The privacy prescription: Impact of DPDP Act and rules in healthcare and life sciences sector

Explicit, informed consent is mandatory for collecting and using patient data. Blanket or implied consent is invalid

Individuals can access, correct, and erase their health data, systems must be designed to ensure compliance

Only necessary data for treatment or research can be processed; secondary use without consent is prohibited

Appointment of Data Protection Officers (DPOs), breach reporting within 72 hours, and Data Protection Impact Assessments (DPIAs) for high-risk activities are mandatory