Glossary term · Law & regulation
Digital Personal Data Protection Act 2023 (also: DPDP Act, DPDPA): The DPDP Act 2023 is India’s law governing how digital personal data is processed, setting consent rules, individual rights and duties for organisations that handle data.
The Digital Personal Data Protection Act 2023 is India’s main law on digital personal data. It was enacted on 11 August 2023 as Act 22 of 2023. It requires clear consent for processing, lets you withdraw consent, and gives you rights to access, correct and erase your data. It applies when Indian hospitals and services handle the reports you send.
Who is who under the Act?
- Data Principal: the individual the data is about. For a child this includes the parent or lawful guardian.
- Data Fiduciary: the organisation that decides why and how data is processed, such as a hospital.
- Consent Manager: a registered person who lets you give, manage, review and withdraw consent from one place.
- Data Protection Board of India: the body set up under the Act.
What does valid consent look like?
Section 6 says consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. You may withdraw consent at any time. Withdrawing must be about as easy as giving consent. Withdrawal does not make earlier processing unlawful.
What rights do you have?
- Access: a summary of your data, how it is processed and who it was shared with (section 11).
- Correction and erasure of inaccurate or incomplete data (section 12).
- Grievance redressal through the organisation first (section 13).
- Nominating someone to act for you if you die or lose capacity (section 14).
Section 8 requires reasonable security safeguards. After a personal data breach the organisation must inform the Board and each affected person.
What does this mean for medical travellers?
Before you send scans and reports, ask who will see them and why. Ask how long they will be kept and how to withdraw consent. Send only what the specialist needs for an opinion. Use secure links rather than open messaging groups where possible.
Questions people ask
Can I ask a hospital in India to delete my reports?
Section 12 gives a right to request erasure of personal data. Some records may need to be kept for legal or medical reasons. Ask the hospital’s grievance officer in writing and keep a copy of your request.
Does the Act allow my data to leave India?
Section 16 lets the Central Government restrict transfers to specified countries or territories by notification. Ask any provider where your data will be stored and processed, especially if you request reports to be sent abroad.
Sources
General information, not medical or legal advice. Rules change: confirm with the official source. How we write and check.