INTRODUCTION
IoT and DPDP compliance represent one of the most underestimated challenges in India’s data protection landscape today.
Your fitness band knows your resting heart rate. Your smart meter knows when you wake up. Your office access badge knows exactly where you were at 9:14 am. Individually, each of these data points seems harmless. Together, however, they compose a surveillance portrait of extraordinary detail — one that its subject never agreed to provide and may not even know exists.
This is precisely the privacy risk that IS Audit 3.0 (ICAI Module 6, Section 6.5.6) identifies when it notes that IoT devices collect and aggregate fragments of data that, in combination, can reveal religion, health information, lifestyle choices, and other sensitive personal attributes — even when no single data point appears sensitive in isolation.
The Internet of Things is defined in IS Audit 3.0 (Module 6, Section 6.5.1) as a system of interrelated computing devices, mechanical and digital machines, objects, animals, or people that are provided with unique identifiers and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction. In simple terms, devices collect, send, and act on data — largely without human involvement at the point of collection.
That last phrase is the compliance problem. The DPDP Act, 2023 is built on the premise of informed, specific, and free consent. IoT is built on the premise of seamless, continuous, and frictionless data collection. These two architectures sit in fundamental tension — and that tension has a deadline: 13 May 2027.
Three Case Study bring this tension to life.
Case Study 1 — Rohini’s Wearable and the Insurance Company That Knew Too Much
The Scenario
Rohini is a 41-year-old schoolteacher in Pune. She purchased a health insurance policy from a mid-sized insurer. As part of a wellness incentive programme, the insurer offered her a discount in exchange for syncing her fitness wearable to their app. Rohini agreed, expecting only her step count to be shared.
Over eighteen months, the wearable transmitted her heart rate variability, sleep patterns, stress indicators, menstrual cycle data, and location history to the insurer’s cloud platform. The insurer’s algorithm then recalculated her risk profile — and at renewal, her premium increased substantially. No one told Rohini that these data points were being collected, how they were being used, or that they would influence her premium.
The DPDP Act Position
Rohini’s situation discloses at least three distinct violations.
First — Consent specificity failure under Section 6(1). The DPDP Act requires consent to be free, specific, informed, unconditional, and unambiguous. It must be limited to personal data that is necessary for the specified purpose. Rohini consented to sharing her step count for a wellness discount. She did not consent to the sharing of menstrual cycle data, stress indicators, or sleep patterns. Any processing beyond the specified purpose is unlawful.
Rule 3 of the DPDP Rules, 2025 reinforces this directly. A Data Fiduciary must give notice in clear and plain language, with an itemised description of personal data to be collected and a specific description of the purpose. A general reference to “health data” does not satisfy this standard. Each category of IoT data being collected must be identified separately in the consent notice.
Second — Purpose limitation failure under Section 8(1). The purpose for which Rohini’s data was processed — premium recalculation — was never disclosed as a specified purpose at the time of consent. Consequently, processing her data for that purpose is unlawful under the Act, regardless of what the policy fine print may say.
Third — Sensitive personal data processing without adequate basis. Menstrual cycle data and health metrics constitute personal health information. While the DPDP Act does not yet have a separate “sensitive personal data” category in the manner of some foreign frameworks, Section 8(5) requires the Data Fiduciary to implement reasonable security safeguards. Moreover, when data is used to make a decision that affects the Data Principal, Section 8(3) requires the Data Fiduciary to ensure completeness, accuracy, and consistency of that data. An algorithmic premium revision based on wearable data must meet this standard.
The IS Audit 3.0 Perspective
IS Audit 3.0 (Module 6, Section 6.5.6) specifically identifies privacy concerns in healthcare IoT as a primary risk, observing that devices in this domain collect at least one piece of personal information and that the aggregation of IoT data fragments can reveal health information that was never explicitly disclosed. This aggregation risk is precisely what happened to Rohini.
Furthermore, IS Audit 3.0 (Section 6.5.7) identifies governance of IoT data as requiring a clear reference architecture, defined governance processes, and lifecycle management of the data managed by the IoT solution — none of which the insurer had implemented.
The Compliance Fix
Insurers and any organisation using wearable or health IoT data must:
→ Issue a separate, itemised consent notice for each data category collected by the device — not a single bundled consent covering “health data.” → Clearly specify every downstream use — including risk assessment, pricing, and underwriting decisions — as a stated purpose at the time of initial consent. → Ensure that data collected via wearable integration is not used for purposes beyond what was disclosed, unless fresh consent is obtained for the new purpose. → Implement data minimisation controls at the IoT gateway level, so that only the specific data categories covered by consent are transmitted to the cloud platform.
Rohini’s insurer collected far more than it disclosed. The DPDP Act calls that a violation — not a feature.
Rohini’s insurer had a wellness programme. It did not have a consent programme. Under the DPDP Act, that distinction matters enormously. The compliance deadline is 13 May 2027.
Disclaimer
The contents of this post are intended for general awareness and informational purposes only. They do not constitute legal opinion, professional advice, consultancy, statutory interpretation, or a recommendation to act in any particular manner.
The Digital Personal Data Protection Act, 2023, related rules, notifications, regulatory guidance and judicial interpretations may evolve from time to time. The applicability of the law may also vary depending on the facts, sector, nature of data processing, organisational role, contractual terms and compliance framework.
Readers should not rely solely on this post for making legal, business, HR, technology, data-processing or compliance decisions. Specific advice from a qualified legal, privacy, cybersecurity, governance or compliance professional should be obtained before acting on any matter discussed.
The author / publisher shall not be responsible for any loss, liability, claim, penalty or consequence arising from reliance on the contents of this post without independent professional advice.
Authors:
This article has been co-authored by CA. Sunil Elayadath and CA. Karthik Narayanan S, Partners of Karthik & Sunil, together with Mr. Dhanesh P. K., Designated Partner, DSK Sustainability Tech.