Yes, dbGaP approval is needed to access controlled datasets in BDC. Users with eRA Commons credentials (see Understanding eRA Commons Accounts) can access the BDC ecosystem but will have limited access to only open datasets.