Health Data And Privacy Under India’s Data Protection Regime:
Health Data And Privacy Under India’s Data Protection Regime: An Examination Of The Adequacy Of The Digital Personal Data Protection Act, 2023, For The Protection Of Health Data In The Indian Healthcare System
Gurveer Singh Dhindsa, LL.B. (Hons.), O.P. Jindal Global University, Jindal Global Law School (2023–2026)
ABSTRACT
The Digital Personal Data Protection Act, 2023 (“DPDP Act”) is India’s first comprehensive statutory framework for the processing of digital personal data, built on consent, purpose limitation and accountability. Unlike the draft bills that preceded it, however, the Act does not define or treat health data as a distinct, “sensitive” category requiring heightened protection. This paper examines the legal regime governing health data in India, tracing its evolution from Section 43A of the Information Technology Act, 2000 and the SPDI Rules, 2011, through the unimplemented Digital Information Security in Healthcare Act and the Health Data Management Policy, to the DPDP Act and the Digital Personal Data Protection Rules, 2025. It argues that the Act’s general, category-blind structure - read together with its exceptions and exemptions - leaves significant areas of health data under- protected, and proposes a set of reforms to reconcile patient privacy with public health objectives and the continued expansion of India’s digital health ecosystem.
