India's DPDP Act

In one line

The Digital Personal Data Protection Act, 2023 (DPDP) is India's general data-protection law. It is built on consent: a data fiduciary (whoever decides why and how personal data is processed) may use a data principal's (the individual's) data only for a clear, notified purpose they agreed to.

What it requires

• Notice & consent — a clear, itemised notice (available in English and Indian languages) and free, specific, informed, revocable consent. Consent managers can broker this — the same idea ABDM uses for health records.
• Purpose limitation & minimisation — collect only what the stated purpose needs; delete when it's served.
• Principal's rights — access, correction, erasure, grievance redressal, and nomination.
• Fiduciary duties — security safeguards, breach notification to the Data Protection Board (DPB) and affected principals; extra obligations for Significant Data Fiduciaries (audits, DPIAs, a Data Protection Officer).
• Children — verifiable parental consent under 18; no tracking or targeted ads.

Health & ABDM context

Health data is sensitive in practice and central to ABDM, which is built around consent-managed health-record sharing — DPDP gives that model its legal backbone. Penalties run up to ₹250 crore per instance, so this is board-level risk, not a checkbox.

DPDP vs HIPAA — the mental model

HIPAA is sectoral (US health-specific); DPDP is general (all digital personal data, every sector). HIPAA leans on "covered entities and minimum necessary"; DPDP leans on "consent and purpose." Build for both: notified, consented, minimised, secured, erasable.

What it means for builders

Practically, a health app under DPDP needs: a clear, multilingual consent notice at collection; a purpose recorded against each use; an erasure/correction path; security safeguards and a breach-notification route to the DPB; and, for a Significant Data Fiduciary, a DPO and DPIAs. Build consent as a first-class object — the same shape ABDM's consent manager already uses — not a tick-box buried in terms of service.

Key takeaways

• DPDP is India's general data-protection law, built on consent + purpose limitation.
• Roles: data principal (individual), data fiduciary (decides processing), DPB (enforcer).
• Health data is central to ABDM, which is consent-managed by design; penalties reach ₹250 crore.
• HIPAA is sectoral, DPDP is general — build for both: notified, consented, minimised, secured, erasable.