Pharmacovigilance systems for India: What companies need to have in place

The 3 June 2026 CDSCO circular reiterating the requirement for an effective pharmacovigilance system under Paragraph 6.11 of Schedule M of the Drugs and Cosmetics Rules has brought a fundamental question into sharper focus for pharmaceutical and biotechnology companies in India: what must an organisation actually have in place to demonstrate a functioning pharmacovigilance system? 

The answer extends well beyond adverse event reporting, timelines and regulatory submissions. A company must be able to show how safety information is identified across the organisation, transferred to pharmacovigilance personnel, scientifically evaluated, reported within applicable timelines, documented, quality-controlled and kept under effective oversight throughout the product lifecycle.

This question is especially relevant for companies that manufacture, import or market medicinal products in India. They are expected to ensure that safety information arising from product use can be collected, processed, evaluated and forwarded appropriately. For organisations in which pharmacovigilance has not yet developed into a mature independent function, meeting this expectation requires a deliberate review of responsibilities, procedures, interfaces and regulatory preparedness. 

For many companies, the immediate task is therefore to determine whether their present arrangements can reliably capture safety information, support timely regulatory reporting and withstand regulatory scrutiny. 

A pharmacovigilance system is not merely a database, a reporting mailbox or a set of SOPs kept ready for inspection. It is an organisational arrangement through which a company identifies where safety information may arise, ensures that such information reaches the right people, evaluates it scientifically, reports it when required and continuously reviews whether the system is working as intended. 

In simple terms, if a company places a medicinal product in the market, it must also have a mechanism to listen to what happens to patients after that product is used. The question then becomes how that information reaches the organisation and what happens to it once it arrives. 

Pharmacovigilance begins long before the first case is processed 

In many companies, the first instinct is to think of pharmacovigilance as something that begins when an adverse event report reaches the PV team. In practice, the system has to begin much earlier. It begins by asking a simple question: from where can safety information reach the company? 

A doctor may mention a suspected adverse reaction to a medical representative. A patient may call the company helpline. A product quality complaint may contain a medical outcome. A market research or patient support programme may reveal lack of efficacy, misuse, overdose, pregnancy exposure, or another medically relevant situation. A literature article may report an adverse event involving a marketed product. Even a company’s own social media channel may become a source of safety information. 

The challenge is that safety information does not always arrive in technical language. Reporters may use words such as side effect, problem, complaint, not working, reaction, intolerance, or many other expressions. Therefore, a company must train its people to recognise potential safety information and forward it appropriately, even when the information is incomplete or indirect. 

This is why sources of safety information must be identified, owned, monitored and periodically assessed for effectiveness. Telephone calls, email inboxes, medical information channels, quality complaints, websites, social media, commercial teams and contractual partners all need clear ownership. Recording every phone call may not be mandatory, but relevant information received during a call must be captured accurately, documented promptly and made retrievable. The organisation should also be able to demonstrate that these channels are actually working as intended and that safety information is reaching pharmacovigilance personnel appropriately. 

One of the most common mistakes organisations make is assuming that pharmacovigilance is owned exclusively by the PV department. Because potential safety information can enter through many channels, the pharmacovigilance system must extend across the organisation. Commercial teams, medical information personnel, quality teams, customer service functions, distributors and business partners may receive relevant information before the pharmacovigilance team does. Each function must therefore know what to recognise, how quickly to forward it and who is responsible for ensuring that it reaches the appropriate pharmacovigilance personnel. 

Defining ownership and accountability 

Once the routes through which safety information may enter the company are understood, the next requirement is clear accountability for ensuring that the information is acted upon. Every organisation should clearly define: 

• Who is responsible for oversight of pharmacovigilance activities? 
• How are safety decisions made? 
• How are responsibilities delegated? 
• How are pharmacovigilance obligations communicated internally? 

In the Indian context, particular attention should be paid to the responsibilities of the Marketing Authorisation Holder (MAH) and the Pharmacovigilance Officer in Charge (PVOIC). 

While specific activities may be outsourced, accountability cannot. 

This is an important principle that companies should remember when developing their pharmacovigilance framework. 

In India, accountability should be assigned based on the relevant licence and regulatory responsibility for the product, rather than assumed to rest simply with the company that manufactures or markets it. Depending on the business model, this may involve a manufacturer, importer, loan licensee, contract manufacturer, marketer or another entity with defined regulatory responsibility. Where different companies manufacture and market the product, their respective pharmacovigilance obligations must be clearly understood and documented so that safety information is not lost between commercial and regulatory arrangements. 

This determination should be made explicitly when the pharmacovigilance system is designed, because uncertainty over which entity owns regulatory reporting, oversight and safety-data exchange can create gaps precisely when a case requires prompt action. 

The PVOIC also requires careful attention. The role should not be treated as a nominal appointment. According to the Pharmacovigilance Guidance Document for MAHs of Pharmaceutical Products, the PVOIC should be a medical or pharmacy professional trained in the collection and analysis of adverse event reports. Where the PVOIC is a pharmacy professional, there should be appropriate access to a medically qualified person for causality assessment when required. 

Beyond regulatory compliance, the PVOIC frequently serves as the focal point for coordination between safety information sources, management, quality systems and regulatory reporting activities. As organisations grow, the effectiveness of this role often influences the effectiveness of the broader pharmacovigilance system. 

Why SOPs alone do not constitute a pharmacovigilance system 

Clear accountability must then be translated into documented procedures that explain how pharmacovigilance activities will be performed in practice. 

SOPs are written to be followed, not to be filed. They should specify responsibilities, escalation pathways, reporting timelines, decision-making processes, communication requirements and quality activities clearly enough for personnel to follow them consistently. 

For companies operating across multiple countries or as affiliates of global organisations, company-wide procedures may need to be supplemented by local work instructions. This helps ensure that corporate requirements and India-specific regulatory obligations are both addressed without creating avoidable conflicts or procedural gaps. 

A safety database is not a pharmacovigilance system 

With responsibilities and procedures defined, the organisation needs an appropriate means of recording, managing, tracking and reporting adverse event information. This is where a safety database becomes important. 

A safety database serves as the system of record for adverse event information and supports case management, reporting, tracking and oversight. 

A safety database is necessary, but purchasing one does not by itself create a functioning pharmacovigilance system. Its effectiveness depends on sound governance, defined processes, trained personnel, data quality and management oversight. 

The effectiveness of a database ultimately depends upon: 

• Data quality 
• Defined processes 
• Trained personnel 
• Quality oversight 
• Management commitment 

Technology is an enabler, not a substitute for governance. 

Documentation and inspection readiness 

As these arrangements become operational, the company must be able to document how the pharmacovigilance system is organised, how responsibilities are fulfilled and how performance is monitored. 

The Pharmacovigilance System Master File (PSMF) serves as a comprehensive description of the pharmacovigilance system and provides regulators with an overview of how pharmacovigilance activities are organised and managed. It brings together key elements of the system, including the organisation and responsibilities, sources of safety information, relevant computerised systems and databases, pharmacovigilance processes, system performance and the quality system. 

Alongside the PSMF, organisations should ensure that training records, quality records, reconciliation activities, vendor oversight documentation, and procedural controls remain current and consistently maintained. 

Inspection readiness is not a separate exercise undertaken in the weeks before an inspection; it is the natural outcome of a well-designed pharmacovigilance system that has been documented, monitored and maintained consistently over time. 

Outsourcing activities is not the same as outsourcing accountability 

The same principles of defined responsibility, documented processes and oversight apply when pharmacovigilance activities are outsourced. External support can provide specialised expertise and scalable capacity, but it does not transfer the organisation’s regulatory accountability for the product. 

Case processing, literature monitoring, aggregate reporting, medical review and other pharmacovigilance activities may be delegated to qualified service providers, but accountability remains with the organisation responsible for the product. 

Effective vendor oversight, performance monitoring, quality agreements and governance structures are essential elements of any outsourced pharmacovigilance model. Outsourcing should therefore be viewed as a management responsibility rather than merely a procurement exercise, with ongoing oversight remaining just as important as vendor selection. 

Where multiple parties are involved in manufacturing, marketing, distribution or licensing arrangements, pharmacovigilance agreements or safety data exchange agreements become especially important. These documents should specify how safety information will move between parties, timelines for exchange, points of contact, escalation pathways, and responsibility for regulatory reporting. 

Sustaining the pharmacovigilance system 

Establishing the system is only the first step; the company must also ensure that it continues to operate effectively as products, partnerships and business volumes change. 

This also requires appropriately trained and competent personnel; competence should be demonstrated rather than assumed. 

A robust quality framework supports continuous improvement through: 

• Internal audits 
• Deviation management 
• CAPA processes 
• Training programmes 
• Vendor oversight 
• Periodic review of system performance 

Without these elements, even well-designed systems may gradually deteriorate over time. Quality management helps the company maintain regulatory compliance by identifying weaknesses, correcting deviations and ensuring that the pharmacovigilance system continues to perform as intended. 

Building before it becomes urgent 

Perhaps the most important lesson for organisations is that pharmacovigilance systems should be developed before they become an immediate regulatory necessity.

Many organisations begin investing in pharmacovigilance only after inspections, partner requirements or regulatory expectations create immediate pressure. Systems established reactively can often address short-term compliance needs, but systems built proactively are typically more sustainable and effective over the long term. 

As product portfolios expand, distribution networks grow, partnerships evolve and market exposure increases, pharmacovigilance requirements become more complex. 

Smaller organisations do not necessarily require large pharmacovigilance departments or complex infrastructures. However, even a small system should contain all of the essential elements required for effective operation. It is often better to build a complete system at a modest scale than an incomplete system at a larger scale. 

Technology should support this system rather than define it. Organisations could use technology where it genuinely improves efficiency, quality or control, including newer tools such as artificial intelligence. However, such tools should be adopted to solve clearly identified business or compliance challenges, not merely because they are available. 

Pharmacovigilance should therefore be viewed not merely as a compliance obligation, but as an essential component of patient safety, product stewardship and responsible business practice. 

Taken together, the minimum practical expectation is that a company can answer seven questions clearly: 

1. Who is accountable for pharmacovigilance? 
2. Where can safety information enter the organisation? 
3. How is it transferred and assessed? 
4. Which procedures and tools govern the work? 
5. How are partners and vendors controlled? 
6. What records demonstrate that the system is operating? 
7. How are deficiencies identified and corrected? 

If any answer is unclear, the pharmacovigilance system is not yet fully established. 

Conclusion 

For pharmaceutical and biotechnology companies in India, the immediate priority is to establish a complete and workable pharmacovigilance system that meets regulatory expectations throughout the product lifecycle.

The regulatory requirement is clear, but its purpose is equally important: every company that places a medicinal product on the market must be able to understand, monitor and continuously evaluate its benefit-risk profile. Behind every adverse event report, product complaint, signal or safety concern is a patient, and a functioning pharmacovigilance system is how the company fulfils that responsibility.