Wearable data under the DPDP Act in India is personal data, and much of it — heart rate, sleep, glucose, location, activity — is health and behavioural information that a data principal expects to be handled with care. The DPDP Act 2023 does not create a separate 'sensitive data' tier the way older Indian rules did, but it does require specific consent for the purposes you actually use wearable data for, strong security safeguards, and prompt breach handling. Continuous, always-on collection from wearables makes purpose limitation, data minimisation and retention the hardest duties to get right. This guide checks how ready your wearable or health-tracker product is under DPDP.
Smartwatches, fitness bands and connected health devices stream continuous personal data. Here is what the DPDP Act requires of the companies that collect it.
The DPDP Act 2023 protects all digital personal data of identifiable individuals, and wearable devices generate some of the most intimate data a company can hold — resting heart rate, sleep stages, menstrual cycles, blood glucose, ECG traces and precise location over time. Unlike the earlier SPDI Rules under the IT Act, the DPDP Act does not carve out a separate legal category of 'sensitive personal data' with its own rules. Instead, every duty in the Act applies uniformly, and the practical sensitivity of health data shows up in how it is treated: consent must be genuinely specific, security safeguards must be strong, and breach handling must be prompt.
The defining challenge for wearables is that collection is continuous and passive. A person straps on a band and it streams data all day, which makes it easy to drift past the purpose the user actually agreed to. Purpose limitation, data minimisation and retention are therefore the duties most likely to be breached — often unintentionally — by wearable and connected-health products. Niti Bharat works with Indian health-tech and device companies to bring always-on collection back within the boundaries of what the data principal actually consented to.
The three highest-risk patterns are blanket consent, silent data-sharing, and indefinite retention. Treating device setup as consent for everything a wearable ever does fails the 'free, specific and informed' test in Section 6. Quietly sharing health or location data with insurers, employers or advertising partners — a common monetisation route for wearables — without clear disclosure and separate consent is exactly the kind of processing a data principal will complain about. And keeping years of continuous health data 'just in case' turns a data-minimisation duty into a standing liability, because a breach of that store carries penalties up to ₹250 crore where reasonable security safeguards have failed.
With the DPDP Rules 2025 notified in November 2025 and enforcement expected around May 2027, wearable and health-tracker companies operating in India should not wait. Niti Bharat's fixed-price DPDP engagements (₹75K–₹3.2L) include a wearable-data flow map, a granular consent redesign, and a retention-and-deletion policy built specifically for continuous device data.
A granular consent template for connected devices, a wearable data-flow map, and a retention-and-deletion policy template tailored for continuous health data.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
