DPDP Act in Hospitals: Why Clinical Consent Falls Short

Overview

The Digital Personal Data Protection Act, 2023 establishes that obtaining clinical consent for surgical or medical treatment under National Medical Commission guidelines no longer gives healthcare providers lawful authority to collect, digitise, or share a patient's personal health data. Under the statute, hospitals operate as statutory Data Fiduciaries bound by strict purpose limitation, mandatory itemised notices, and verifiable security safeguards. While Section 7 carves out narrow legitimate-use exemptions for acute life-threatening emergencies, treating medical consent as an all-inclusive privacy waiver violates informational self-determination under Article 21. As of March 2025, healthcare administrators face statutory financial penalties of up to ₹250 crore for data security lapses, requiring hospitals to fundamentally decouple bedside clinical care from digital personal data compliance.

The Supreme Court of India recognised health data as an intimate zone of personal privacy requiring constitutional protection under Article 21 in the landmark Puttaswamy judgment. Writing for the nine-judge bench, the Court affirmed that informational privacy forms an intrinsic facet of human dignity and personal liberty. Because health records expose vulnerable physiological, genetic, and psychological details, mishandling medical records inflicts severe dignitary and social harm.

Modern hospitals no longer function as isolated physical clinics. Digital workflows like electronic health records, automated insurance verification, telemedicine portals, and diagnostics routinely digitise sensitive patient information across connected networks. This technological shift has outpaced traditional administrative practices, leaving large troves of patient records exposed on institutional servers.

The Digital Personal Data Protection Act, 2023 transforms this constitutional doctrine into a binding regulatory regime. Under Section 2(i) of the statute, hospitals qualify as Data Fiduciaries because they determine the purpose and means of processing personal health data. Blanket admission forms that bundle medical treatment with commercial data sharing no longer satisfy legal standards, exposing healthcare administrators to direct regulatory scrutiny.

Indian medical jurisprudence draws a strict boundary between physical clinical consent under common law and digital data consent under the Digital Personal Data Protection Act, 2023. For decades, hospital admission protocols relied on a single signature to cover diagnosis, surgical risk, physical handling, and administrative record-keeping. The new statutory framework renders this unified approach legally invalid.

Clinical consent originates in medical ethics and tort law. In Samira Kohli v. Dr. Prabha Manchanda (2008), the Supreme Court established that a doctor must secure informed consent before initiating physical procedures, ensuring the patient understands the nature, risks, and alternatives of the intervention. Regulated by the National Medical Commission, this doctrine shields physicians against allegations of assault, battery, or negligence, but it confers no legal authority to digitise, store, or profile patient information.

+-------------------------------------------------------------------------+
|                    THE DUAL CONSENT ARCHITECTURE                        |
|                                                                         |
|  +--------------------------------+  +-------------------------------+  |
|  |     CLINICAL CONSENT           |  |     DATA CONSENT              |  |
|  |  (Samira Kohli / NMC Rules)    |  |  (DPDP Act, 2023, Sec 6)      |  |
|  +--------------------------------+  +-------------------------------+  |
|  | • Bodily integrity            |  | • Informational self-         |  |
|  | • Authorises physical surgery  |  |   determination               |  |
|  | • Protects doctor from battery |  | • Limits storage and sharing  |  |
|  | • Non-negotiable for care      |  | • Fines up to ₹250 crore      |  |
|  | • Regulated by NMC             |  | • Freely withdrawable         |  |
|  +--------------------------------+  +-------------------------------+  |
+-------------------------------------------------------------------------+

Data consent, by contrast, protects informational self-determination rather than bodily integrity. Governed by Section 6(1) of the DPDP Act, 2023, it demands explicit permission to process digital personal data for designated purposes. A patient may willingly consent to an emergency appendectomy while refusing to let the hospital transfer diagnostic records to marketing networks or third-party insurers.

Section 6(1) of the Digital Personal Data Protection Act, 2023 requires hospitals to secure consent that is freely given, specific, informed, unconditional, and unambiguous through clear affirmative action. Standard pre-ticked checkboxes and vague non-disclosure clauses buried in multi-page admission forms fail every legal test laid out in the statute.

Compliance requires hospitals to follow clear operational standards:

• Itemised Pre-Consent Notice: Under Section 5 of the DPDP Act, 2023, hospitals must present patients with a distinct, itemised notice before requesting consent, detailing the exact categories of data collected, specific processing purposes, and complaint procedures.
• Prohibition of Conditional Service: Section 6(1) forbids conditioning the provision of a service on data consent that is not directly necessary for that service. A hospital cannot refuse admission or clinical consultation simply because a patient declines optional data sharing.
• Simple Withdrawal Mechanisms: Section 6(4) provides patients the statutory right to withdraw data consent at any time, mandating that the process of revoking consent must be as effortless as granting it.
• Unbundled Commercial Permissions: Sharing patient profiles with pharmaceutical companies or diagnostic marketing chains requires separate, explicit opt-ins rather than bundled administrative agreements.
• Protection for Minors: Section 9 strictly prohibits processing a child's digital data without verifiable parental consent, barring behavioural tracking or targeted promotions directed at paediatric patients.

Section 7 of the Digital Personal Data Protection Act, 2023 provides narrow legitimate-use exemptions where healthcare institutions may process patient data without prior consent. The legislature incorporated these non-consensual processing grounds to ensure data governance rules do not hinder urgent, life-saving medical responses.

The statute outlines three specific healthcare situations that waive standard consent requirements:

• Medical Emergencies: Under Section 7(f), a Data Fiduciary may process personal data without consent to respond to a medical emergency involving a threat to the life or an immediate threat to the health of the individual. When an unconscious trauma victim arrives at an emergency department, clinicians can extract identifying records and medical history immediately.
• Epidemics and Disease Outbreaks: Section 7(g) authorises non-consensual processing when taking measures to deliver medical treatment or health services during an epidemic, outbreak, or public health threat. This enables municipal monitoring and disease containment without requiring bureaucratic clearance from individual patients.
• Disaster Relief: Section 7(h) permits data processing without consent to ensure safety or provide relief services during disasters or public order breakdowns.

These exemptions apply strictly to immediate clinical response. Once an emergency patient stabilises, hospitals cannot invoke Section 7(f) to retain, process, or monetize that data for secondary administrative or commercial purposes.

Healthcare institutions face severe vicarious liability under Section 8(1) and Section 8(2) of the DPDP Act, 2023 for breaches committed by external data processors. Hospitals routinely transfer digital patient records across complex supply chains involving Electronic Health Record (EHR) vendors, cloud hosts, diagnostic chains, telemedicine applications, and insurance Third-Party Administrators (TPAs).

Section 8(1) prohibits hospitals from engaging external processors without a valid, legally binding contract. If an outsourced cloud provider suffers a cyber intrusion or leaks diagnostic records, the hospital remains fully liable as the primary Data Fiduciary, regardless of contractual disclaimers shifting blame to the vendor.

Data flows to insurance intermediaries carry particularly high compliance risks. Sharing detailed clinical notes and full medical histories with TPAs without specific, unbundled consent violates Section 6(1). Furthermore, under Section 11(1), patients have the explicit right to demand a summary of all health data shared by the hospital, along with the precise legal identities of all third-party recipients.

Under Section 8(5) and Item 1 of the Schedule, failing to implement reasonable security safeguards attracts financial penalties of up to ₹250 crore. Additionally, Section 8(6) penalises failures to notify both the Data Protection Board of India and affected patients of data breaches with fines reaching up to ₹200 crore.

Emergency medical triage creates an immediate philosophical friction between the bioethical duty of beneficence and statutory informational self-determination under the DPDP Act, 2023. In classical medical ethics, physicians follow the principle of beneficence—prioritising the immediate preservation of life and physical well-being above administrative formalities. Digital privacy statutes, however, champion individual autonomy and informational sovereignty.

This tension becomes acute during critical triage admissions. When clinical staff must act within seconds, forcing patients or distressed family members to read detailed digital notices undermines urgent care delivery. While Section 7(f) resolves this by suspending consent during immediate life threats, hospital administrators often err on the side of caution by thrusting comprehensive consent forms onto patients before treating them.

Conditioning emergency admissions or urgent surgical procedures on signing broad data-processing agreements violates the non-conditionality mandate of Section 6(1). Research published by the National Institutes of Health highlights that psychiatric documentation requires exceptional procedural safeguards. Because secondary leaks of mental health histories cause severe social stigma and workplace discrimination, hospitals face a profound moral and legal duty to segregate clinical treatment records from broader institutional databases.

Healthcare facilities operating as Data Fiduciaries under Section 2(i) of the DPDP Act, 2023 must fundamentally restructure their digital and administrative intake workflows. Meeting statutory requirements requires a systematic overhaul of patient registration, digital record management, and third-party vendor oversight.

Healthcare providers must implement four structural changes:

• Decouple Documentation Workflows: Hospitals must completely segregate clinical treatment consent from digital data notices. Emergency care, outpatient consultations, and standard diagnostic services must proceed without requiring patients to sign commercial data-sharing waivers.
• Reconcile Record Retention Policies: Section 8(7) of the DPDP Act mandates data erasure once a specified clinical purpose is fulfilled or when a patient withdraws consent, unless retention is legally required. Healthcare administrators must align this with Regulation 1.3 of the NMC Regulations, 2002, which requires doctors to preserve medical records for a minimum of 3 years from treatment commencement.
• Establish Grievance Redressal Mechanisms: Under Section 8(9), every hospital must institute a dedicated grievance redressal mechanism and publish the official contact information of a designated officer to handle patient privacy complaints.
• Comply with Significant Data Fiduciary Mandates: Large hospital networks designated by the Central Government as Significant Data Fiduciaries under Section 10 must appoint an India-resident Data Protection Officer, commission annual independent audits, and carry out periodic Data Protection Impact Assessments.

Balancing patient privacy and emergency healthcare delivery requires the National Medical Commission and the Data Protection Board of India to establish harmonised operational protocols. Data protection rules must safeguard sensitive physiological records without introducing bureaucratic bottlenecks into acute clinical settings.

Hospitals must adopt a dual-track documentation pathway. Under this design, life-saving triage proceeds immediately under the legitimate-use provisions of Section 7(f) without consent paperwork. Standard data consent and notice protocols under Section 6(1) apply only after the medical emergency has been fully resolved and the patient is stable.

Software providers building hospital management infrastructure must embed privacy-by-design principles into electronic systems. Role-based access controls, automatic end-to-end encryption, and dynamic consent dashboards empower patients to manage secondary disclosures to insurers and researchers directly. By aligning day-to-day administrative practices with the DPDP Act, Indian healthcare institutions can protect constitutional privacy under Article 21 while maintaining clinical efficiency.

• Distinct Legal Foundations: Clinical consent under Samira Kohli (2008) authorises physical medical interventions, whereas data consent under Section 6(1) of the DPDP Act, 2023 governs the digital collection, processing, and sharing of personal health records.
• Data Fiduciary Accountability: Hospitals operate as Data Fiduciaries under Section 2(i) and bear primary legal liability for personal data breaches, facing financial penalties of up to ₹250 crore under Section 8(5) for failing to implement reasonable security safeguards.
• Narrow Emergency Exemptions: Section 7(f) permits hospitals to process patient data without prior consent during acute medical emergencies, but this carve-out expires once the patient is stabilised.
• Unbundled and Free Consent: Section 6(1) explicitly prohibits hospitals from conditioning clinical admission or medical care on patient consent for optional data processing or commercial third-party sharing.
• Retention Harmonisation: Section 8(7) mandates data erasure upon consent withdrawal or purpose completion, but hospitals must maintain records for at least 3 years to satisfy Regulation 1.3 of the NMC Regulations, 2002.