"Enacting data protection law without building institutional capacity risks turning rights into paper guarantees." Examine this in the context of India's healthcare sector and the DPDP Act, 2023.

Privacy is a fundamental right under Article 21 (K.S. Puttaswamy, 2017) [1]. The DPDP Act, 2023 was fully operationalised by the DPDP Rules notified on 14 November 2025 [2], which turn this right into duties that can be enforced. In healthcare, however, these rights are only as real as the capacity of hospitals and PHCs to honour them. The statement is therefore largely valid.

Rights the law creates

• Enforceable entitlements: clear consent notices; requests to access, correct or erase data must be answered within 90 days [2].
• Deterrence: penalties of up to ₹250 crore for failing to keep reasonable security safeguards, and up to ₹200 crore for not reporting a breach [2].
• Accessible redress: a digital-first Data Protection Board that accepts complaints online [2].
• Consent-based infrastructure: ABDM shares records only with the patient's revocable, time-bound consent [3].

Why capacity gaps risk paper guarantees

• Weakest-node risk: over 104 crore health records are linked to 93 crore ABHA accounts [3]. Every connected PHC, lab or clinic is a possible entry point for a breach.
• Consent at the front desk: consent to treatment is not consent to data processing. Untrained registration staff often take both in one signature.
• Size-blind costs: security and breach duties apply to every Data Fiduciary alike [2]. These fixed costs push small nursing homes towards closure, takeover by chains, or paper-only compliance.
• Detection gap: reporting a breach [2] requires logs and monitoring that most PHCs lack. Patients rarely learn of leaks, so enforcement that waits for complaints fails rural and low-literacy patients.
• Circular penalties: fining a state-run PHC only moves public money from one account to another. It does not fix the staff or system gap.

Way forward

• Train first: use the 18-month phased-compliance window [2] to train registration clerks, ANMs and lab technicians.
• Privacy built into public tools: add consent screens and access logs to ABDM software. Extend the Digital Health Incentive Scheme, which already reimburses digitisation costs [3], to cover compliance.
• Standard two-part consent form in local languages, issued by MoHFW.
• Corrective orders before fines for public facilities.

The DPDP framework gives patients genuine rights, but in healthcare their value is decided at the registration desk, not in the statute book. If privacy is treated as shared public infrastructure rather than each clinic's separate burden, Puttaswamy's promise can become real protection. That would also build the trust that universal health coverage (SDG 3.8) requires.