Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsTeleconsult platforms process consult notes, prescriptions and often payment data, under two frameworks at once.
In short
Telemedicine sits under both the Telemedicine Practice Guidelines 2020, which govern the consult, and the DPDP Act, which governs the personal data around it. You need clear consent, secure records and prescriptions, and control over the platform and its vendors. Penalties reach ₹250 crore.
What changes for this sub-sector.
The Telemedicine Practice Guidelines 2020 govern the consultation; the DPDP Act governs the data it generates.
Record consent for the teleconsultation and, separately, for processing and storing the data it produces.
Store consult notes and e-prescriptions securely, with access limited to those who need them.
Know whether the platform is a Fiduciary or a Processor for a given data flow, and contract accordingly.
Collect only what the consult needs; retain records for the required period, then delete.
Patients can access, correct and erase their teleconsult data, subject to medical-record rules.
Align consent with both frameworks, then lock down records.
The readiness check flags dual-framework consent, record-security and platform-role gaps.
Take the readiness check →Consultant-led and partner-backed.