Rohini’s Story: Her fitness wearable shared her menstrual cycle data with her insurer. She only agreed to share her step count.

Rohini synced her wearable to her health insurer’s app to get a wellness discount. Eighteen months later, her premium went up. The insurer’s algorithm had been analysing her heart rate variability, sleep patterns, stress markers, and menstrual cycle data — none of which she had agreed to share.

This is not a privacy inconvenience. Under the DPDP Act, 2023, it is a set of concrete violations.

Section 6(1) requires consent to be specific, informed, and limited to personal data necessary for the stated purpose. “Health data” is not a specific purpose. Each category of IoT data being collected must be itemised separately. Rule 3 of the DPDP Rules, 2025 reinforces this: the consent notice must give an itemised description of every category of personal data collected and a specific description of every purpose for which it will be used.

Rohini consented to a wellness discount based on step count. Menstrual data, stress indicators, and sleep patterns were neither itemised nor disclosed as inputs to premium recalculation. That processing had no lawful basis.

Furthermore, Section 8(3) of the DPDP Act requires that when personal data is used to make a decision affecting the Data Principal, it must be complete, accurate, and consistent. An algorithmic premium revision based on wearable data — without transparency about which data points drove the outcome or how — fails this standard.

IS Audit 3.0 (ICAI Module 6, Section 6.5.6) flags exactly this risk: IoT devices aggregate fragments of data that individually appear harmless but together reveal sensitive personal attributes. Health wearables are the most acute example of this in consumer markets.

The compliance requirement is clear:

→ Issue a separate, itemised consent notice for every data category the wearable collects.
→ Disclose every downstream use — including risk scoring and premium decisions — as a specified purpose before collection begins.
→ Minimise data at the gateway: collect only what the stated purpose requires, nothing more.

Rohini’s insurer had a wellness programme. It did not have a consent programme. Under the DPDP Act, that distinction matters enormously. The compliance deadline is 13 May 2027.

Disclaimer

The contents of this post are intended for general awareness and informational purposes only. They do not constitute legal opinion, professional advice, consultancy, statutory interpretation, or a recommendation to act in any particular manner.

The Digital Personal Data Protection Act, 2023, related rules, notifications, regulatory guidance and judicial interpretations may evolve from time to time. The applicability of the law may also vary depending on the facts, sector, nature of data processing, organisational role, contractual terms and compliance framework.

Readers should not rely solely on this post for making legal, business, HR, technology, data-processing or compliance decisions. Specific advice from a qualified legal, privacy, cybersecurity, governance or compliance professional should be obtained before acting on any matter discussed.

The author / publisher shall not be responsible for any loss, liability, claim, penalty or consequence arising from reliance on the contents of this post without independent professional advice.

---

Authors:
This article has been co-authored by CA. Sunil Elayadath and CA. Karthik Narayanan S, Partners of Karthik & Sunil, together with Mr. Dhanesh P. K., Designated Partner, DSK Sustainability Tech.