Discuss the challenges of reconciling clinical consent with data consent in Indian healthcare. Suggest measures to make compliance feasible for primary health institutions.

The Digital Personal Data Protection (DPDP) Act, 2023 came into full effect when the DPDP Rules were notified on 14 November 2025 [1]. Every hospital and Primary Health Centre (PHC) is now a Data Fiduciary, meaning a body that decides why and how personal data is used. Clinical consent (agreeing to treatment) and data consent (agreeing to how personal data is used) follow different legal rules. Fitting them together is hardest in primary care.

Challenges in reconciling the two

• Different legal standards: Data consent must be clear and informed. It must be given through a separate notice that states the specific purpose, and it can be withdrawn at any time [1]. Clinical consent covers one course of treatment and cannot be undone once care is given.
• One signature for both: Registration desks usually take one signature for both consents. The facility can break the law before the doctor even sees the patient.
• Emergencies and incapacity: Unconscious or critically ill patients cannot give either consent. Staff lack clear guidance on processing data lawfully without delaying care.
• A third consent layer: Under ABDM, facilities can see past records only with the patient's revocable, time-bound consent [2]. Over 100 crore records are already linked to ABHA accounts [2].
• Literacy and language: Rural and low-literacy patients cannot meaningfully read data notices. Consent then becomes a formality.
• High penalties, low capacity: Fines go up to ₹250 crore for weak security safeguards and ₹200 crore for not reporting a breach [1]. PHCs often lack the IT staff and access logs needed even to detect a breach.

Measures for primary health institutions

• Standard two-part form: MoHFW should issue a template in local languages that separates treatment consent from data consent.
• Privacy built into public tools: The free ABDM-enabled software [2] should include consent screens, access logs and secure storage. A PHC would then comply simply by using it.
• Train frontline staff first: Registration clerks, ANMs and lab technicians should be trained during the 18-month phased compliance window [1].
• Health-specific guidance: Rules are needed for emergencies, guardians and the use of anonymised data for planning [2].
• Fix before fining: For public PHCs, the Data Protection Board [1] should prefer time-bound orders to fix problems. Fining a PHC only moves public money from one account to another.

Reconciling the two consents is less a legal puzzle than a capacity gap at the front desk. If the state builds shared privacy infrastructure and trains frontline staff before the obligations take effect, the DPDP framework can protect the informational privacy recognised under Article 21 in Puttaswamy (2017). It would also build trust in ABDM and support progress towards SDG 3.