

Environmental and biomedical waste compliance

Pharma manufacturing and any facility handling clinical samples or expired drugs must comply with Biomedical Waste Management Rules, requiring authorisation from the State Pollution Control Board and proper segregation, storage and disposal through authorised waste handlers. Manufacturing plants also typically need Consent to Establish and Consent to Operate from the Pollution Control Board under air and water pollution control laws, depending on the plant's category.

Labour compliance across manufacturing and R&D staff

Pharma companies typically run both manufacturing floors and R&D or corporate teams, and both are covered by the same core labour thresholds.

• EPF is mandatory once a company crosses 20 employees, at the standard Rs 15,000/month wage ceiling with 12% employee and 12% employer contribution.
• ESI is mandatory once a company crosses 10 employees (1+ for hazardous units, which many manufacturing sites qualify as), at a Rs 21,000/month wage ceiling.
• The four Labour Codes came into force nationally on 21 November 2025, but state-level rules are still being notified, so pharma employers should confirm their specific state's status before assuming full applicability.
• A POSH Internal Committee is mandatory at any site, manufacturing or corporate, with 10 or more employees.

Data protection for patient and clinical trial data

Pharma and device companies frequently handle sensitive personal data through clinical trials, patient support programs and post-market surveillance. Under the DPDP Act 2023, the Data Protection Board provisions are already active, the Consent Manager framework becomes operational 13 November 2026, and full substantive obligations (notice, consent, security safeguards, breach reporting) become enforceable 13 May 2027. Penalties for failing to implement reasonable security safeguards can reach up to Rs 250 crore per instance, so data governance for clinical and patient data deserves early attention rather than a last-minute scramble.

If you are not sure where your pharma or medical device business stands on labour and statutory compliance, ComplianceCheck's statutory compliance assessment gives you a clear picture in a few minutes.

Sources

• CDSCO — cdsco.gov.in
• Ministry of Labour and Employment — labour.gov.in
• EPFO — epfindia.gov.in
• ESIC — esic.gov.in
• MeitY / Data Protection Board — meity.gov.in
• Respective State Pollution Control Board and State Drug Control Authority

This guide is general information, not legal advice. Requirements vary by state, sector and headcount - confirm specifics with a compliance professional or the relevant authority.