Sujeet Katiyar

Healthcare data is not just another category of personal information. It is the most sensitive, most permanent and most ethically challenging form of data any organisation can ever handle. Under India’s DPDP Act, this places hospitals, diagnostics, insurers, TPAs, healthtech platforms and researchers in the highest risk bracket. Clinical records create lifelong consequences when breached. Biomedical research depends on continuous data flows that must now comply with stricter rules. Hospitals and insurers operate in massive, interconnected digital ecosystems where a single weak link can expose entire patient histories. Public health programmes need data at population scale, yet DPDP demands that individual rights remain protected. The healthcare sector faced some of the harshest penalties under GDPR in Europe even with a longer preparation window. India’s timeline is shorter. The risk is higher. And the stakes are far more human. If there is one sector that cannot afford to delay DPDP readiness, it is healthcare.