Healthcare & Health Tech
The SPDI Rules 2011 treat health data as sensitive. The DPDP Act has no separate sensitive-data category, but all its duties apply to health data.
The SPDI Rules, 2011 list health data as sensitive personal data. The DPDP Act has no sensitive category: it protects all personal data the same way. If you run a healthtech platform handling diagnosis, treatment, or health-record data, apply data minimisation and purpose limitation especially strictly. Mistakes with health data can cause serious harm.
Are there specific IRDAI or health-sector rules layered on top of general DPDP/SPDI treatment? We will expand this page once we confirm a primary source.
In plain English: health data is one of the most sensitive categories under Indian law. Collect the minimum you need. Use it only for the stated purpose. Treat any onward sharing as a fresh consent event.
G.S.R. 313(E), 11 April 2011, under s.87(2)(ob) read with s.43A, IT Act 2000. The MeitY-hosted copy returned 502 on 18 August 2026, so we cite the India Code copy.
Am I a Data Fiduciary?
Sector rules sit on top of DPDP, not instead of it. Run the self-check to confirm your baseline DPDP status first.
Run it now