
India's new Digital Personal Data Protection Rules, 2025, implementing parts of the DPDP Act, 2023, significantly impact the healthcare sector by classifying all healthcare providers as "data fiduciaries" and patients as "data principals." While empowering patients with rights to access and correct medical data, the law introduces complexities. It mandates transparency but allows data processing without consent during emergencies, though ambiguities remain regarding chronic illnesses and post-operative care, necessitating potential redesign of consent architectures.