Patient Data and Robots

When robot data counts as personal data

The Digital Personal Data Protection Act, 2023 defines personal data as any data about an individual who is identifiable by or in relation to such data. A therapy robot's session log linked to a patient record, a telepresence call showing a face on a ward and a companion device's voice recordings can all meet that test. The Act does not create a separate category of sensitive health data, so its general duties apply, but the sensitivity of clinical information should still shape your controls. A hospital that decides why and how such data is processed fits the Act's definition of a Data Fiduciary, even when the robot maker hosts the software. Map every data flow from each robot before go-live, including backups and analytics.

Consent, notice and legitimate uses

Section 6 of the Act requires consent to be given freely for a specified purpose and signalled by a clear affirmative action, and section 5 requires a notice describing the data, the purpose and how to exercise rights or complain. Section 7 also lists legitimate uses that do not rest on consent, including responding to a medical emergency that threatens a person's life or health. Do not stretch that ground to cover routine recording. For a telepresence round or a remote family visit, decide in advance who gives consent when a patient cannot, how other people on the ward are told, and whether any recording is needed at all. Often the simplest control is to record nothing.

Security, breaches and patient requests

Section 8 requires a Data Fiduciary to take reasonable security safeguards against a personal data breach and, if one happens, to inform the Data Protection Board and each affected person; the Schedule sets penalties of up to ₹200 crore for failing to give that notice. The government's explainer on the Digital Personal Data Protection Rules, 2025, notified on 14 November 2025, says affected individuals must be told without delay and that requests must be answered within ninety days. It also describes an eighteen-month period for phased compliance, so check which duties apply on the date you sign. Sections 11 and 12 give patients rights to a summary of their data and to its correction and erasure. Write these duties into the maker's contract.

Connecting robots to the hospital network

Data protection law sets the duty, and engineering practice decides whether you meet it. IEC 80001-1:2021 describes how organisations apply risk management when they connect medical devices or health software to IT networks, covering safety, effectiveness and security through deployment and use. Use it to structure a joint review between IT, clinical engineering and information governance before any robot joins the network. Ask the maker where video and logs are stored, whether data leaves India, how access is logged and how quickly security patches are released. Section 16 of the Act lets the central government restrict transfers of personal data to particular countries, so ask how the maker would respond if its hosting region were affected.

Sources and further reading

• The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) — Ministry of Electronics and Information Technology (MeitY).
  Full text of India's data protection law: personal data, consent, security safeguards, breach notice and rights.
• DPDP Rules, 2025 Notified: A Citizen-Centric Framework for Privacy Protection and Responsible Data Use — Press Information Bureau, Government of India.
  Government explainer on the DPDP Rules 2025: phased compliance, breach notices, 90-day replies and the Data Protection Board.
• IEC 80001-1:2021 Application of risk management for IT-networks incorporating medical devices, Part 1 — ISO / IEC.
  Standard for managing safety, effectiveness and security risks when connecting medical devices to IT networks.

Common questions

Does the DPDP Act apply to foreign robot makers?

It can. Section 3 extends the Act to processing outside India when that processing is connected with offering goods or services to people in India. A maker hosting data abroad for an Indian hospital should expect contract questions about compliance and should name every sub-processor it uses.

Can patient data collected by robots be used for research?

Section 17 exempts processing needed for research, archiving or statistical purposes when the data is not used to take decisions about a specific person. Ethics committee review and your hospital's own policies still apply, so plan any research use before collection starts.