Recent Amendments to DPDP Act: What's New for Healthcare?

The recent amendments to the DPDP Act, particularly for 2026, have introduced significant changes that healthcare organizations must adapt to. These amendments aim to strengthen patient data rights, addressing how sensitive medical data is collected, processed, and stored. Section 8(1) emphasizes the need for explicit consent from patients before their data can be processed, marking a shift towards prioritizing patient autonomy and security. Healthcare providers must ensure they have comprehensive consent mechanisms in place. This includes informing patients about the purpose of data collection and their rights regarding their personal health information. For example, a hospital must not only seek patient consent for treatment but also inform them of how their data will be used for research or shared with third parties.

The DPDP Act amendments enhance patient data rights significantly. Patients now have the right to access their data, request corrections, and even withdraw consent at any time. This aligns with the global trend of empowering individuals regarding their personal information. Healthcare organizations must implement procedures that allow patients to easily make such requests, thereby promoting transparency and trust. For instance, a clinic could establish a user-friendly portal where patients can access their health records, request changes, or withdraw consent efficiently. Failing to comply with these requirements could lead to legal consequences and loss of patient trust.

One of the most urgent obligations under the DPDP Act amendments is the requirement for healthcare organizations to report any data breaches within 72 hours, as specified in Rule 7(2)(b). This rule is crucial for preventing further data exposure and ensuring that affected individuals are notified promptly. Organizations must develop a robust incident response plan that includes identifying potential breaches, assessing their impact, and documenting the response actions. For example, if a healthcare provider experiences a ransomware attack, they must quickly assess the situation, contain the breach, and report it to the Data Protection Board within the stipulated 72 hours. This not only helps mitigate the damage but also demonstrates compliance with the regulatory framework.

The amendments to the DPDP Act have established stringent penalties for non-compliance, particularly concerning data breaches. Organizations in the healthcare sector face penalties that can reach up to ₹250 crores, depending on the severity of the breach and the sensitivity of the data involved. Section 15 outlines the various circumstances under which penalties may be applied, highlighting the importance of implementing strong data protection measures. Healthcare organizations should conduct regular audits and training to ensure compliance with the DPDP Act and mitigate the risk of costly breaches. For instance, a hospital might invest in cybersecurity solutions and employee training programs to safeguard patient data, thereby reducing the likelihood of a breach and associated penalties.