top of page
Search

How to Process Personal Data in a Medical Emergency or Disaster Without Consent

Writer: Kaustav Chowdhury
Kaustav Chowdhury
17 hours ago
6 min read

Consent is the default route to processing under the Digital Personal Data Protection Act, 2023, and it is the route least available when something has gone badly wrong. Section 7 answers that with a list of certain legitimate uses, three of which are about emergencies. A medical emergency, a public health threat and a disaster each have their own clause, and the clauses are drafted differently from one another.

Step 1: Fix the Commencement Position

Section 7 belongs to the group that comes into force eighteen months after publication of commencement notification G.S.R. 843(E) dated November 13, 2025, which falls in May 2027. So does section 4, which is the provision that makes a legitimate use an alternative to consent in the first place.

Nothing here is operative today, and that is the reason to settle the question now. An emergency is the worst moment to work out which clause applies, so the clause has to be chosen in advance and written into the procedure that will actually be followed.

Step 2: Understand What a Legitimate Use Replaces

Section 4(1) provides that a person may process the personal data of a Data Principal only in accordance with the provisions of the Act and for a lawful purpose for which the Data Principal has given her consent, or for certain legitimate uses.

So a legitimate use stands in place of consent and of nothing else. Sub-section (2) provides that lawful purpose means any purpose which is not expressly forbidden by law, and that requirement is not displaced by the clause relied on. The processing has still to be in accordance with the provisions of the Act.

Step 3: Read Clause (f), the Medical Emergency

Clause (f) of section 7 covers processing for responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual.

Three points are on the face of it. The threat may be to life, or it may be an immediate threat to health, and the word immediate qualifies the second limb and not the first. The individual at risk need not be the Data Principal whose data is processed. And the processing must be for responding to the emergency, which ties the clause to the response rather than to the circumstances.

Step 4: Read Clause (g), the Epidemic and Public Health Measure

Clause (g) covers processing for taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health.

This clause is narrower in purpose and wider in trigger than the one before it. The purpose is confined to the provision of medical treatment or health services, so processing for some other purpose during an epidemic is outside it. The trigger is any other threat to public health, which is open ended and not tied to a notified event.

Step 5: Read Clause (h), the Disaster and Breakdown of Public Order

Clause (h) covers processing for taking measures to ensure safety of, or provide assistance or services to, any individual during a disaster, or any breakdown of public order. Its permitted purposes are the widest of the three, because they extend to assistance or services and are not confined to medical ones.

It is also the only one of the three with an Explanation attached. The Explanation gives disaster the meaning assigned to it in clause (d) of section 2 of the Disaster Management Act, 2005, so the word is not left to ordinary usage.

Step 6: Apply the Imported Definition of Disaster

Clause (d) of section 2 of the Disaster Management Act, 2005 defines disaster as a catastrophe, mishap, calamity or grave occurrence in any area, arising from natural or man made causes, or by accident or negligence, which results in substantial loss of life or human suffering, or damage to and destruction of property, or damage to or degradation of environment, and is of such a nature or magnitude as to be beyond the coping capacity of the community of the affected area.

The last element is the one that decides most cases. A serious incident that the affected community can cope with is not a disaster on this definition, however grave it is for the individuals caught in it. Note also that the breakdown of public order limb in clause (h) carries no imported definition, so it stands on its own words.

Step 7: Choose the Clause Before the Event

The three clauses are not interchangeable and the choice has consequences. The same incident may be a medical emergency for one individual under clause (f) and not a disaster under clause (h), because the coping capacity threshold is not met. A measure to provide treatment during an outbreak sits in clause (g), while the same organisation's logistics data may sit in clause (h) or nowhere at all.

Decide which clause each anticipated response relies on, and write the clause into the procedure. Clause (i), the employment limb, is a different legitimate use with its own conditions and is not a substitute for any of these three.

Step 8: Record the Basis at the Time, Not Afterwards

Because each clause turns on the circumstances as they stood, the record made during the response is the evidence of the basis. Note the clause relied on, the facts that engaged it, what personal data was processed and for what response, and the date and time.

A contemporaneous note of two lines is worth more than a reconstruction months later, and reconstruction is what is left if nothing is recorded. The note is also the only thing that shows the processing was for responding to the emergency rather than merely during it.

Common Pitfalls to Avoid

  • Numbering the clause wrongly: The medical emergency is clause (f) of section 7, and clause (e) is compliance with a judgment, decree or order.

  • Treating a legitimate use as an exemption from the Act: It stands in place of consent, and section 4 still requires processing in accordance with the provisions of the Act for a lawful purpose.

  • Forgetting that lawful purpose is defined: Section 4(2) gives it the meaning of any purpose not expressly forbidden by law.

  • Reading immediate into both limbs of clause (f): The clause covers a threat to the life, or an immediate threat to the health, of an individual.

  • Assuming the individual at risk is the Data Principal: Clause (f) extends to a threat to any other individual.

  • Using clause (g) for a non-medical purpose: It is confined to measures to provide medical treatment or health services.

  • Using the ordinary meaning of disaster: The Explanation imports the definition in clause (d) of section 2 of the Disaster Management Act, 2005, including the coping capacity threshold.

  • Deciding the clause during the incident: The clause has to be chosen in advance and recorded as the response happens.

Key Statutory Provisions

  • Section 7 of the Digital Personal Data Protection Act, 2023: Certain legitimate uses. Clause (f) covers responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual. Clause (g) covers measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health. Clause (h) covers measures to ensure safety of, or provide assistance or services to, any individual during a disaster or any breakdown of public order, with an Explanation importing the meaning of disaster from the Disaster Management Act, 2005.

  • Section 4 of the Act: Grounds for processing personal data. Processing is permitted only in accordance with the provisions of the Act and for a lawful purpose for which the Data Principal has given her consent or for certain legitimate uses, and lawful purpose means any purpose which is not expressly forbidden by law.

  • Section 2 of the Disaster Management Act, 2005: Clause (d) defines disaster as a catastrophe, mishap, calamity or grave occurrence arising from natural or man made causes, or by accident or negligence, which results in substantial loss of life or human suffering, or damage to and destruction of property, or damage to or degradation of environment, and is of such a nature or magnitude as to be beyond the coping capacity of the community of the affected area.

  • Commencement notification G.S.R. 843(E) dated November 13, 2025: Places section 4 and section 7, with the remainder of Chapter II, in the group commencing eighteen months after publication.

Related in This Series

Sources and References


Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.

Comments

bottom of page