Digital Personal Data Protection Act (DPDPA) – A Wake-Up Call for IVF Clinics

With the introduction of the Digital Personal Data Protection Act, 2023 (DPDPA), questions are being raised about how India's earlier medical laws handle patient data and privacy.

- 

While certain medical laws do talk about concepts such as confidentiality of medical records, they have remained silent on several key compliance requirements from a data protection standpoint. This article explores how DPDPA compares with existing medical laws from a data protection perspective for clinical establishments carrying out the procedures related to assisted reproductive technology.

Today, In vitro fertilisation (IVF) clinics are mushrooming across Indian cities and towns. Unlike multi-specialty hospitals, these clinics often operate with small, tight-knit teams: a medical director, a gynaecologist, an embryologist, and perhaps a visiting anaesthesiologist. Rarely do they have an in-house IT officer, let alone a Chief Information Security Officer. This lean structure may be efficient for treatment delivery but it poses a serious compliance risk under India's Digital Personal Data Protection Act (DPDPA), 2023.