International Journal For Multidisciplinary Research

E-ISSN: 2582-2160   •   Impact Factor: 9.24

A Widely Indexed Open Access Peer Reviewed Multidisciplinary Bi-monthly Scholarly International Journal

Call for Paper Volume 8, Issue 6 (November-December 2026) Submit your research before last 3 days of December to publish your research paper in the issue of November-December.

Protection of Sensitive Personal Health Data in India: Examining the Legal Gaps in the DPDP Act, 2023

Author(s) Ms. Pragati Singh, Dr. Ruchika Sharma
Country India
Abstract Electronic health records, telemedicine platforms, wearable diagnostic devices, and the country’s digital health infrastructure have all helped to rapidly digitize healthcare delivery in India, leading to unprecedented volumes of private medical data. The Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, break away from established domestic and international precedent by discarding the statutory classification of sensitive personal data. This is despite the reality that health information is a well-established category in privacy jurisprudence that requires enhanced legal protection on account of the irreversible harm caused by unauthorized disclosure. This study examines the legal gaps related to personal health data in the Indian data protection system critically using a doctrinal and comparative legal research methodology. It traces the journey from the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the uniform data model of the 2023 Act; examines the impact of the removal of Section 43A of the Information Technology Act, 2000, on the compensatory remedies available to individuals; investigates the wide consent exemptions for medical emergencies and state welfare programs under Section 7; and scrutinizes the institutional governance gaps under the Ayushman Bharat Digital Mission Health Data Management Policy. The study ends with recommendations for a statutory sub-classification of health data, fiduciary duties in specific sectors, explicit data portability rights, and restorative compensation mechanisms. The framework of India is compared with Article 9 of the EU General Data Protection Regulation and the US Health Insurance Portability and Accountability Act.
Keywords Sensitive Personal Health Data, Digital Personal Data Protection Act 2023, Medical Privacy, Informed Consent, Data Fiduciary Obligations, Health Data Governance
Published In Volume 8, Issue 6, November-December 2026
Published On 2026-11-15

Share this