Medical Emergency
A legitimate use that allows processing without consent to respond to a medical emergency involving a threat to life or an immediate threat to health.
A medical emergency is a situation where someone's life or health is in immediate danger. The DPDP Act lets an organisation use personal data without consent to respond, because asking first could cost precious time.
Meaning of Medical Emergency
Section 7 also allows processing for treatment or health services during an epidemic or public health threat. The processing should be limited to what the emergency needs, and records should be kept of why it was done.
Section 7(f) allows processing of personal data to respond to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual. The words "any other individual" matter: data about one person, for example a bystander's contact, may be used to save another. The test is the urgency and nature of the threat, not the identity of the person treated.
The clause sits close to two neighbours. Section 7(g) covers measures to provide medical treatment or health services during an epidemic, outbreak of disease or other threat to public health, and Section 7(h) covers safety and assistance in a disaster or breakdown of public order. Ordinary, planned healthcare, such as a scheduled consultation or follow-up reminder, is not a medical emergency, and should rest on consent or on voluntary provision under Section 7(a).
The ground lasts as long as the emergency does. Once the patient is stable and able to decide, return to normal rules: new uses need consent, and data collected in the emergency should not feed into marketing or research. Record what was accessed, by whom and why, to show the use stayed within the clause.
The DPDP Act creates no separate category for health data, as the older SPDI Rules did for "sensitive personal data". Medical records are personal data like any other, with the same security expectations, and sector rules from the NMC and the Ministry of Health can add confidentiality duties. Section 38 makes the Act additional to those laws.
Examples of Medical Emergency
A hospital checks a patient's allergy history from a connected clinic record when the patient arrives unconscious.
A patient arrives unconscious after a road accident. The emergency team retrieves her allergy and medication history from the hospital network to avoid a dangerous drug. The access is logged, and her family is briefed once she is stable.
A caller reports a collapsed stranger on a train platform. The platform uses the caller's location and the patient's phone details to send help. It deletes the call's location trail after the case closes, apart from records needed by law.
An employee collapses at work and the campus clinic shares her known cardiac condition with the paramedics. Her employer's HR team does not receive the medical details, because HR has no role in the emergency response.
Why Medical Emergency matters
For hospitals, ambulance services, tele-health platforms and diagnostic chains, the emergency clause removes a legal worry in moments where delay is dangerous. Staff can focus on care without stopping to complete consent forms for a patient who cannot give them.
The risk lies in stretching it. If a clinic describes every walk-in as an emergency to avoid consent, or lets emergency data flow to commercial partners, the processing loses its ground, with penalties up to ₹50 crore, and security lapses over health records can reach ₹250 crore. Clear internal rules keep the clause protective for patients rather than a loophole.
How it works in practice
- 1Write an emergency-access protocol that says who may open records in an emergency, what may be viewed and how it is logged.
- 2Enable "break-glass" access in clinical systems: emergency access is possible but triggers an immediate log entry and review by a supervisor.
- 3Limit the data to what treatment requires, for example allergies, medications and blood group, and avoid copying whole records to personal devices or messaging groups.
- 4After the emergency, tell the patient or family in plain words what was accessed and why, and revert to consent for any further use.
- 5Train front-line teams to tell a true emergency from an urgent but not immediate need, and review a sample of emergency-access logs every month.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating routine appointments as emergencies. The clause requires a threat to life or an immediate threat to health.
Sharing emergency data with insurers, marketing teams or researchers afterwards. The emergency ground does not extend to those uses.
Unrestricted emergency access with no logging. Without logs, nobody can show later that the access was justified.
Assuming no consent means no notice at all. Tell the person afterwards what happened when she is able to understand it.
Compliance tips
Run emergency-access drills and review the logs, so staff know what the clause allows and what it does not.
Include emergency scenarios in data-protection training for clinical and call-centre staff.
Keep emergency records under the same strong security as other health data, with encryption and role-based access.
Define when the emergency ends and write down the point at which normal consent rules resume.
Common questions about Medical Emergency
Can a hospital use my data without consent in an emergency?
Yes, within limits. Section 7(f) of the DPDP Act allows processing to respond to a medical emergency involving a threat to life or an immediate threat to health. The use should be limited to what the emergency requires, and normal rules apply once the situation has passed.
Does the medical emergency clause cover epidemics?
Epidemics are dealt with separately in Section 7(g), which covers measures to provide medical treatment or health services during an epidemic, disease outbreak or other threat to public health. Section 7(f) is about an individual emergency, though the two serve a similar purpose.
Is health data treated as sensitive under the DPDP Act?
The DPDP Act has no separate sensitive personal data category. Health data is personal data like any other, and the same security and breach duties apply. Sector laws and professional rules, such as medical confidentiality, can still impose stricter requirements on top, and Section 38 preserves them.