The Digital Personal Data Protection Act, 2023 ("DPDP Act") is the latest legislation governing how organizations will process, retain and protect the digital personal data of individuals. Each organization that collects and processes digital personal data of any individual, including its own employees, will be required to comply with these new regulations. It is important to note that personal data can only be processed with proper consent and for certain outlined legitimate uses.
The PDPA legislation characterizes personal data as "any information concerning a person who can be identified by or in connection with said data". This encompasses various types of personal identification details, including name, address, contact number, Aadhaar, PAN card, Passport, and so on.
Impacts on Healthcare
The DPDP Act will require healthcare providers and entities to obtain explicit consent from data principals (individuals whose data is processed) before collecting, using, or sharing their personal health data, which is classified as sensitive personal data under the law
The DPDP Act will also mandate healthcare providers and entities to implement appropriate security measures, conduct data protection impact assessments, appoint data protection officers, and comply with the codes of practice and standards issued by the Data Protection Board of India
The DPDP Act will enable data principals to access, correct, erase, port, and restrict the processing of their personal health data and seek redressal for any grievances or violations of their rights
The DPDP Act will create new opportunities for innovation and collaboration in the healthcare industry, as it will facilitate the use of personal health data for research, public health, emergency response, and other purposes, subject to certain conditions and safeguards
Up to INR10,000 Breach in observance of duty of Data Principal
Up to INR200 Crore Breach in observance of additional obligation in relation to children
Up to INR200 Crore Breach in not giving notice of Personal Data Breach
Up to INR250 Crore Noncompliance of the provisions by Data Fiduciaries
FAQ
frequently asked questions
