India's Digital Personal Data Protection Act

Summary Notes on the Digital Personal Data Protection Rules, 2025

Legislative Framework

• Digital Personal Data Protection Act (DPDP Act), 2023: The recently notified Rules have implemented parts of this Act, marking a significant privacy reform since the IT Act, 2000.
• Key Constitutional Underpinning: The Act promotes the respect for individual rights and ensures data accountability.

Key Provisions

• Definitions:

  • Data Fiduciary: Includes all healthcare entities (clinics, hospitals, telemedicine apps) irrespective of size.
  • Data Principal: Refers to patients who have rights over their medical data (to access, correct, and erase).

• Scope of Data: Covers all personal data (digital or digitized), with limited exceptions outlined in Section 3(c) of the Act.

Patient Rights

• Empowerment of patients regarding their personal health data.
• Right to withdraw consent or request data deletion, applies broadly but raises healthcare operational concerns.

Healthcare Implications

• The Act introduces transparency but presents challenges, particularly in emergency care scenarios where obtaining consent may not be feasible.
• Processing Without Consent: Allowed in medical emergencies and public health crises treads a careful line between privacy and patient care needs.

Retention and Data Management

• Ambiguity in data retention timelines for healthcare records creates potential risks:

  • Schedule III: Lacks specific retention timelines for healthcare, unlike other sectors.
  • Post-Treatment Data: Patients' medical records may be needed for years; lack of clear guidelines places hospitals and patients at risk.

• Section 5(2) requires that prior data fiduciaries notify data principals regarding their rights without a specified timeline, potentially encompassing all historical data.

Responsibility and Legal Obligations

• The Act does not relieve healthcare providers of their legal responsibilities, even as patient consent changes.
• The definition of "processing" includes erasure, necessitating consent even for data deletion, which may complicate patient care post-consent withdrawal.

Recommendations for Future Actions

• A call for sector-specific regulations in healthcare due to the unique complexities of patient data rights compared to other sectors like e-commerce and online gaming.

Conclusion

The DPDP Act, through its Rules, aims to establish a robust privacy framework in Indian healthcare. While it protects individual rights, the operational ambiguities and the need for clearer guidelines on data retention and healthcare specifics need to be addressed to ensure comprehensive patient care and privacy protection.