Data protection and clinical validation are prerequisites for scaling AI in public health. Analyse in the light of the DPDP Act, 2023.

Scaling AI in public health means taking tools from pilots to millions of patients. India's AI diabetic retinopathy screening, for example, covers only about 7,100 patients in 38 facilities across 11 States [2]. It can be scaled safely only if two conditions hold: health data is handled lawfully, and the tool is proven to work on Indian patients.

Data protection under the DPDP Act, 2023

• Consent and notice: personal data can be processed only with free, informed consent. The notice must be available in English or any Eighth Schedule language [3], which matters for low-literacy rural patients.
• Security safeguards: Data Fiduciaries (organisations that process the data) must take reasonable safeguards and report breaches. Failing to protect data can draw penalties of up to ₹250 crore [3].
• Legitimate uses: consent is not needed in medical emergencies [3], so privacy does not get in the way of urgent care.
• Privacy-by-design: government health-AI follows the ICMR (2023) and MeitY AI guidelines [1].

Clinical validation before scale

• Representative data: WHO asks for datasets "intentionally made representative", external validation and a clearly stated intended use [4]. A model trained on urban patients may fail without warning in tribal districts.
• Multi-site trials: ICMR is testing AI thermal imaging for breast cancer across diverse populations [5]. This is a model for any tool before scale-up.
• Licensing: AI tools that count as medical devices come under the Medical Devices Rules, 2017. States license Class A and B devices; the Centre licenses Class C and D [6].

How the two connect, and where the gaps are

• They support each other: validation needs large, diverse datasets. Consent and safeguards under the DPDP Act make it lawful to use such data.
• Soft law: the ICMR and MeitY documents are guidelines with no penalties [1].
• Broad exemptions: the DPDP Act is not specific to health. Its exemption for research and statistical processing [3] may weaken patient protection.
• Models that keep changing: AI that keeps learning after approval can drift away from the version that was licensed [4].
• Federal unevenness: health is a State List subject, so States adopt these rules unevenly.

In short, data protection builds trust and validation builds accuracy, and scaling needs both. The way forward is health-specific data standards under the DPDP framework, Indian multi-site validation and post-market monitoring by CDSCO, and adoption of the rules by States. Together these would let AI advance the right to health under Article 21 and SDG 3 while protecting privacy.