How not to fall foul of privacy law

Health information is sensitive information, which raises the bar to collect and use it. APP 11 governs security, and APP 8 governs cross-border disclosure: send identifiable patient data to an overseas recipient and the entity remains accountable for how that recipient handles it, unless the patient consents or the destination is whitelisted. The 2024 reforms added a statutory tort for serious invasions of privacy, in force from June 2025, and automated-decision-making transparency obligations landing by December 2026. Australia has no EU adequacy decision, and a country-whitelist mechanism is still under development.

Health data is special-category data under Article 9, so processing needs both an Article 6 lawful basis and an Article 9 condition, usually explicit consent in this context. Large-scale processing of health data triggers a Data Protection Impact Assessment under Article 35. Acting for a clinic makes us a processor, requiring Article 28 terms. Transfers outside the EEA need an adequacy decision or appropriate safeguards such as Standard Contractual Clauses. Breaches are notifiable within 72 hours, and fines reach 4 percent of global turnover.

If we act as a business associate to a clinic that is a covered entity, HIPAA applies to protected health information and a Business Associate Agreement is required, including with any subprocessor that touches that data, such as a model API. Outside HIPAA, state privacy laws fill the gap: California's CCPA and CPRA, Maryland's MODPA, and Washington's My Health My Data Act, which treats consumer health data broadly.

The framework is now live. The DPDP Rules 2025 were notified on 13 November 2025, operationalising the 2023 Act on a phased schedule running to roughly mid-2027. The model is consent-led: clear notice, defined data-principal rights, and erasure once the purpose is served. Breaches are notifiable to the Data Protection Board, with penalties up to 200 crore per incident. Significant Data Fiduciaries face extra duties, including an annual DPIA and an independent audit. Two design-relevant points: the Act does not carve out a separate sensitive data tier the way GDPR does, treating personal data more uniformly, and cross-border transfers are permitted unless the government specifically restricts a destination, which is more flexible than the EU. Processing data of anyone under 18 needs verifiable parental consent.

This is the strictest residency market of the six. The federal PDPL sets general data-protection duties, but the decisive instrument is Federal Law 2 of 2019 on the use of ICT in health fields, which mandates that health data stay confidential and, in effect, requires it to be stored and processed inside the UAE, with transfer outside subject to regulator approval. The financial free zones, DIFC and ADGM, run their own GDPR-style regimes.