A Regression in Protection? Health Data, Sensitive Personal Information, and the DPDP Act, 2023

Abstract

The Digital Personal Data Protection Act, 2023 marks the formal arival of a comprehensive personal data protection regime in India. Yet it does so by jettisoning a foundational architectural feature that successive earlier drafts and almost every comparable jurisdiction-had insisted upon: the separate category of "sensitive personal data" warranting heightened protection. Health data, more than any other class of information, was the principal beneficiary of that architecture. Its absence from the 2023 Act is not a drafting omission but a deliberate policy choice. This chapter argues that the choice represents a regression in protection. By placing a citizen's mental-health records, HIV status, and Ayushman Bharat health identifier on the same legal footing as her shopping cart, the DPDP Act flattens a regulatory landscape that the Information Technology (SPDI) Rules, 2011, the Srikrishna Committee Report, the 2019 Bill, and the constitutional decision in Justice K.S. Puttaswamy v. Union of India had each in their own register insisted must remain stratified. Read against the Ayushman Bharat Digital Mission, this flattening produces a peculiar paradox: the State has built a federated digital health infrastructure of unprecedented scale even as it has dismantled the very statutory This chapter situates the regression in its doctrinal, comparative, category that made such infrastructure constitutionally tolerable.