Health data, and an Act with no sensitive category

The DPDP Act does not create a special category for health data. Unlike the GDPR, there is no Article 9 equivalent listing sensitive data with a higher bar. Everything is personal data, and the same consent standard applies to a diagnostic report as to a newsletter signup.

That sounds like relief. It is not. The absence of a sensitive category means health providers get no separate lawful basis to fall back on, and the general standard — free, specific, informed, unconditional, unambiguous, under Sec. 6(1) — has to carry a clinical relationship it was not obviously designed for.

Where the exposure concentrates

Consent taken at the counter. Registration desks collect identity, contact and clinical information under time pressure, often on paper, often on behalf of someone who is unwell. A notice under Sec. 5 has to be delivered before that consent, in a language the patient can choose, and the record has to show which notice was shown.

Third parties who are not obviously third parties. Labs, imaging centres, insurers, teleconsult platforms and billing processors each receive personal data. Each transfer needs a purpose the patient was actually noticed about.

Retention. Clinical records are held for years under other law, and the Act permits that where a law requires it. What it does not permit is holding everything else on the same schedule because it sits in the same system.

The withdrawal problem

Sec. 6(4) requires withdrawal to be as easy as giving consent was. In a hospital that means a patient who consented at a desk can withdraw without returning to that desk. Most provider systems have no route for this at all, and building one late means retrofitting it across every downstream system that already received the data.

What the Act allows without consent

Sec. 4(1) allows processing with consent or for certain legitimate uses, listed in Sec. 7. Sec. 7(f) covers responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or another individual, so the unconscious patient in casualty needs no consent form first. Sec. 7(g) covers medical treatment or health services during an epidemic, outbreak of disease or other public health threat. Sec. 7(a) covers the specified purpose for which a person voluntarily gave her data, such as a number given to book an appointment, unless she has said she does not consent to that use.

These uses are tied to the situation they name. The Act does not list treatment generally as a legitimate use, so ordinary care still rests on consent or on Sec. 7(a). The full list is in what the DPDP Act requires.

Children and patients who cannot consent for themselves

A child is anyone below eighteen (Sec. 2(f)). Sec. 9(1) requires verifiable consent of a parent or lawful guardian before processing a child's data, and the same for a person with disability who has a lawful guardian. Sec. 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children.

Rule 12 and Part A of the Fourth Schedule disapply Sec. 9(1) and 9(3) for a clinical establishment, mental health establishment or healthcare professional, where processing is restricted to providing health services to the child, to the extent necessary for the protection of her health. A paediatric loyalty app or marketing list is outside that. For a guardian of a person with disability, Rule 11(1) requires due diligence that a court, designated authority or local level committee appointed the guardian, so registration desks need to record more than a name and signature.

Labs, insurers and other vendor chains

A lab, teleconsult platform or billing bureau acting on a provider's instructions is a Data Processor, and Sec. 8(1) keeps the provider responsible for that processing whatever the contract says. Sec. 8(2) requires a valid contract before engaging one. A lab that decides how it uses reports for its own purposes, or an insurer receiving claims data, can be a Data Fiduciary in its own right, and Sec. 8(3) requires completeness, accuracy and consistency when data is disclosed to another Fiduciary. Map each flow first. Vendor management sets out the steps, and the key definitions explain the roles.

Retention and breach reporting

Sec. 8(7) requires erasure when consent is withdrawn or the specified purpose is no longer served, unless retention is necessary for compliance with law. Where a clinical record-keeping rule in another law requires a record to be kept, that is retention "necessary for compliance with any law" under this exception; the Act itself names no medical retention period. Marketing contacts and app data do not inherit it, and Processors must be made to erase too.

A personal data breach includes accidental loss of access (Sec. 2(u)), so ransomware that locks the records system counts even if nothing is copied. Sec. 8(6) and Rule 7 require intimation to the Board and each affected patient: a first description to the Board without delay and detailed information within seventy-two hours. Rule 6(1)(e) also requires a year of logs. See DPDP data breach notification and DPDP penalties.

Where the Act steps back

Sec. 17(1) disapplies Chapter II (except Sec. 8(1) and 8(5)), Chapter III and Sec. 16 where processing is necessary for enforcing a legal right or claim, so a hospital pursuing a claim of its own, such as recovering unpaid fees, can use the relevant records without fresh consent. The Act does not say in terms that the same applies to defending a claim, so do not assume it does. Sec. 17(2)(b) exempts research, archiving and statistical purposes only where the data is not used for any decision specific to a Data Principal and the prescribed standards are followed.