This, the second in a two-part series on health data protection law, examines the impact of the Digital Personal Data Protection Act, 2023 (DPDPA), on healthcare organisations.

The DPDPA was enacted in 2023 but is not yet in effect. It regulates personal data processing by data fiduciaries. These are entities that determine the purposes and means of processing personal data. Hospitals, clinical establishments, laboratories and clinical research organisations will likely be data fiduciaries. The DPDPA does not regulate dataprocessors, which are entities that process personal data on behalf of data fiduciaries. Global standards point to health-tech providers and businesses offering services for IT systems, cloud computing, health record management and health apps likely being classified as data processors.

However, if such organisations determine the means and purposes of processing, they will be data fiduciaries. A health technology B2B data analysis entity using personal data provided by its customers to improve its business or train its AI or ML models would be a data fiduciary. Many players in India offer services to companies outside the country without handling Indian residents’ personal data. Such arrangements enjoy exemptions under the DPDPA.