DPDP Amendment to RTI Act Blocks Public Health Disclosures

What happened

On 13 November 2025, the DPDP Act amended the Right to Information Act. Section 44(3) removes the public interest test that previously allowed disclosure of personal information. The Supreme Court of India is now hearing a constitutional challenge to this strict privacy mandate in Venkatesh Nayak v. Union of India, W.P. (C) No. 177/2026, according to NASSCOM Community.

Does the DPDP Act apply here?

The Act applies to the processing of digital personal data within India. Public hospitals and government health authorities process massive volumes of digital personal data, making them Data Fiduciaries. Healthcare enterprises and HealthTech vendors partnering with public entities fall squarely under this jurisdiction.

The amendment creates a hard statutory conflict. RTI requests for health records or provider information now hit a strict privacy wall because the public interest exception no longer exists.

Legal implications under DPDP

Prior to this amendment, public authorities could disclose personal data if they decided the public interest outweighed privacy risks. Section 44(3) of the DPDP Act changes that standard entirely. The law now bans RTI disclosures of personal information.

For General Counsels in HealthTech, this alters liability allocation and contract defensibility. When your platform holds data on behalf of a public hospital, you can no longer rely on a transparency exception. Consent is the primary basis for processing, except where Section 7 legitimate uses apply. Releasing requested identifier data without consent violates the Act.

Could this happen to you

HealthTech vendors frequently build systems for government health registries or public hospitals. A transparency advocate might submit an RTI request for platform usage logs or medical practitioner details. Your public-sector client might previously have disclosed them to comply with transparency mandates.

Doing so today constitutes a data breach. The Data Protection Board of India would demand an itemised breach report within 72 hours, per the DPDP Rules, 2025. You need strict indemnity clauses. Enterprise contracts must specify that the public authority cannot disclose platform data under RTI. Defensibility requires automated mapping of what data belongs to whom.

What companies should do in the next 30 days

1. General Counsels must review all existing public sector contracts to update limitation of liability terms.

2. Compliance heads need to conduct a privileged review of data flows between healthtech platforms and public authorities.

3. Medical directors should direct grievance officers to reject third-party requests for patient or practitioner data.

4. Legal teams must establish defensible consent records and data maps to prove that no personal data leaked through unauthorized public requests.

What to watch

The Supreme Court ruling in Venkatesh Nayak v. Union of India will dictate whether the absolute privacy bar remains or if a new transparency test emerges. We expect the DPBI to initiate enforcement on unauthorized disclosures involving public health data. Exactly 248 days remain until the DPDP hard compliance deadline of 13 May 2027.

Legal teams must secure their safe harbour status now to avoid heavy outside counsel spend on reactive breach defense. Map your patient data flows in 24 hours and check your compliance exposure at freescan.complydp.com.