Archive · 30 Dec 2025
India's New Data Privacy Rules Impact Healthcare
India has new rules about keeping personal data safe, which will change how hospitals and clinics handle patient information.
Now, every healthcare provider is responsible for protecting patient data, and patients have more rights over their own information.
They can ask to see, correct, or even delete their medical records.
However, there are some confusing parts.
For example, it's not clear how long hospitals should keep medical records, and what happens if a patient asks to delete their data but still needs medical care.
The rules also say that during emergencies, hospitals can use patient data without asking for permission.
Overall, this is a big step towards better privacy in healthcare, but some parts might need to be clarified or changed to work better for the healthcare sector.
The Digital Personal Data Protection Act, 2023, and its rules are now in effect, impacting the healthcare sector significantly.
All healthcare providers are now 'data fiduciaries' responsible for protecting patient data, and patients are 'data principals' with rights over their information.
Patients can access, correct, or erase their medical data, but ambiguities exist around data retention and emergency care.
The rules allow data processing without consent during medical emergencies and public health crises.
The Act does not specify data retention timelines for medical records, leaving hospitals uncertain about how long to keep patient data.
- Who
- Healthcare providers (clinics, hospitals, labs, telemedicine apps) and patients in India
- What
- Implementation of the Digital Personal Data Protection Act, 2023, and its rules
- When
- The rules have been notified and are now in effect
- Where
- India
- Why
- To foster respect for individual rights and data accountability in the healthcare sector
- Act
- Digital Personal Data Protection Act, 2023
- Rules
- Digital Personal Data Protection Rules, 2025
- Data Fiduciary
- Any entity handling personal data, including healthcare providers
- Data Principal
- Individuals whose data is processed, including patients
- Consent Withdrawal
- Patients can withdraw consent or request data deletion
- Emergency Exemption
- Data processing allowed without consent during emergencies
- Data Retention
- No specified timelines for medical data retention