---
title: "Beyond The Compliance Checkbox: Sector-Specific Compliance Under The DPDP Act"
date: 2026-10-16
author: "KM Team"
url: https://acuitylaw.co.in/beyond-the-compliance-checkbox-sector-specific-compliance-under-the-dpdp-act/
---

# Beyond The Compliance Checkbox: Sector-Specific Compliance Under The DPDP Act

Posted On - 16 October, 2026 • By - KM Team

![](https://acuitylaw.co.in/wp-content/uploads/2026/10/pexels-towfiqu-barbhuiya-3440682-11391947-scaled-e1792144618905.jpg)

Part III: A Guide to Healthcare, Pharma and Medical Devices

In the first two articles of this series, we examined how the Digital Personal Data Protection Act, 2023 (**“DPDP Act”**) and the Digital Personal Data Protection Rules 2025 (**“DPDP Rules”**) affect BFSI businesses and Global Capability Centres. This third article seeks to address healthcare, pharmaceuticals and medical devices – a sector in which data may be transferred between multiple entities including hospital, laboratory, insurer, pharmacy, technology platform, device operator and research sponsor.

The country’s healthcare sector is processing digital health data on a large scale. In May 2026, the National Health Authority reported that more than 100 crore health records had been linked with Ayushman Bharat Health Accounts (**“ABHA”**) under the Ayushman Bharat Digital Mission (**“ABDM”)** twice the 50 crore records linked in February 2025.[1](#d3da180b-7664-4d36-93f3-e4fd8211bf7d) By 12 October 2026, the official ABDM dashboard recorded more than 98 crore ABHA accounts.[2](#7b18a478-c787-408e-93f1-eda5c436167d)

The ABDM is designed to enable health records to be accessed and shared across hospitals, clinics, laboratories and other registered healthcare providers through a consent-based exchange. Linking a record to ABHA does not, however, authorize every subsequent use of that record. If the same information is later used for an insurance claim, clinical research, commercial analytics or AI training, that further use must independently satisfy the DPDP Act.

For healthcare organizations, the compliance risk lies in everyday operational decisions: what an admission form actually authorizes; when patient information can be shared with an insurer, a Third-Party Administrator (**“TPA”**) or caregiver; how long medical and clinical-trial records must be retained; and whether data from telemedicine platforms, connected devices and medical imaging can be used for research.

The answers do not lie in a single regulatory framework. They require the DPDP Act to be applied together with the existing healthcare laws in India. The financial exposure is significant: a failure to take reasonable security safeguards can attract a monetary penalty of up to INR 250 crore, while failure to notify a personal data breach can attract a penalty of up to INR 200 crore.[3](#c76e2201-837a-409c-8573-238bdff267b0) Against this backdrop, the following FAQs examine how the DPDP framework applies to the principal data-protection issues confronting healthcare businesses.

1. **What are the implications of the DPDP Act for hospitals, pharmaceutical companies, clinical research organizations and medical device companies?**

The DPDP Act requires healthcare businesses to account for personal data processed across the entire organisation. Hospital-management systems, diagnostic portals, clinical-trial databases, telemedicine platforms and connected-device applications might process identifiable digital personal data. A hospital, pharmaceutical sponsor or medical-device company that decides why and how the data is processed would be identified as a ‘Data Fiduciary’, while a vendor acting on its instructions would be considered as a ‘Data Processor’ under the DPDP Act and DPDP Rules.

The obligation to be exercised as a Data Fiduciary cannot be transferred. Consider a hospital that appoints one vendor to host patient records and another to send appointment reminders. The hospital remains responsible for processing undertaken on its behalf and must engage each processor under a valid contract. It must also implement reasonable security safeguards, including access controls, encryption or masking, monitoring, logs and backups. If either vendor processing the digital personal data suffers a breach, the hospital’s obligations for grievance redressal and notification of breach will still be triggered. The Data Protection Board must be informed without delay, of the nature, extent, timing and location of the breach, the likely consequences arising from the breach and further, the measures undertaken to protect the Data Principal’s interests. Upon becoming aware of a personal data breach, the hospital must notify each affected Data Principal without delay under rule 7(1), and the Board without delay under rule 7(2)(a). It must provide the Board with the detailed information prescribed under rule 7(2)(b) within 72 hours of becoming aware of the breach, unless the Board allows a longer period on a written request.

The compliance framework extends beyond reasonable security measures. Healthcare organisations must provide mechanisms for the rights available under the DPDP Act, including access, correction, erasure, grievance redressal and nomination. Additionally, Section 9(1) of the DPDP Act provides that processing a child’s personal data requires verifiable consent from the parent or lawful guardian. The Data Fiduciary is required to adopt appropriate technical and organizational measures to ensure verifiable consent is obtained. Further, Sections 9(2) and 9(3) provide that a Data Fiduciary must not process personal data in a manner likely to cause any detrimental effect on the well-being of a child or undertake tracking or behavioral monitoring of children or targeted advertising directed at them.

The DPDP Rules exempt specified clinical establishments, mental health establishments and healthcare professionals from the parental-consent requirement under Section 9(1) and the restrictions under Section 9(3), but only where processing is confined to health services necessary to protect the child’s health. Allied healthcare professionals receive a corresponding exemption where processing is confined to supporting the implementation of a healthcare treatment and referral plan recommended by that professional for the child, to the extent necessary to protect the child’s health. However, it is to be noted that the prohibition on processing which is likely to cause a detrimental effect on the child’s well-being continues to apply.[4](#16219758-f2be-4bab-af0a-79bcbe52c62b)

With the substantive obligations scheduled to take effect from 13 May 2027, healthcare organizations must use the remaining transition period to identify their data flows, allocate responsibility across vendors and business functions, and close compliance gaps before the framework becomes enforceable.

1. **Is a patient’s bundled data consent on a hospital admission form sufficient under the DPDP Act?**

No. A single admission-form signature cannot provide blanket authority for every subsequent use of the patient’s data.

Consider a clause commonly encountered in hospital consent documentation:

*“I consent to the hospital collecting and using my demographic, contact, medical, insurance and financial information for registration, treatment, maintenance of electronic health records, sharing with group entities and service providers, research, personalised recommendations, promotional offers, overseas transfers and other lawful purposes.”*

A single checkbox cannot be treated as consent for several distinct uses of patient data. Registration, treatment, billing and processing an insurance claim relates to providing and administering the healthcare sought by the patient. Research and promotional offers involve separate uses of that data. Seeking one general authorisation for these distinct processing purposes constitutes bundled consent.

 Further, the consent provided should be free, specific, informed, unconditional and unambiguous. It must signify agreement to a specified purpose and be limited to the personal data necessary for that purpose. The accompanying notice must separately provide an itemised description of the personal data and clearly explain each purpose and the uses enabled by the processing. Broad expressions such as “other purposes”, “any relevant information” or “other legitimate purposes” do not identify the proposed processing with the required precision.

This does not require a separate form for every technical step involved in treating a patient. It requires the hospital to distinguish processing necessary for providing the requested healthcare service from independent uses of the same data. A patient’s consent to admission, surgery or another medical procedure does not, by itself, authorise unrelated processing of the patient’s personal data under the DPDP Act. It is hence integral that hospitals replace blanket admission-form language with purpose-specific notices and granular choices for independent uses of patient data.

1. **If a hospital is already using ABHA under ABDM, what are the additional requirements to ensure compliance with the DPDP Act?**

ABDM and the DPDP Act regulate different aspects of the hospital’s use of health data. An ABHA enables an individual to identify and link health records within the ABDM ecosystem. ABDM’s consent architecture governs the exchange of those records between a Health Information Provider, such as the hospital or laboratory holding the record, and a Health Information User requesting access to it. The consent artefact records the individual’s permission for that exchange.

The granular nature of ABDM consent is reflected in the ABHA application, which allows an individual to control who can access their health records, the categories of information and the duration of access. A consent request can accordingly identify a purpose and specify the period for which records are requested. It does not give the recipient unrestricted permission to use those records for unrelated purposes.[5](#57f97195-85c7-4833-a18d-1dc2e5e37e4f) Such permission is confined to the data-sharing transaction it authorises. For example, a patient can permit a hospital to retrieve a diagnostic report through ABDM for treatment. That consent does not, by itself, authorise the hospital to use the report for research, AI training, promotional profiling, or to disclose it to an insurer. Each further use must have an independently valid basis under the DPDP Act and remain within the purpose communicated to the patient.

Accordingly, ABDM participation will not discharge the hospital’s wider obligations under the DPDP Act. The hospital must account for digital personal data generated outside ABDM as well as information received through it. Once the substantive provisions become operative, this will include issuing a compliant notice where consent is sought, securing the data, regulating processors, responding to breaches, applying retention and erasure requirements and enabling applicable Data Principal rights. The ABDM policy itself requires participating entities to comply with other applicable laws.[6](#1b184a73-eda7-4a95-8140-8f5c0186ea06)

The practical requirement is therefore to trace what data enters through ABDM, the purpose for which it was obtained, what the hospital subsequently adds to it, and every system, vendor and recipient to which it is sent. ABDM facilitates the exchange of a health record; it does not provide blanket authority for everything the hospital later does with that record.

1. **Can a hospital share a patient’s information with a third party like an insurer, TPA, pharmacy, diagnostic laboratory or other service provider, without obtaining fresh consent each time?**

The DPDP Act does not itself require consent to be obtained afresh for every transmission. The relevant question is whether the disclosure remains within the specified purpose and lawful basis already established for processing the patient’s data.

For example, where a patient has authorised the hospital to share specified information with a diagnostic laboratory for a particular test, the operational exchanges necessary to complete that test can fall within the same consent. The consent cannot be the basis for processing of digital personal data for a different purpose.

A specific sectoral requirement applies to insurers. The Insurance Regulatory and Development Authority of India (**“IRDAI”**) Master Circular on Protection of Policyholders’ Interests, 2024 requires an insurer to obtain the policyholder’s express consent each time it shares medical records or related information. A standing or general authorization does not satisfy this insurer-facing requirement. The requirement governs the insurer’s sharing of records; the hospital’s disclosure of records to the insurer for processing a claim must be assessed separately under the DPDP Act and applicable duties of medical confidentiality.[7](#0e8bcd5c-9f8e-4650-9d69-e403da20a3fa)

1. **How does the DPDP Act apply to telemedicine consultations conducted through video, phone calls, WhatsApp and other digital platforms?**

A phone call or WhatsApp message is not, by itself, telemedicine. It forms part of a telemedicine consultation when a Registered Medical Practitioner (**“RMP”**) uses it to provide healthcare remotely. The Telemedicine Practice Guidelines recognise video, audio and text- including telephone calls, email and platforms such as WhatsApp- as modes of consultation, subject to the RMP determining whether the chosen mode is appropriate.[8](#23a024ee-364e-46b7-a71d-c6bed258f9c5)

Patient consent is required for every telemedicine consultation. Consent is implied where the patient initiates that consultation. Where an RMP, health worker or caregiver initiates a later interaction, including a follow-up call, the patient’s explicit consent must be obtained and recorded. That consent can be given through email, text, audio or video message, or orally during the call. Accordingly, a patient’s express and recorded agreement to a scheduled doctor-initiated follow-up can satisfy this requirement; the patient’s initiation of an earlier consultation does not, by itself, create continuing implied consent for subsequent calls.[9](#5225cb56-4ff1-4cb6-8b17-b173aa95c4c9) Consent to the clinical consultation also does not automatically authorize every use of the personal data generated through it.[10](#2913b37a-40e6-4a6b-b545-9b97eaaad7e1) The DPDP Act illustrates the distinction: consent to receive a telemedicine service does not permit the app to access the patient’s contact list when that information is unnecessary for the service. Every platform permission and use of consultation data must therefore have a lawful basis. Where consent is relied upon, the data must be necessary for the specified purpose.

The Guidelines also require RMPs to retain, for the period prescribed from time to time – a log or record of the telemedicine interaction, the patient records and materials used during the consultation, and any prescription issued.[11](#1efea9e2-4421-405d-844d-6397e64800a3) A “log or record” can include phone logs, email records, chats, text records or video-interaction logs; the Guidelines do not expressly require the audio or video content of every consultation to be recorded.[12](#193c7db1-4184-47d6-96a8-65c3fb5e3655) Where a hospital uses a technology platform to facilitate telemedicine and that platform processes personal data on the hospital’s behalf, the hospital remains responsible for such processing and must engage the platform under a valid contract.

1. **What are the DPDP implications for companies that manufacture or operate products such as smartwatches, connected medical devices and other health-monitoring technologies that collect personal data?**

The manufacture of hardware does not, by itself, make a company a Data Fiduciary. Responsibility arises where the company determines the means and purposes of processing digital personal data. The manufacturer, companion-app operator and healthcare provider can therefore have different – and sometimes overlapping roles for separate data flows.

Consider a cardiac monitor that transmits a patient’s readings to a manufacturer-operated application and permits the treating hospital to view them. The manufacturer’s role depends on the decisions it makes about that processing. If it independently determines that the application will collect, store or analyze identifiable readings, or use them for product improvement, it is a Data Fiduciary for those activities. If it processes the readings only on the hospital’s behalf under a valid contract, it is a Data Processor, while the hospital is the Data Fiduciary for clinical processing. Where the manufacturer receives only operational telemetry, such as battery status, uptime or error logs, the DPDP Act applies only if that information relates to an identifiable individual. The parties’ roles must therefore be determined separately for each data flow and processing purpose.[13](#451bf2a6-f157-42a9-a9ee-9f55c85980a0)

Where processing relies on consent, the company must specify the purpose and limit collection to the data necessary for it. Consent to continuous monitoring for clinical alerts does not, by itself, extend to unrelated advertising, profiling or product-development analytics. Withdrawal must be as easy as giving consent, although processing required or authorised by law can continue.

Not every smartwatch or wellness product is a regulated medical device. Where a connected product falls within the statutory medical-device framework because of its intended medical purpose, the Medical Devices Rules, 2017 apply alongside the DPDP Act. The product must therefore be designed around its actual data flows – including permissions, notices, access controls, processor arrangements, retention and deletion- rather than a single consent obtained when the user activates the device.

1. **How does the DPDP Act apply to the collection, sharing and reuse of clinical-trial data?**

The DPDP Act applies to digital personal data processed throughout a clinical trial, including during recruitment, enrolment, safety monitoring, regulatory reporting and secondary research. Digital Personal Data as defined under the DPDP Act refers to data through which a person can be identified. Compliance cannot therefore be addressed solely through the participant’s clinical trial consent form. Trial data falls outside the DPDP Act only when it no longer relates to an individual who is identifiable by or in relation to that data. Coded or de-identified trial data remains personal data if the participant can still be identified through a re-identification key, metadata or other information.[14](#c4e8a602-e004-45d0-9a0c-6956bb99c51c)

The New Drugs and Clinical Trials Rules, 2019 (**“NDCT Rules”**) require freely given, informed and written consent to participate in a trial. Where consent is relied upon under the DPDP Act, the participant must also receive a compliant notice and specifically consent to the processing of necessary personal data for stated purposes. The two requirements can be addressed in the same document because the DPDP Act does not mandate a separate consent form, but the DPDP notice must remain independently understandable and satisfy rule 3 of the DPDP Rules. Broad language permitting use for “further research” or “scientific purposes” does not, by itself, authorise every subsequent use under the DPDP Act.[15](#721916d0-bf64-4b9c-8764-88f79a3a3abe)

Responsibility follows the actual data flow. A sponsor is a Data Fiduciary where it determines the purpose and means of processing trial data. A clinical research organisation (**“CRO”**), meaning an organisation engaged by the sponsor to perform trial-related functions, is a Data Processor to the extent that it processes data on the sponsor’s behalf. A CRO or trial site that independently determines the purpose and means of a separate processing activity is a Data Fiduciary for that activity.[16](#84767258-aaaa-40f5-831d-33a475b6c538)

The research exemption does not apply to a clinical trial as a whole. It must be tested against each processing activity. It cannot cover processing used to decide whether a particular participant is eligible for the trial, what dosage that participant should receive, or whether treatment should be stopped or modified for that participant’s safety. Each is a decision specific to the participant. The exemption can apply only to separate processing that is necessary for research, is not used to take any participant-specific decision and complies with the Second Schedule standards.[17](#8842e48b-7e72-4120-9c6f-e66cb5e85195)

Withdrawal stops future processing that depends on the withdrawn consent. It does not affect processing already undertaken or prevent processing that is otherwise required or authorised by law, including prescribed reporting of serious adverse events to the Central Licensing Authority. Any secondary use of trial data must therefore be supported by valid consent covering that specified purpose, the research exemption or another basis expressly available under law.[18](#fbc4e52a-e7c1-4a48-9344-e8bd961e0c4f)

1. **How long can healthcare organizations retain patient and clinical trial data, and can they use that data at a later time for research, analytics or AI?**

The DPDP Act does not prescribe a uniform retention period for health data. Under section 8(7), a Data Fiduciary must erase personal data when consent is withdrawn or when it is reasonable to assume that the specified purpose is no longer being served, whichever occurs earlier, unless retention is necessary for compliance with another law. It must also cause its Data Processor to erase the personal data made available to it. Rule 8(3), however, requires a Data Fiduciary to retain personal data, associated traffic data and other processing logs for at least one year from the date of processing for the purposes specified in the Seventh Schedule. After that period, the data and logs must be erased unless further retention is required under another law or has been notified by the Central Government.[19](#ba92b2a2-da04-4e9e-9f39-6739f1b3062e) Rule 8(1) also prescribes a three-year inactivity period for specified large e-commerce entities, online gaming intermediaries and social media intermediaries. It does not prescribe a general three-year retention period for healthcare organizations merely because they process health data.[20](#34683525-a6ca-47e9-9e7f-bd73b7ef490c) Sectoral requirements also apply to particular records. The Code of Medical Ethics Regulations, 2002 requires physicians to maintain indoor-patient records for three years from commencement of treatment, the Telemedicine Practice Guidelines require RMPs to retain specified consultation records for the period prescribed from time to time, but do not by themselves prescribe a fixed period and; under the NDCT Rules, an Ethics Committee must retain the specified clinical-trial records for five years after completion of the trial.[21](#ae6f3776-10a6-4a10-9fca-1f9272c1492f)

Healthcare organisations must therefore determine retention by record type. Such mandatory retention overrides DPDP erasure for that period but does not authorise unrelated use of the retained data.

Later use for research can fall within the exemption under Section 17(2)(b), but only where the processing is necessary for research, archiving or statistical purposes, is not used to make a decision specific to an individual, and complies with the Second Schedule standards on necessity, data minimisation, accuracy, retention, security and accountability.

Neither does describing an AI project as “research” nor does de-identifying the dataset automatically satisfy this test. If the exemption does not apply, particularly where AI is used to make a decision specific to an identifiable patient, the organization must identify a lawful basis for that processing under the DPDP Act.[22](#28ff27d8-f57f-4b92-b60b-3832d77ce9c8)

1. **Can a hospital train an AI diagnostic model on de-identified patient imaging data without obtaining fresh consent?**

Yes, but only if the data is genuinely anonymised or the processing satisfies the statutory research exemption. “De-identified” is not a defined term or safe harbour under the DPDP Act.

If neither the images, their metadata nor linked datasets can identify an individual, the material falls outside the definition of personal data. Merely removing names or patient numbers is insufficient where re-identification remains possible.

Anonymization is therefore a threshold question, not a statutory exemption: if the data no longer relates to an identifiable individual, the DPDP Act does not apply; if identification remains possible, the data continues to be personal data, and its use must satisfy the Act.[23](#7221e202-6682-4c75-b531-b9fa36bd1f28) If the images remain personal data, the hospital cannot rely merely on the label “de-identified”. Model training can fall within the research exemption only where the processing is necessary for research, is not used to make a decision specific to a Data Principal and satisfies the standards prescribed in the Second Schedule.[24](#62cf689f-eb61-4e07-bafa-891e46e66ce0)

The research exemption can apply to training the model, but not to its later clinical use. When the model is used to recommend a diagnosis for an identifiable patient, the hospital is processing personal data to make a decision affecting that patient. It must therefore establish a separate lawful basis for this use and ensure that the personal data used is complete, accurate and consistent.[25](#de73ab67-fffa-49cf-b417-e4db02f8852c)

1. **Can a hospital share a patient’s mental health records with a caregiver without the patient’s consent?**

Ordinarily, no. A caregiver or family member does not acquire access to a patient’s mental health records merely by accompanying or caring for the patient.

The Mental Healthcare Act, 2017 (**“MHCA”**) gives every person with mental illness a right to confidentiality in relation to their mental and physical healthcare.[26](#44633ced-d304-4f2b-9305-1718541fbdde) It also presumes that the person has capacity to make treatment decisions where they can understand the relevant information, appreciate the reasonably foreseeable consequences and communicate their decision.[27](#9e14af6e-dfca-4e31-a7c7-f2b46a4097d6) A diagnosis of mental illness does not, by itself, transfer control of the patient’s information to their family.[28](#f5a4830d-9eaf-44a1-b07a-5f1f4604a826)

Any disclosure without consent must be anchored in a specific exception recognised by law. Section 23 of the MHCA provides one example: it permits information to be shared with a nominated representative to enable the performance of their statutory duties, and allows limited disclosures for treatment, protection against harm or violence, prevention of a threat to life, compliance with orders of specified authorities or courts, and public safety or security. The applicable exception determines both whether disclosure is permitted and the information that may be disclosed; it does not give the recipient a general right to the patient’s complete psychiatric file. The DPDP Act operates alongside these confidentiality protections. Its medical-emergency provision permits processing necessary to respond to a threat to life or an immediate threat to health; it does not create a general right of access for caregivers. Involvement in a patient’s care does not, by itself, confer authority to access or control the patient’s mental-health information.

**Our Thoughts**

For healthcare businesses, DPDP compliance is not principally a documentation exercise. Revising admission forms and privacy notices will achieve little if patient data continues to move through hospital systems, insurers, laboratories, research teams, device platforms and vendors without clearly defined purposes and responsibilities.

Boards and management teams should now focus on the decisions embedded in these data flows: which information is genuinely required for care; which secondary uses require separate consent or another lawful basis; who controls each use; and when legal retention ends and erasure must begin. Research, AI and connected-care initiatives should be examined at the design stage – not after patient data has already been collected or transferred.

The organisations best prepared for 13 May 2027 will be those that can account for every material use of identifiable health data from collection to deletion. In healthcare, the compliance question is no longer simply whether the patient signed a form, but whether the organisation can justify what happened to the patient’s data afterwards.

For any queries or further engagement on the matters discussed in this paper, please reach out to Acuity Law at **[*[email protected]*](/cdn-cgi/l/email-protection#f1b0bdb19092849885889d9086df929edf989f)**.

***The information contained in this document is not legal advice or legal opinion. The contents recorded in the said document are for informational purposes only and should not be used for commercial purposes. Acuity Law LLP disclaims all liability to any person for any loss or damage caused by errors or omissions, whether arising from negligence, accident, or any other cause.*** 

1. Ministry of Health and Family Welfare, Government of India, *‘100 Crore Health Records Linked with ABHA under ABDM, Marking Major Leap in Digital Healthcare’*, 22 May 2026, [PIB Release No. 2264241](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2264241&lang=1&utm_source=chatgpt.com). [↩︎](#d3da180b-7664-4d36-93f3-e4fd8211bf7d-link)
2. National Health Authority, Ministry of Health and Family Welfare, Government of India, ‘ABDM Insights Dashboard’, figure for “Bharat Health Accounts (ABHA) Overall”, accessed 12 October 2026, [https://dashboard.abdm.gov.in/abdm/](https://dashboard.abdm.gov.in/abdm/). [↩︎](#7b18a478-c787-408e-93f1-eda5c436167d-link)
3. Digital Personal Data Protection Act, 2023, section 33(1) read with the Schedule, serial numbers 1 and 2. [↩︎](#c76e2201-837a-409c-8573-238bdff267b0-link)
4. Digital Personal Data Protection Act, 2023, sections 9(2) and 9(4); Digital Personal Data Protection Rules 2025, rule 12(1) read with Fourth Schedule, Part A, serial numbers 1 and 2. [↩︎](#16219758-f2be-4bab-af0a-79bcbe52c62b-link)
5. National Health Authority, “Ayushman Bharat Health Account (ABHA) – PHR Mobile App”, application description, stating that individuals can control who may access their health records, the type of health information accessible and the duration of access, available at [ABHA App, Google Play](https://play.google.com/store/apps/details?id=in.ndhm.phr). [↩︎](#57f97195-85c7-4833-a18d-1dc2e5e37e4f-link)
6. National Health Authority, *Health Data Management Policy* (December 2020), clause 5.3, [↩︎](#1b184a73-eda7-4a95-8140-8f5c0186ea06-link)
7. Insurance Regulatory and Development Authority of India, *Master Circular on Protection of Policyholders’ Interests, 2024*, Ref. IRDAI/PP&GR/CIR/MISC/117/9/2024, 5 September 2024, Part B, “Health Insurance Policies”, Section II, para 1(v), p. 23. See also Insurance Regulatory and Development Authority of India (Protection of Policyholders’ Interests, Operations and Allied Matters of Insurers) Regulations, 2024, regulation 15(1)-(3). [↩︎](#0e8bcd5c-9f8e-4650-9d69-e403da20a3fa-link)
8. Telemedicine Practice Guidelines, 2020, paragraphs 1.4.1, 1.4.2, 3.1.1 and 3.3.1-3.3.3. [↩︎](#23a024ee-364e-46b7-a71d-c6bed258f9c5-link)
9. Telemedicine Practice Guidelines, 2020, paragraphs 3.4.1–3.4.3. See also paragraphs 3.6.2 and 4.1.2 concerning follow-up consultations. [↩︎](#5225cb56-4ff1-4cb6-8b17-b173aa95c4c9-link)
10. Digital Personal Data Protection Act, 2023, sections 4, 5 and 6(1). [↩︎](#2913b37a-40e6-4a6b-b545-9b97eaaad7e1-link)
11. Telemedicine Practice Guidelines, 2020, paragraphs 3.7.2-3.7.2.3. [↩︎](#1efea9e2-4421-405d-844d-6397e64800a3-link)
12. Telemedicine Practice Guidelines, 2020, paragraph 3.7.2.1. [↩︎](#193c7db1-4184-47d6-96a8-65c3fb5e3655-link)
13. Digital Personal Data Protection Act, 2023, sections 2(i), 2(k), 2(t), 2(x) and 8(2). [↩︎](#451bf2a6-f157-42a9-a9ee-9f55c85980a0-link)
14. DPDP Act, section 2(t). [↩︎](#c4e8a602-e004-45d0-9a0c-6956bb99c51c-link)
15. NDCT Rules, Third Schedule, paragraph 2(a), (b) and (f), read with Table 3; DPDP Act, sections 4(1), 5(1) and 6(1); DPDP Rules, rule 3(a) and (b). [↩︎](#721916d0-bf64-4b9c-8764-88f79a3a3abe-link)
16. DPDP Act, sections 2(i), 2(k), 8(1) and 8(2). [↩︎](#84767258-aaaa-40f5-831d-33a475b6c538-link)
17. DPDP Act, section 17(2)(b); DPDP Rules, rule 16 read with the Second Schedule. [↩︎](#8842e48b-7e72-4120-9c6f-e66cb5e85195-link)
18. DPDP Act, sections 4, 6(4)–6(6), 7(d) and 17(2)(b); NDCT Rules, rules 25(x) and 42. [↩︎](#fbc4e52a-e7c1-4a48-9344-e8bd961e0c4f-link)
19. DPDP Act, section 8(7); DPDP Rules, rule 8(3) read with the Seventh Schedule. [↩︎](#ba92b2a2-da04-4e9e-9f39-6739f1b3062e-link)
20. DPDP Rules, rule 8(1) read with the Third Schedule. [↩︎](#34683525-a6ca-47e9-9e7f-bd73b7ef490c-link)
21. Code of Medical Ethics Regulations, 2002, regulation 1.3.1; Telemedicine Practice Guidelines, 2020, paragraphs 3.7.2–3.7.2.3; NDCT Rules, rule 13(1) and (2). [↩︎](#ae6f3776-10a6-4a10-9fca-1f9272c1492f-link)
22. DPDP Act, sections 2(t), 4 and 17(2)(b); DPDP Rules, rule 16 read with the Second Schedule. [↩︎](#28ff27d8-f57f-4b92-b60b-3832d77ce9c8-link)
23. DPDP Act, sections 2(t) and 3. Neither the DPDP Act nor the DPDP Rules defines “anonymization” or “de-identification”. Data falls outside the Act only where it is no longer about an individual who is identifiable by or in relation to that data. [↩︎](#7221e202-6682-4c75-b531-b9fa36bd1f28-link)
24. DPDP Act, section 17(2)(b); DPDP Rules, rule 16 read with the Second Schedule. [↩︎](#62cf689f-eb61-4e07-bafa-891e46e66ce0-link)
25. DPDP Act, sections 4, 8(3) and 17(2)(b). [↩︎](#de73ab67-fffa-49cf-b417-e4db02f8852c-link)
26. MHCA, section 23(1). [↩︎](#44633ced-d304-4f2b-9305-1718541fbdde-link)
27. MHCA, section 4(1) and (2). [↩︎](#9e14af6e-dfca-4e31-a7c7-f2b46a4097d6-link)
28. MHCA, sections 5–14 and 23(2)(a). [↩︎](#f5a4830d-9eaf-44a1-b07a-5f1f4604a826-link)

---

## Acuity Law

- Website: https://acuitylaw.co.in
- Contact: richagotech@gmail.com