Paternity, Privacy, and Penalties: The DPDP Trap for IVF Hospitals

Executive Summary

The compliance time bomb inside India’s fertility boom

India’s Assisted Reproductive Technology sector is projected to cross $3.5 billion by 2030. But alongside the boom in baby-making comes a boom in data. IVF clinics are no longer merely medical facilities — they are highly sensitive biological databases.

The enactment of the Digital Personal Data Protection (DPDP) Act, 2023, has thrown a wrench into the workings of fertility centres. The industry is caught in a legal paradox: the ART Act, 2021 mandates strict donor anonymity, while the DPDP Act grants individuals the right to access their personal data — including their genetic lineage.

Add the complexities of paternity disputes, the sensitivity of reproductive-health data, and penalties up to ₹250 Crore [≈ US$30M], and the conclusion is unavoidable.

IVF hospitals are sitting on a compliance time bomb.The DPDP Trap · KSK Privacy & Data Protection

This report dissects the “DPDP Trap,” maps the overlapping legislation, and provides a strategic blueprint for fertility centres to survive the new privacy regime.

To understand the scale of the DPDP challenge, you must first understand the scale of data generation in modern fertility treatment. An average IVF cycle generates over 5 GB of data — from hormonal profiles and ultrasound imaging to embryonic time-lapse photography and genetic-sequencing reports.

Unlike a standard surgical procedure, IVF data is multi-generational. It involves the genetic data of the patient, the partner, and potentially a third-party donor — three Data Principals in a single file.

• i

  The PCPNDT Act, 1994

  Regulates pre-natal diagnostic techniques. A leak of guarded ultrasound or genetic data is not just a privacy issue — it is a criminal offence.

• ii

  The IT Act, 2000 (s.43A)

  Though the DPDP Act supersedes the SPDI Rules, the IT Act’s compensation provisions remain a grey area during the transition.

• iii

  National ART & Surrogacy Registry (NARSH)

  Mandatory uploads turn clinics into data suppliers to the State — raising the question of who is liable when the government database is breached.

The DPDP Act effectively kills the “blanket consent” forms used in 95% of Indian hospitals — the ten-page document signed at admission. Under the Act, consent must be specific, granular and freely given.

A clinic cannot bundle consent for “performing IVF” with “storing genetic data on local servers” or “sharing data with the National ART Registry.” Patients must be able to say yes to the procedure but no to specific processing — without it affecting their care.

1. Cryptographic separation of data Technical

   Technically segregate “medical data” from “genetic / lineage data,” so a court order for medical records cannot accidentally expose a donor’s identity.

2. Layered digital consent Policy

   Adopt dynamic consent management — patients sign off at bloodwork, at embryo transfer, and before any registry upload.

3. A Data-Fiduciary firewall for NARSH Contractual

   When uploading to the national registry, act strictly as a collector and transfer liability to the State by contract and by technical design.

4. Drafting for the “unborn Data Principal” Governance

   State explicitly how data on frozen embryos or gametes is handled if prospective parents die, divorce, or abandon the cycle.

Conclusion

Privacy is a clinical imperative, not an IT issue

The ART Act was a necessary step toward regulating a booming sector. But the subsequent DPDP Act created a legislative blind spot: the IVF industry must now balance the biological rights of parents and donors against the digital rights of children.

“Paternity, Privacy, and Penalties” is not a catchy phrase — it is the reality of modern reproductive healthcare. Hospitals that treat data privacy as an IT-department issue will find themselves trapped. Those that recognise it as a core clinical and ethical imperative will build the trust necessary to lead India’s fertility future.