Using Employee Health Data Responsibly Under the DPDP Act
Corporate wellness programs inevitably involve personal information: checkup reports, health risk assessments, teleconsultation records, counselling bookings, claims. Handled well, this data helps employees get timely care and helps HR understand aggregated needs. Handled carelessly, it can damage trust, harm individuals and expose the organization to legal risk. India's Digital Personal Data Protection Act, 2023 (the DPDP Act) makes thoughtful handling of employee health data a legal expectation, not just good manners.
This article offers a practical overview for HR and benefits teams. It is general information, not legal advice. The DPDP Rules were notified with a phased implementation timeline, so confirm current obligations and dates with your legal counsel.
The DPDP Act in brief
A few core ideas from the Act that matter most for wellness programs:
- Data Principal: the individual the data is about – here, your employee (and family members, if covered).
- Data Fiduciary: the organization that decides why and how personal data is processed. Depending on the arrangement, this could be the employer, the wellness provider, or both for different purposes.
- Data Processor: an entity that processes data on behalf of a fiduciary, such as a platform vendor.
- Lawful basis: processing generally needs the individual's consent, or must fall under a specified "legitimate use". The Act includes certain employment-related legitimate uses, but whether a particular wellness activity fits is a question for your counsel.
- Notice and consent: where consent is the basis, it should be informed, specific and given through a clear affirmative action, with a notice explaining what data is collected and why.
- Rights: individuals can seek information about processing, ask for correction and erasure, and raise grievances. They can also withdraw consent.
- Safeguards and breaches: fiduciaries must take reasonable security safeguards and notify the Data Protection Board and affected individuals of personal data breaches.
Our glossary entry on the DPDP Act gives a shorter summary.
Why employee health data needs extra care
Even though the Act uses one framework for personal data, health information is especially sensitive in a workplace:
- There is a power imbalance between employer and employee, which can make "consent" feel less than free.
- Health information could, if misused, influence decisions about roles, promotions or continued employment.
- Stigma around conditions like mental illness, HIV or infertility makes disclosure deeply personal.
The practical principle is simple: the employer should know as little as necessary about any individual's health, and as much as useful about the population.
Handling employee health data in practice: seven steps
1. Map the data flows
List every wellness service and answer: what data is collected, by whom, where it is stored, who can access it, how long it is kept, and what HR receives. A simple table works.
| Service | Data collected | Held by | What HR sees |
|---|---|---|---|
| Annual health checkup | Test results, doctor notes | Provider / lab | Aggregated risk trends only |
| Teleconsultation | Symptoms, prescriptions | Provider | Usage counts only |
| Counselling / EAP | Session notes | Counsellor | Anonymised usage only |
| Health risk assessment | Lifestyle answers, scores | Provider | Aggregated risk bands |
2. Separate individual and aggregate data
Design programs so identifiable health records stay with the clinical provider. HR should receive reports that are aggregated and anonymised, with minimum group sizes so no one can be singled out – for example, avoid breakdowns where a category contains only one or two people.
3. Write clear notices
Employees should know, in plain language and in a language they understand:
- What is collected and for what purpose
- Who will see it, and confirmation that the employer won't see individual results
- How to withdraw consent and how to raise a concern
4. Keep participation genuinely voluntary
For voluntary wellness services, avoid linking participation to appraisals, bonuses or manager visibility. Statutory medical examinations required for certain roles are a separate matter and should be handled under the applicable law.
5. Put strong vendor contracts in place
Your contracts with wellness providers and platforms should cover purpose limitation, security safeguards, breach notification timelines, sub-processors, data location and deletion at the end of the engagement. Ask counsel to review them against the DPDP Act and Rules.
6. Limit retention
Keep data only as long as needed for the stated purpose or as required by other laws (for example, certain medical and occupational health records). Define deletion schedules with providers.
7. Train the people who touch data
HR business partners, wellness champions and managers should know what not to ask, what not to forward and how to respond if an employee discloses a health condition.
Questions to ask your wellness provider
- Where is our employees' data stored, and who can access it?
- What exactly will HR receive, and how is it anonymised?
- How do employees give and withdraw consent?
- How do you handle requests for access, correction or erasure?
- What is your breach response process?
- Which sub-processors do you use?
You can read about our approach on the security and compliance page.
How MeWeSalus Care can help
MeWeSalus Care designs its services so that individual health information stays within the care relationship and HR receives aggregated, anonymised insights. If you're reviewing how your wellness program handles data, contact us and we'll walk you through our data practices, alongside the advice of your own legal team.
Frequently Asked Questions
Can an employer see an employee's health checkup results?
As a good practice, employers should only receive aggregated, anonymised reports from wellness providers. Any access to individual results should be limited to a clear, lawful purpose and handled with the employee's informed consent, after legal review.
Does the DPDP Act treat health data as a special category?
The DPDP Act applies one framework to digital personal data and does not create a separate sensitive category the way some other laws do. Health data still carries high risk, so it deserves stronger safeguards in practice.
Is this article legal advice?
No. It is general information to help HR teams ask the right questions. Rules under the Act are being implemented in phases, so confirm your obligations with qualified legal counsel.
This article is for general information only and is not medical, legal or financial advice. Please consult a qualified professional about your specific situation.