Before a specialist in India can review your case, you send some of the most private things you own: scans, biopsy reports, a list of medicines, sometimes a photo of your passport. It is right to ask where they go, who sees them, and how long they are kept. India now has a dedicated data-protection law. Here is where it stands today, and what it means for you.
The law in one paragraph
The Digital Personal Data Protection Act 2023 applies to digital personal data processed in India — and to processing outside India when it relates to offering goods or services to people in India. Anyone who decides why and how your data is used (the law calls them a "data fiduciary", such as a hospital, a lab or a facilitator) must use it lawfully, for a stated purpose, keep it secure, and delete it when it is no longer needed. You, the "data principal", get rights to information, correction, erasure, grievance redress and to nominate someone to act for you.
What is in force now, and what comes next
The government notified the Digital Personal Data Protection Rules on 13 November 2025 and chose a phased start, so organisations have time to prepare.
- August 2023DPDP Act passed by Parliament.
- 13 November 2025Rules notified; Data Protection Board of India established.
- 13 November 2026Consent manager registration and duties begin.
- 13 May 2027Core duties begin: notice and consent, security safeguards, breach reporting, children's data, your rights.
- Until thenHealth data remains protected as 'sensitive personal data' under the IT Act and its 2011 rules.
If you live outside India, your own country's privacy law may also apply to organisations there that handle your records, such as your doctor at home or your insurer. The Indian law covers the Indian side of your journey.
Until the main provisions start in May 2027, the older protections continue: section 43A of the Information Technology Act and the 2011 rules on sensitive personal data, which already treat medical records and health information as sensitive. Doctors are also bound by professional confidentiality, and the Charter of Patients' Rights lists confidentiality and privacy among a patient's rights.
What the new rules will require
The Rules turn the Act's principles into practical duties. Most will matter to you as a patient only when something goes wrong, but it is reassuring to know what you can expect from May 2027:
- Clear notice. Organisations must tell you, in plain language, what data they collect and why.
- Easy withdrawal. Withdrawing consent must be as easy as giving it.
- Breach reporting. After a personal data breach, affected people must be told without delay, and the Data Protection Board must receive a detailed report within 72 hours of the organisation becoming aware.
- Grievances answered. Complaints must be resolved within a reasonable time of no more than 90 days.
- Logs kept. Certain logs must be kept for at least a year to help detect and investigate breaches.
- Consent managers. Registered platforms that let you give, manage and withdraw consent, and that may not read the data passing through them.
Practical steps to protect your records
None of this needs legal knowledge. It needs a few minutes of care each time you share something, and the confidence to ask an organisation how it handles your file. A good one will answer gladly.
Laws help, but good habits help more. Remember too that your data may sit in several places at once: your own phone, your email, your doctor at home, the hospital in India, the lab, and any facilitator. Each copy is a small risk, so fewer copies in fewer places is better. These steps cost nothing:
- Send only what is needed. Medical reports for a medical review; passport details only when a visa letter or admission needs them.
- Use secure links, not open email chains. Ask for an upload portal or a protected link.
- Ask who will see your file and how long it will be kept.
- Keep your own complete copy of everything, in one folder.
- Ask for deletion when you no longer need an organisation to hold your records — and ask for confirmation.
- Beware messaging-app forwarding. Reports shared in large groups can travel far.
How BookMedTrip handles your documents
We collect only what the doctor needs to review your case, share it only with the specialists and hospitals you agree to, and never sell it. Documents you upload are kept for seven days by default, unless you tick a box asking us to keep them longer; before any automatic deletion we ask you to confirm, and we log what was deleted. You can ask us at any time what we hold about you, and ask us to delete it sooner. We are preparing for the full DPDP duties that begin in May 2027, and we already follow the principle behind them: your data, your choice.
Have a question about your records? Write to us, or read about how we work. You can see what the US$99 consultation asks you to send, and why. When you are ready, book here.
Independent research. Figures are quoted from the official and published sources listed below, as they stood when we checked them (October 2026). BookMedTrip is an independent facilitator and is not affiliated with any government body, hospital, charity or organisation named here, and receives no commission from them. If anything here is out of date or inaccurate, please write to care@bookmedtrip.com and we will correct it.
Su'aalo
Is the DPDP Act in force in India?
Partly. The Rules were notified on 13 November 2025 and the Data Protection Board was set up then. Consent manager rules start on 13 November 2026 and the main duties, including your rights and breach reporting, on 13 May 2027.
How is my medical data protected in India before May 2027?
Health information is treated as sensitive personal data under section 43A of the IT Act and its 2011 rules, which remain in force until the DPDP provisions take over. Doctors also have duties of confidentiality.
What rights will patients have under the DPDP Act?
Rights to information about processing, correction and erasure, grievance redress, and to nominate someone to act for them; withdrawing consent must be as easy as giving it.
