Healthcare Data Across Borders: Reconciling India’s DPDP Framework With The GDPR

Introduction

Healthcare increasingly depends on cross-border data flows. Hospitals use international cloud infrastructure, diagnostic companies transfer medical images to specialist teams, pharmaceutical companies conduct multinational trials and healthcare platforms rely on analytics providers located outside the country where patients receive treatment. These activities can improve diagnosis, research and continuity of care, but they also expose highly sensitive personal information to multiple jurisdictions.

The legal difficulty is that healthcare data is not merely another category of personal information. Medical records, genetic information, diagnostic images, prescriptions and insurance details can reveal intimate facts about an individual. A data breach may cause financial harm, discrimination, reputational injury and emotional distress. Cross-border processing adds further uncertainty because the data may become subject to foreign access powers, different retention rules and unfamiliar enforcement mechanisms.

India’s Digital Personal Data Protection Act 2023 (DPDP Act) and the European Union’s General Data Protection Regulation (GDPR) take different approaches to international transfers. The DPDP Act adopts a relatively permissive model under which personal data may generally be transferred outside India unless the Central Government restricts transfer to a specified country or territory. The GDPR follows a structured transfer regime based on adequacy decisions, appropriate safeguards or limited derogations under Chapter V.

For healthcare organisations operating across both systems, the practical task is not simply to obtain consent. They must establish a lawful purpose, minimise the data transferred, allocate controller and processor responsibilities, assess security and access risks and ensure that the transfer mechanism satisfies the stricter applicable standard.

What Makes Healthcare Data Different

Healthcare data may be personal data under both frameworks, but the GDPR treats health data as a special category of personal data under Article 9. Processing is generally prohibited unless an applicable exception exists, such as explicit consent, healthcare provision under appropriate professional safeguards, public-health purposes or scientific research subject to legal conditions.

The DPDP Act does not create an identical category of “special category personal data” in the enacted statute. Its obligations apply to digital personal data generally, although the Central Government may prescribe additional requirements for specified classes of Data Fiduciaries or purposes. This does not make health information low-risk. Healthcare organisations remain subject to the Act’s obligations concerning lawful processing, notice, security safeguards, breach response, erasure and accountability.

The difference is significant. Under the GDPR, a healthcare organisation must identify both a general lawful basis under Article 6 and an additional condition under Article 9. Under the DPDP Act, the Data Fiduciary must process personal data for a lawful purpose, generally based on consent or certain legitimate uses recognised by the Act. The Indian framework may therefore be simpler in form, but a responsible healthcare organisation should still apply heightened safeguards because the consequences of misuse are severe.

Indian Data Privacy Framework

The DPDP Act places primary responsibility on the Data Fiduciary, which determines the purpose and means of processing. A hospital, diagnostic company, insurer or healthcare platform may be a Data Fiduciary even when an overseas cloud provider performs the technical processing.

The Data Fiduciary must provide notice describing the personal data and the purpose for which it will be processed. Consent must be free, specific, informed and unambiguous, and the Data Principal must be able to withdraw it. In healthcare, consent language should explain whether data will be stored abroad, shared with affiliated entities, used for research, processed by artificial-intelligence systems or retained after treatment ends.

Section 16 permits the Central Government to restrict the transfer of personal data outside India to a notified country or territory. The provision does not impose a general localisation requirement. It creates the possibility of a negative-list or restricted-destination model, under which transfers remain permitted unless the Government imposes restrictions or specifies additional conditions.

The 2025 DPDP Rules provide that personal data may be transferred outside India subject to requirements specified by the Central Government concerning making the data available to a foreign state or entities under its control. Healthcare organisations must therefore monitor future notifications and sector-specific requirements rather than treating the Act as a permanent authorisation for unrestricted export.

The Data Fiduciary must also implement reasonable security safeguards and notify personal-data breaches in accordance with the statutory framework. For healthcare data, security should address encryption, identity and access management, privileged-user controls, audit logs, pseudonymisation, backup protection and secure deletion. A transfer agreement that addresses only confidentiality but not operational security is insufficient.

GDPR Requirements for Transfers

The GDPR applies where an organisation processes personal data in the context of an establishment in the European Union or offers goods or services to individuals in the Union, or monitors their behaviour there. A healthcare company outside the EU may therefore be subject to the GDPR where it provides services to EU patients or processes their data in a relevant context.

Chapter V of the GDPR governs transfers to third countries. The first route is an adequacy decision under Article 45, through which the European Commission determines that the recipient country provides an adequate level of protection. In the absence of adequacy, the organisation may rely on appropriate safeguards under Article 46, including the European Commission’s Standard Contractual Clauses (SCCs), approved binding corporate rules, codes of conduct or certification mechanisms.

The SCCs are not simply boilerplate. The parties must identify the transfer module, describe the categories of data and processing, allocate controller or processor roles and address the rights of data subjects. The parties must also consider whether the law and practice of the importing country may undermine the contractual safeguards.

Following Schrems II, organisations using SCCs must conduct a transfer-impact assessment. They should examine the likelihood of public-authority access, the nature of the data, the purposes of processing, available legal remedies and supplementary technical and organisational safeguards. Encryption with keys retained by the exporter, pseudonymisation and strict access controls may be necessary where the risk cannot be addressed through contractual language alone.

Article 49 provides limited derogations, including explicit consent and transfers necessary for important reasons of public interest or performance of a contract. These derogations are interpreted narrowly and are not intended to provide a routine basis for structural, repetitive healthcare transfers.

Reconciling the Two Regimes

A healthcare organisation processing Indian and EU data should adopt a cumulative approach. It should comply with the DPDP Act for Indian personal data and the GDPR for EU personal data, applying the stricter safeguard where the rules overlap.

The first step is data mapping. The organisation should identify the data collected, its source, purpose, location, recipient, retention period and movement across systems. Patient data may travel from a hospital to a cloud provider, laboratory, research institution, insurer and analytics company. Each transfer should have a documented purpose and legal basis.

The second step is role allocation. The hospital may determine the purpose of diagnosis and act as controller or Data Fiduciary. A cloud provider may act as processor or Data Processor. A research institution may become an independent controller or separate Data Fiduciary if it determines its own research purposes. Contracts should reflect actual decision-making rather than simply label every recipient a processor.

The third step is lawful purpose and consent. Consent for treatment should not automatically be treated as consent to unrelated commercial analytics or AI training. If research is intended, the organisation should consider whether a separate legal basis, ethics approval, anonymisation or an appropriate statutory research framework is required.

The fourth step is transfer security. For EU data, SCCs may be necessary where India is not covered by an adequacy decision. For Indian data, a contractual transfer mechanism may not be expressly required by the DPDP Act, but contractual controls remain essential for confidentiality, breach allocation, sub-processing and audit rights.

Data Localisation and Government Access

Cross-border healthcare processing creates two distinct concerns. The first is where the data is stored. The second is who can access it. A data centre located in India may still be operated by a foreign company subject to foreign disclosure obligations. Conversely, data stored abroad may be protected by strong technical controls and inaccessible to public authorities except through lawful procedures.

The GDPR’s transfer-impact assessment focuses on the practical risk of foreign government access and the availability of enforceable rights. The DPDP Act’s transfer provisions focus more directly on the Government’s power to restrict destinations or impose conditions. Healthcare organisations should therefore assess both location and legal access.

Contractual commitments should address government requests, notice where legally permitted, challenges to disproportionate requests, transparency reports, data segregation and deletion. Encryption should be designed so that the service provider cannot access unencrypted health data unless operationally necessary.

Research and Artificial Intelligence

Cross-border healthcare research often requires large datasets for clinical trials, epidemiology and machine-learning development. The legal risk increases when data is reused for a purpose beyond the original clinical relationship.

Under the GDPR, scientific research may benefit from specific legal provisions, but it still requires an appropriate lawful basis, Article 9 condition, safeguards and data-minimisation measures. Under India’s framework, research organisations must similarly assess the purpose, notice, consent or permitted use, security and retention obligations.

Anonymisation can reduce regulatory exposure, but pseudonymisation does not remove personal-data status where re-identification remains possible. AI developers should document the source of training data, exclude unnecessary identifiers, restrict access, evaluate re-identification risk and establish governance for model outputs.

Contractual Architecture

A cross-border healthcare data agreement should identify the data categories, purpose, processing operations, locations, recipients, sub-processors, retention period, security measures and deletion obligations. It should also establish procedures for patient requests, breach notification, audits, government-access requests and termination.

The contract should not rely on a general statement that the provider will comply with “applicable law.” It should specify which party responds to access, correction, erasure and grievance requests, and how quickly the parties must cooperate. Where GDPR SCCs apply, the SCCs should be incorporated without conflicting terms.

Organisations should also maintain a transfer register and periodically reassess the arrangement. Cloud architecture, sub-processors, foreign laws and regulatory guidance may change during the life of the contract.

Practical Compliance Implications

The DPDP Act’s permissive transfer model may make India operationally attractive for international healthcare processing. However, this advantage should not be mistaken for regulatory simplicity. Government restrictions may change, the Rules may evolve and sectoral laws may impose additional requirements.

The GDPR remains more demanding because it requires a recognised transfer mechanism and enforceable safeguards. A company that uses SCCs without assessing foreign access risk may fail to address the central purpose of Chapter V. Healthcare data intensifies that risk because the information is sensitive, often irreplaceable and difficult to anonymise without losing research value.

The most defensible strategy is to classify data by sensitivity, separate Indian and EU datasets where appropriate, use privacy-preserving techniques, minimise transfers and apply GDPR-level safeguards to all healthcare data processed across borders. This may increase compliance costs, but it reduces the risk of fragmented systems and inconsistent protection.

Conclusion

Cross-border healthcare-data transfers under India’s DPDP Act and the GDPR are legally possible, but they require more than a general consent clause or a cloud-services agreement. India permits transfers outside the country unless restricted by the Central Government, while the GDPR requires adequacy, appropriate safeguards or a narrowly available derogation.

The principal challenge is reconciling these different models with the high sensitivity of healthcare information. Organisations must map data flows, identify roles, establish lawful purposes, obtain meaningful consent where required, use appropriate transfer mechanisms, assess foreign-access risks and implement strong technical safeguards.

For EU data transferred to India, Standard Contractual Clauses and a transfer-impact assessment will usually be central unless an alternative GDPR mechanism applies. For Indian data, contractual and organisational safeguards remain essential even where no general localisation rule prohibits the transfer. The most sustainable approach is a risk-based, privacy-preserving architecture that treats healthcare data as a continuing responsibility rather than a commodity that may be moved freely once consent has been obtained.

References

1. Digital Personal Data Protection Act, 2023, Section 16.
2. Regulation (EU) 2016/679, Article(s) 44-49.
3. Regulation (EU) 2016/679, Article 9.
4. Digital Personal Data Protection Act, 2023, Section(s) 4-7.
5. Digital Personal Data Protection Act, 2023, Section 16.
6. Digital Personal Data Protection Rules, 2025, Rule 15.
7. Digital Personal Data Protection Act, 2023, Section(s) 8 and 9.
8. Regulation (EU) 2016/679, Article 3(2).
9. Regulation (EU) 2016/679, Article 45.
10. Regulation (EU) 2016/679, Article 46.
11. Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems (Case C-311/18) EU:C:2020:559.
12. Regulation (EU) 2016/679, Article 49.
13. European Commission, ‘Standard Contractual Clauses’ (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en)

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.