For patients
Your Health Data, Your Rights: What India's DPDP Law Means for Patients
Hospitals, labs and health apps now need your consent, must tell you about leaks, and have 90 days to act on your requests. Here's what changes and when.
- Written by
- MyMedicare Editorial Team
- Published
- Reading time
- 1 min read
Your medical records are some of the most sensitive data you have. India's Digital Personal Data Protection (DPDP) Act, 2023 and its Rules, notified in November 2025, now give you clear legal rights over how hospitals, labs and health apps use that data.
Key dates
| Date | What happens |
|---|---|
| Nov 2025 | DPDP Rules notified; Data Protection Board set up |
| 13 Nov 2026 | Consent Manager registration begins |
| 13 May 2027 | Full obligations apply: consent notices, security, breach reporting, user rights |
Your rights
- Clear notice: organisations must tell you, in plain language, what data they collect and why.
- Consent: for most uses, they need your specific consent, and you can withdraw it.
- Access, correction and erasure: you can ask to see, fix or delete your data. Requests must be handled within 90 days.
- Breach alerts: if your data is leaked, you must be informed. The Data Protection Board must get a report within 72 hours.
- Children: verifiable parental consent is usually needed, but healthcare and treatment are exempt so care isn't delayed.
What you should do now
- 1Check which apps hold your health records and delete the ones you don't use.
- 2Prefer apps that use consent-based sharing (like ABDM).
- 3Read the privacy notice of any app before uploading reports.
- 4Never share reports over unknown WhatsApp numbers.
How MyMedicare protects you
- Records are shared only with your consent, for the period you choose
- You can revoke access anytime
Keep your records in one place and decide exactly who sees them.
Create your free account