Current Affairs · · GS2 · Social Justice

DPDP Act puts hospitals on notice, but staff training lags

A Hindu opinion piece argues that India's data protection law will not protect patients unless doctors, nurses and technicians are trained and small facilities get affordable security support. With the DPDP Rules phasing in through May 2027, hospitals must handle consent, access and breaches more carefully without delaying care.

Event date:

REq1
  1. Note1 / 6

    WHY IN NEWS?

    • A Hindu opinion piece says India must train its clinical staff before data rules take full effect.
    • The Digital Personal Data Protection Rules were notified on 13 November 2025.
    • Rules on consent managers are due to apply from November 2026, and most obligations from May 2027.
    • The writer warns that a law assuming compliance, and waiting for complaints, will not protect patients by itself.
  2. Note2 / 6

    WHO IS WHO UNDER THE LAW

    Role under DPDP ActIn a hospitalMain duty
    Data principalThe patientHas rights to information, correction and grievance redress
    Data fiduciaryThe hospital or clinicDecides why and how data is used; must keep it safe
    Data processorCloud, software or lab partnersProcesses data on the hospital's behalf

    Failure to take reasonable security safeguards can attract penalties of up to ₹250 crore.

  3. Note3 / 6

    KEY CONCEPTS

    1. Does consent to treatment cover all uses of patient data?

    No. Consent for treatment does not automatically allow unrelated uses, such as selling scans for commercial research.

    1. Why is health data especially sensitive?

    It reveals illness, medication and test results. A leak can cause stigma, discrimination or fraud.

    1. What is role-based access?

    Each staff member sees only the data needed for their job. An emergency doctor may need allergy records quickly; a billing clerk does not need clinical notes.

    1. What is the Ayushman Bharat Digital Mission?

    It is a national programme to create digital health IDs and secure, linked health records across providers.

  4. Note4 / 6

    THE CHALLENGES

    These points are the writer's argument.

    • Costs: Encryption, audits and training are expensive for small hospitals and primary health centres.
    • Patients may pay: With high out-of-pocket spending, compliance costs could pass on to patients.
    • Many hands: Records flow to insurers, labs, telemedicine apps and cloud providers.
    • Everyday lapses: Shared passwords, misdirected reports and messaging apps leak data despite investment in systems.
    • Skills gap: Medical confidentiality training does not cover digital consent, audit logs or breach reporting.
  5. Note5 / 6

    WAY FORWARD

    These are the writer's suggestions, not adopted policy.

    • Use shared infrastructure: Build on ABDM for secure data exchange instead of each facility building its own.
    • Train the workforce: Add data-protection modules to medical, nursing and allied-health courses.
    • Help small providers: Offer model consent forms, vendor contracts and security support.
    • Control access smartly: Combine role-based permissions and audit trails with emergency access rules.
    • Inform patients in their own languages about how data is used.
    • Coordinate the Health Ministry, National Health Authority, MeitY and States on sector standards.
  6. Note6 / 6
    REq1

Sources

Syllabus

PaperSubjectSub-topic
GS2Social JusticeHealth, government policies, data protection, governance
GS3Internal SecurityCybersecurity
PrelimsPolityDPDP Act 2023, data fiduciary, data principal, ABDM

Topics

Fundamental RightsGovernanceInformation and Communication Technology

Related previous-year questions

Asked in earlier UPSC Prelims papers on this topic. Answer, then check.

  1. UPSC Prelims 2019 · International Relations and Current Affairs · Current Affairs

    Which of the following adopted a law on data protection and privacy for its citizens known as 'General Data Protection Regulation' in April 2016 and started implementation of its from 25th May, 2018?

    1. Australia
    2. Canada
    3. The European Union
    4. The United States of America
    Show answer

    Answer: C. General Data Protection Regulation (GDPR) aims to protect all European Union (EU) citizens from data breaches. The regulation was approved by the EU Parliament in April 2016 after about four years of preparation and debate, and came into effect on May 25, 2018. Australia, Canada, and the United States of America have their own data protection laws but none of them is called GDPR. GDPR is specifically a European Union regulation. Correct answer: The European Union → Option (c).

    Difficulty: easy · direct

    Open this question on its own page, with the full explanation →

  2. UPSC Prelims 2021 · Polity · Fundamental Rights

    Right to Privacy' is protected under which Article of the Constitution of India?

    1. Article 15
    2. Article 19
    3. Article 21
    4. Article 29
    Show answer

    Answer: C. In K. S. Puttaswamy Case (2017), Supreme Court of India has held that right to privacy is a Fundamental Right and it is protected under Article 21 of the Constitution of India. The Court reasoned that privacy is an incident of fundamental freedom or liberty guaranteed under Article 21. The Court overruled M.P. Sharma, and Kharak Singh judgements, in so far as the latter did not expressly recognize the right to privacy. Hence option (c) is the correct answer.

    Difficulty: easy · direct

    Open this question on its own page, with the full explanation →

  3. UPSC Prelims 2024 · Polity · Fundamental Rights

    Under which of the following Articles of the Constitution of India, has the Supreme Court of India places the Right to Privacy?

    1. Article 15
    2. Article 16
    3. Article 19
    4. Article 21
    Show answer

    Answer: D. The Supreme Court of India in Justice K.S. Puttaswamy (Retd) vs Union of India has declared that the Right to Privacy is a fundamental right under Article 21. In doing so, the Supreme Court overruled verdicts given in the M.P. Sharma case in 1958 and the Kharak Singh case in 1961, both of which had held that the right to privacy is not protected under the Indian Constitution. Article 21 guarantees protection of life and personal liberty, and the Right to Privacy has been placed under this article. Hence option (d) Article 21 is the correct answer.

    Difficulty: easy · direct

    Open this question on its own page, with the full explanation →

  4. UPSC Prelims 2018 · Polity · Fundamental Rights

    Right to Privacy is protected as an intrinsic part of Right to Life and Personal Liberty. Which of the following in the Constitution of India correctly and appropriately imply the above statement?

    1. Article 14 and the provisions under the 42nd Amendment to the Constitution
    2. Article 17 and the Directive Principles of State Policy in Part IV
    3. Article 21 and the freedoms guaranteed in Part III
    4. Article 24 and the provisions under the 44th Amendment to the Constitution
    Show answer

    Answer: C. Article 21 and the freedoms guaranteed in Part III are the correct reference, so the answer is (c). In K. S. Puttaswamy and others versus Union of India and others, the Supreme Court held that the right to privacy is an integral part of the right to life and personal liberty guaranteed by Article 21, adding that the right to privacy is intrinsic to the entire fundamental rights chapter of the Constitution. Option (c) captures both halves of that holding, the specific Article and the wider Part III. The distractors pair an unrelated Article with an unrelated amendment or Part. Article 14 concerns equality, Article 17 abolishes untouchability, and Article 24 prohibits child labour in hazardous employment, and none of these was the basis of the privacy judgment. SOURCE: The Hindu resource page on the Supreme Court verdict on the right to privacy. HOW TO CRACK IT: The stem quotes the judgment's own language, right to life and personal liberty, which is the heading of Article 21, so the answer is signposted in the question itself. Read the stem for constitutional phrases that map directly onto an Article, since UPSC often embeds the answer in the wording. Learn the landmark judgment together with the Article it construes.

    Difficulty: easy · direct

    Open this question on its own page, with the full explanation →

Practice questions

  1. Under the DPDP Act, 2023, a hospital that decides why and how patient data is processed is a:

    1. Data principal
    2. Data fiduciary
    3. Data processor
    4. Consent manager.
    Show answer

    Answer: B. The patient is the data principal.

    Difficulty: medium · statement

  2. The maximum penalty under the DPDP Act for failing to take reasonable security safeguards is:

    1. ₹50 crore
    2. ₹100 crore
    3. ₹250 crore
    4. ₹500 crore.
    Show answer

    Answer: C. It is the highest penalty in the Act's schedule.

    Difficulty: medium · statement

  3. Role-based access control in a hospital means:

    1. All staff see all records
    2. Each staff member sees only data needed for their role
    3. Patients control all access directly
    4. Only doctors can see records.
    Show answer

    Answer: B. It balances privacy with timely care.

    Difficulty: medium · statement

Mains practice

Answer-writing practice on this article. Attempt it first, then open the hints.

  1. GS2 · 150 words

    "Data protection in healthcare is as much about people as about technology." Discuss the challenges of implementing the DPDP Act in Indian hospitals.

    Show hints
    1. Data fiduciary duties
    2. consent beyond treatment
    3. small-provider costs, staff training
    4. ABDM
    5. emergency access.