What are the rules for patient and health data?

Health data attracts the same statutory obligations as any other personal data under the Act, with additional sector layers. NABH has issued a Guidance on the Digital Personal Data Protection Act, 2023 applying to accredited hospitals, HIS, EMR and CMS providers and third party systems handling health data, covering consent management, data lifecycle controls, retention, breach response and vendor contracts. Separately, the CDSCO's Guidance Document on Medical Device Software, issued on 21 July 2026, brings AI enabled medical software within the Medical Devices Rules, 2017 and requires disclosure of the datasets used to train, validate and test such software. Organisations in other sectors should note the pattern rather than the detail: your own regulator may well have issued something equivalent.