India's DPDP Act: What It Means for Your Health Data

India's Digital Personal Data Protection Act (DPDP), passed in 2023, is the country's first comprehensive data privacy law. Health data gets specific attention because it's classified as sensitive personal data. Understanding what the law grants you and what it obliges providers to do turns 'privacy' from a vague worry into a specific set of rights you can exercise.

The specific rights DPDP gives you

• Right to know what data an organisation holds about you.
• Right to correct inaccurate data.
• Right to erase data (with some exceptions for legal retention).
• Right to nominate someone to exercise rights on your behalf if you're unable.
• Right to grievance redressal — a process to complain if the organisation misuses data.
• Right to withdraw consent.

The specific obligations on organisations

• Get informed consent before processing personal data.
• Notify you of the specific purpose.
• Collect only what's necessary.
• Delete data when no longer needed.
• Report breaches promptly.
• Appoint a Data Protection Officer for significant data fiduciaries.
• Allow you to withdraw consent as easily as you gave it.

How DPDP applies to health apps

• Scenario: Signing up for a health app · What DPDP requires: Clear consent, purpose specified
• Scenario: Sharing your record with a doctor · What DPDP requires: Your explicit consent, scoped, time-limited
• Scenario: Aggregating data for analytics · What DPDP requires: Anonymisation OR explicit consent
• Scenario: Sharing with third parties (insurers, employers) · What DPDP requires: Explicit consent for each
• Scenario: Marketing based on health data · What DPDP requires: Requires specific consent
• Scenario: Storing beyond stated purpose · What DPDP requires: Not allowed without renewed consent

Specific expectations for a good health record app

• Clear consent flow at signup, not buried in terms.
• Explicit purpose statement — 'we use your data for X'.
• Data export in a portable format on demand.
• One-click account deletion.
• Grievance officer contact clearly available.
• Breach notification policy stated.
• No third-party sharing without explicit per-instance consent.
• No behavioural profiling for advertising.

What to check before using any health app

• Privacy policy — read the summary at minimum.
• Data storage location — DPDP prefers Indian residency for health data.
• Third-party data sharing disclosures.
• Retention period after account closure.
• Whether AI features process your data — how, where, retention.
• Grievance officer contact.
• Breach history if public.

The specific things you should never share

• Aadhaar numbers unless legally required.
• Full medical history to unsolicited callers or forms.
• Passwords or access to any medical portal.
• Photos of prescription strips with identifying details unless intended recipient known.
• Sensitive diagnostic results with parties who don't need them.

If your rights are violated

• First, contact the organisation's grievance officer.
• If unresolved in 30 days, complaint to Data Protection Board.
• For health-specific issues, medical council for provider misconduct.
• Penalties under DPDP can reach ₹250 crore for major breaches.
• Save all correspondence as evidence.

The specific children's data provisions

• Verifiable parental consent required for anyone under 18.
• No behavioural profiling of children.
• Restricted third-party sharing.
• Age-verification mechanisms required.

What DPDP does NOT do

• Does not prevent all data sharing — consent-based sharing is fine.
• Does not require data localisation for all categories.
• Does not automatically make old (pre-2023) practices compliant — organisations must update.
• Does not cover data processed for personal or household purposes.
• Does not protect against data breaches — only requires notification after.

What you should do now

• Review privacy settings on every health service you use.
• Delete accounts on services you no longer use.
• Set up two-factor authentication.
• Save contact information for grievance officers of your active services.
• Understand what each service does with your data.

DPDP is not just legal framework — it's leverage you can use. A service that isn't compliant is one to leave. A service that responds well to a subject access request is one worth trusting. The specific difference between having rights and exercising them is the difference between passive privacy and active.

References

• MeitY — DPDP Act 2023
• DPO India — health data compliance
• PRS Legislative — DPDP analysis