1. Introduction

Cross-border health data transfer refers to the transmission, disclosure, storage, processing, or exchange of personal health information from one country to another. It includes the international movement of medical records, diagnostic reports, genetic information, biometric identifiers, clinical-trial data, prescription histories, hospital records, health-insurance information, and information generated through wearable devices and digital healthcare platforms.

The practice has become increasingly important because healthcare systems now rely on international cloud infrastructure, multinational pharmaceutical companies, cross-border clinical trials, telemedicine, genomic research, artificial intelligence, and international health surveillance.

However, health information is among the most sensitive categories of personal data. Its unauthorized disclosure can lead to discrimination, identity theft, insurance exclusion, employment disadvantages, reputational harm, and violations of privacy and human dignity.

Consequently, cross-border health data transfers raise important legal questions:

Whether health information can lawfully be transferred outside the country of collection.

Whether explicit patient consent is necessary.

Whether the receiving country provides adequate data protection.

Whether foreign governments can access transferred medical information.

Who is liable for unauthorized disclosure or misuse?

Whether patients can obtain compensation through domestic or foreign courts.

How international research and public-health requirements should be balanced against individual privacy.

The central legal challenge is to balance international healthcare cooperation with the protection of patient autonomy, confidentiality, privacy, and informational self-determination.

2. Meaning and Scope of Cross-Border Health Data Transfer

Cross-border health data transfer involves the movement of identifiable or potentially identifiable health-related information across national boundaries.

Examples include:

An Indian hospital transferring patient records to a cloud server located in Singapore.

An Australian biotechnology company sending genomic samples and associated patient information to a research institution in the United States.

A pharmaceutical company transferring clinical-trial information from India to its European headquarters.

A telemedicine platform allowing doctors in another country to access medical histories.

An international hospital network exchanging diagnostic information.

A genetic-testing company transferring DNA profiles to overseas laboratories.

An international health-insurance company processing medical claims through foreign service providers.

Categories of health data

A critical distinction exists between genuinely anonymous information and pseudonymised information. Pseudonymised records may still be personal data if individuals can be reidentified using additional information.

3. International Legal Framework

A. European Union: GDPR

The General Data Protection Regulation (GDPR) is one of the most influential legal frameworks governing international transfers of health information.

Health information is classified as a special category of personal data under Article 9.

Article 9 generally prohibits processing health data unless an applicable exception exists, such as explicit consent, healthcare provision under appropriate safeguards, public-health interests, or scientific research under the relevant legal conditions.

Important provisions include:

Article 5: Principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.

Article 6: Lawful bases for processing personal data.

Article 9: Special protection for health and other sensitive information.

Article 25: Data protection by design and by default.

Article 32: Security of processing.

Article 35: Data Protection Impact Assessment.

Article 44: General principle governing international transfers.

Article 45: Transfers based on adequacy decisions.

Article 46: Appropriate safeguards, including standard contractual clauses.

Article 49: Specific derogations for certain transfers.

The GDPR does not prohibit every international health-data transfer. Rather, it establishes conditions under which such transfers may occur.

B. United States: HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) establishes federal privacy and security requirements for protected health information.

Its principal rules include:

Privacy Rule.

Security Rule.

Breach Notification Rule.

Minimum necessary standard.

Business Associate requirements.

HIPAA does not establish a general prohibition against transferring protected health information internationally. However, covered entities and business associates remain responsible for satisfying applicable privacy, security, contractual, and other legal obligations.

A foreign cloud provider or outsourced processor may therefore create compliance responsibilities for the covered entity.

C. Council of Europe: Convention 108+

The Convention 108+ provides an international framework for protecting individuals against abuses involving personal-data processing.

Its principles include:

Lawful and fair processing.

Purpose limitation.

Data security.

Special protection for sensitive information.

Independent supervision.

Restrictions on international data transfers where equivalent protection is absent.

D. International Health Regulations, 2005

The International Health Regulations (2005) provide a framework for international cooperation against public-health risks.

They are particularly relevant to disease surveillance, outbreak reporting, and the exchange of public-health information.

However, they should not be treated as a general authorization for unrestricted international disclosure of identifiable patient records.

4. Indian Legal Framework Governing Cross-Border Health Data Transfers

India's legal framework is particularly important because international healthcare outsourcing, biotechnology research, digital hospitals, genetic testing, and telemedicine frequently involve the transfer of Indian residents' health information to foreign entities.

A. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes India's general framework for processing digital personal data.

Its important provisions include:

Section 2 – Personal Data

Personal data means data about an individual who is identifiable by or in relation to such data. Identifiable medical, diagnostic, genetic, and reproductive records can therefore fall within its scope.

Section 4 – Grounds for processing

Personal data may be processed for a lawful purpose on the basis of consent or certain legitimate uses recognised by the Act.

Section 5 – Notice

The Data Fiduciary must provide the prescribed notice explaining the personal data and purposes of processing.

Section 6 – Consent

Consent must meet statutory requirements, including being free, specific, informed, unconditional, and unambiguous, with a clear affirmative action.

Section 8 – General obligations of Data Fiduciary

The Data Fiduciary remains responsible for compliance with the Act in relation to processing undertaken by it or on its behalf.

Section 16 – Processing of personal data outside India

This is the central provision for cross-border data transfers.

Section 16 authorises the Central Government to restrict transfers of personal data by a Data Fiduciary to notified countries or territories. It also preserves the operation of other Indian laws that provide a higher degree of protection or impose additional restrictions.

Thus, India generally follows a restriction-based approach rather than requiring an EU-style adequacy decision for every foreign destination.

India Code+2

B. Digital Personal Data Protection Rules, 2025

The DPDP Rules, 2025 operationalise important aspects of the Act.

Rule 15 concerns transfers of personal data outside India. It subjects such transfers to requirements that the Central Government may specify regarding making personal data available to a foreign State or persons and entities controlled by or acting as agencies of such a State.

Rule 16 addresses specified processing for research, archiving, and statistical purposes, subject to the prescribed safeguards.

An important qualification is that the DPDP Act does not establish a separate comprehensive category of sensitive personal data for health information comparable to GDPR Article 9.

The applicability of particular provisions must also be assessed against the Act's commencement notifications and phased implementation arrangements.

Live Law+2

C. Information Technology Act, 2000

Section 43A historically provided compensation for failure by a body corporate to maintain reasonable security practices while handling sensitive personal data or information.

Section 72A criminalises certain disclosures of personal information in breach of a lawful contract, where the statutory elements are satisfied.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) specifically identified medical records, medical history, and biometric information as sensitive personal data or information.

Rule 7 of the SPDI Rules addresses international transfers. It permits transfer where the receiving entity ensures the same level of data protection as provided under the Rules and the transfer is necessary for lawful contractual performance or where the provider has consented.

Important transitional issue: The interaction between the SPDI Rules, Section 43A, and the DPDP Act must be considered in light of the DPDP Act's repeal and savings provisions and applicable commencement notifications. They should not automatically be treated as simultaneously applicable without examining the relevant legal dates.

D. Constitutional protection of health information

The Indian Constitution does not expressly enumerate a standalone right to informational privacy. However, the Supreme Court has recognised privacy as a fundamental right under Article 21 and the broader constitutional framework.

Health information is protected through principles of:

Personal autonomy.

Bodily integrity.

Medical confidentiality.

Human dignity.

Informational privacy.

Protection against arbitrary disclosure.

The constitutional framework is especially relevant when government hospitals, public-health authorities, and state-controlled healthcare institutions disclose medical records internationally.

5. Important Judicial Decisions and Case Laws

The following judgments establish the legal foundations of confidentiality, privacy, international data transfers, and patient protection.

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Landmark Indian Supreme Court judgment

Citation: (2017) 10 SCC 1.

Court: Supreme Court of India.

Facts:

The constitutional validity of the Aadhaar identification framework led to a larger examination of whether privacy was protected as a fundamental right under the Indian Constitution.

Legal issue:

Whether privacy is a constitutionally protected fundamental right.

Judgment:

The Supreme Court unanimously recognised privacy as a fundamental right, primarily protected under Article 21 and other freedoms guaranteed by Part III of the Constitution.

The Court recognised different dimensions of privacy, including informational privacy, bodily privacy, and decisional autonomy.

Relevance to cross-border health data:

The judgment provides the constitutional foundation for protecting medical records, genetic information, reproductive information, and digital health histories.

For example, if an Indian hospital transfers identifiable patient records to a foreign research company without a lawful basis or adequate safeguards, the transfer may raise constitutional privacy concerns, particularly where state action is involved.

Legal principles:

Informational privacy is constitutionally protected.

Personal information cannot be subjected to arbitrary interference.

Privacy restrictions must satisfy constitutional standards of legality, legitimate purpose, and proportionality.

Individuals retain autonomy over important aspects of their personal information.

2. Mr. X v. Hospital Z (1998)

Citation: (1998) 8 SCC 296.

Court: Supreme Court of India.

Facts:

A hospital disclosed information concerning a patient's HIV-positive status in connection with a proposed marriage.

The patient challenged the disclosure, raising questions concerning medical confidentiality and privacy.

Legal issue:

Whether the duty of medical confidentiality is absolute or whether disclosure may be justified to protect another person's interests.

Judgment:

The Supreme Court recognised the importance of medical confidentiality but held that it is not absolute. Disclosure may be justified in circumstances involving a sufficiently important public or third-party interest.

Relevance:

This decision is important for international transfers of HIV records, infectious-disease information, genetic risks, and other sensitive medical information.

A hospital cannot assume that every disclosure is justified merely because it serves an administrative or commercial purpose. Equally, confidentiality does not necessarily prevent disclosure where a legally recognised justification exists.

Legal principle: Medical confidentiality is fundamental but may be subject to justified exceptions.

3. Sharda v. Dharmpal (2003)

Citation: (2003) 4 SCC 493.

Court: Supreme Court of India.

Facts:

The dispute concerned the court's authority to direct a medical examination in matrimonial proceedings.

Legal issue:

Whether an individual's right to privacy prevents a court from directing a medical examination in appropriate circumstances.

Judgment:

The Supreme Court recognised that privacy is not absolute and that a court may direct a medical examination where legally justified and necessary for adjudication.

Relevance:

In cross-border healthcare litigation, medical information may sometimes be required for judicial proceedings, international evidence gathering, or the resolution of medical disputes.

However, this judgment should not be interpreted as authorising unrestricted disclosure of medical records to foreign courts or private parties.

4. District Registrar and Collector v. Canara Bank (2005)

Citation: (2005) 1 SCC 496.

Court: Supreme Court of India.

Facts:

The case concerned the legality of government access to private financial documents and the privacy interests associated with confidential records.

Legal issue:

Whether governmental authorities can access private records without sufficient legal safeguards.

Judgment:

The Supreme Court emphasised the constitutional significance of privacy and the need to protect confidential records from arbitrary governmental interference.

Relevance:

Although not a medical-data case, its principles are relevant when foreign governmental agencies seek access to medical databases maintained by Indian hospitals or multinational healthcare providers.

It supports the argument that confidential records should not be disclosed merely because a government authority requests access.

5. Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems (Schrems II) (2020)

Leading international transfer judgment

Citation: Case C-311/18, EU:C:2020:559.

Court: Court of Justice of the European Union (CJEU).

Facts:

Maximillian Schrems challenged the transfer of personal data from the European Union to the United States, raising concerns about access by American intelligence authorities.

Legal issue:

Whether standard contractual clauses and the EU–US Privacy Shield adequately protected personal data transferred outside the EU.

Judgment:

The CJEU invalidated the EU–US Privacy Shield adequacy decision but upheld the validity of standard contractual clauses, subject to effective protection and additional safeguards where necessary.

Relevance to health data:

This judgment is particularly significant for:

International clinical-trial databases.

Foreign cloud storage of patient records.

Multinational pharmaceutical companies.

Genetic research platforms.

Overseas medical-data analytics.

International hospital information systems.

A contract alone may not provide adequate protection where the receiving country's surveillance laws undermine the practical effectiveness of the safeguards.

Organisations must assess the destination country's legal environment and, where necessary, implement supplementary technical, contractual, and organisational measures.

PubMed+1

6. Lindqvist v. Åklagarkammaren i Jönköping (2003)

Citation: Case C-101/01, EU:C:2003:596.

Court: CJEU.

Facts:

An individual published personal information concerning other persons on an internet website.

Legal issue:

Whether making personal information accessible on the internet automatically constituted a transfer of personal data to a third country under the former EU Data Protection Directive.

Judgment:

The Court held that publishing information on an internet page hosted within a Member State did not, by itself, constitute a transfer to a third country under the relevant transfer provision merely because the information could be accessed internationally.

Relevance:

The decision helps distinguish between international accessibility and an actual transfer of data to a foreign recipient or processing environment.

In modern healthcare systems, this distinction can be important when evaluating whether a foreign cloud service, overseas database, or foreign medical professional receives or processes identifiable patient data.

EUR-Lex+1

7. Österreichische Post AG v. RW (2023)

Citation: Case C-300/21, EU:C:2023:370.

Court: CJEU.

Legal issue:

The case concerned compensation for non-material damage resulting from infringement of GDPR rights.

Judgment:

The Court held that infringement of the GDPR alone does not automatically establish entitlement to compensation. The claimant must establish damage and a causal link between the infringement and the damage. However, EU law does not impose a minimum seriousness threshold for non-material damage.

Relevance:

If health information is unlawfully transferred abroad and causes anxiety, loss of control over personal information, or other non-material harm, the judgment is relevant to compensation claims under the GDPR.

It is also important for determining the evidentiary requirements in international health-data litigation.

6. European Court of Human Rights: Medical Privacy Cases

8. Z v. Finland (1997)

Citation: Application No. 22009/93, judgment of 25 February 1997.

Court: European Court of Human Rights.

Facts:

The case concerned disclosure of confidential medical information relating to an HIV-positive individual during criminal proceedings involving her husband.

Legal issue:

Whether disclosure of confidential HIV-related medical records violated Article 8 of the European Convention on Human Rights.

Judgment:

The Court recognised that confidentiality of health information is a fundamental principle of the legal systems of the Convention states. Disclosure of such information requires particularly strong justification.

Relevance:

This case is directly relevant to international transmission of HIV records, infectious-disease databases, and confidential medical histories.

It establishes that health information deserves heightened protection because unauthorised disclosure may seriously affect personal dignity, privacy, and social relationships.

9. I v. Finland (2008)

Citation: Application No. 20511/03, judgment of 17 July 2008.

Court: European Court of Human Rights.

Facts:

A hospital employee living with HIV alleged that unauthorised colleagues could access her medical records.

Legal issue:

Whether the hospital had implemented sufficient safeguards to protect confidential medical information.

Judgment:

The Court found a violation of Article 8 because the hospital's record-management and access-control arrangements did not provide adequate protection.

Relevance:

This judgment is important for cross-border electronic health records.

A healthcare institution transferring medical records to foreign cloud providers must ensure that access is restricted, monitored, and appropriately secured.

The decision supports the principle that merely adopting a privacy policy is insufficient; effective technical and organisational safeguards are necessary.

10. L.H. v. Latvia (2014)

Citation: Application No. 52019/07, judgment of 29 April 2014.

Court: European Court of Human Rights.

Facts:

The applicant challenged the collection of extensive medical information by a state authority during an investigation concerning medical treatment.

Legal issue:

Whether the collection and processing of medical records complied with Article 8 of the European Convention on Human Rights.

Judgment:

The Court found that the collection of personal medical information had not been accompanied by sufficient legal safeguards.

Relevance:

This decision is relevant to international health-data exchanges involving public authorities, regulators, and medical investigations.

It demonstrates that the collection and transmission of health data must have a clear legal basis and appropriate limits.

6. Legal Conditions for Lawful Cross-Border Health Data Transfer

A healthcare organisation should evaluate several legal requirements before transferring identifiable medical information internationally.

A. Lawful basis for processing

The transfer must be connected to a legally recognised purpose.

Examples include:

Patient-authorised treatment.

International clinical research.

Medical diagnosis.

Public-health protection.

Healthcare administration.

Legal compliance.

Legitimate healthcare operations where the applicable law permits them.

Under GDPR, an organisation generally needs both an Article 6 lawful basis and an Article 9 condition for processing health data.

Consent to medical treatment should not automatically be treated as consent to unrelated international research or commercial disclosure.

B. Informed patient consent

Consent is especially important when health information is transferred for optional research or commercial purposes.

A meaningful consent process should explain:

What information will be transferred.

Which foreign organisation will receive it.

Why the information is required.

Where the information will be stored.

Whether it will be shared with other organisations.

How long it will be retained.

Whether the patient can withdraw consent.

What risks may arise from international processing.

Consent is not necessarily the only lawful basis under every jurisdiction. For example, GDPR recognises other lawful grounds and special-category exceptions.

C. Destination-country adequacy

The receiving country's data protection framework must be examined.

Under GDPR Article 45, the European Commission may recognise a third country as providing adequate protection.

Relevant factors include:

Rule of law.

Human-rights protection.

Independent regulatory supervision.

Government access to personal data.

Enforceable individual rights.

Judicial remedies.

Restrictions on onward transfers.

An adequacy decision facilitates transfers but does not remove the need to comply with other GDPR requirements.

European Commission

D. Standard Contractual Clauses

Standard Contractual Clauses (SCCs) are contractual instruments used to establish safeguards for international transfers under GDPR Article 46.

They commonly address:

Permitted processing purposes.

Data security.

Confidentiality.

Data-subject rights.

Government access requests.

Subcontracting.

Data breaches.

Audits.

Deletion or return of information.

After Schrems II, organisations must evaluate whether the clauses provide effective protection in the circumstances of the particular transfer.

E. Encryption and pseudonymisation

Technical protection is essential when transferring genetic and medical information.

Important safeguards include:

Encryption during transmission.

Encryption at rest.

Strong authentication.

Role-based access control.

Secure key management.

Pseudonymisation.

Audit logs.

Data-loss prevention.

Secure deletion.

Regular security testing.

For genomic information, pseudonymisation alone may not eliminate reidentification risks because genetic information can contain inherently identifying characteristics.

F. Purpose limitation and data minimisation

International recipients should receive only the information necessary for the authorised purpose.

For example, a foreign laboratory conducting a particular diagnostic test may not require the patient's entire medical history.

Similarly, a clinical-trial sponsor may need coded participant information rather than names, addresses, and unrelated medical records.

G. Accountability of data controllers and processors

The transferor and recipient must clearly allocate responsibilities.

The agreement should identify:

The data controller or fiduciary.

The processor.

The foreign subprocessor.

The purpose of processing.

Permitted disclosures.

Security responsibilities.

Breach-reporting obligations.

Retention periods.

Audit rights.

Liability and indemnification.

The original healthcare organisation cannot assume that transferring the information to an overseas contractor automatically eliminates its legal responsibilities.

7. Special Issues in Cross-Border Health Data Transfer

A. International transfer of genetic information

Genetic information presents unique challenges because it may reveal information not only about an individual but also about biological relatives.

International genomic transfers may expose:

Inherited disease risks.

Familial relationships.

Ancestry.

Genetic predispositions.

Reproductive characteristics.

Population-level genetic information.

The transfer of genomic databases to foreign pharmaceutical companies or research institutions therefore requires particularly careful consideration of purpose limitation, consent, confidentiality, and reidentification risks.

B. Cross-border clinical trials

Multinational clinical trials regularly involve the exchange of participant information between:

Hospitals.

Clinical investigators.

Contract research organisations.

Pharmaceutical sponsors.

Regulatory authorities.

Foreign laboratories.

The transfer must comply with applicable privacy laws, clinical-trial regulations, research ethics requirements, and informed-consent obligations.

A research participant's consent to participate in a trial does not necessarily authorise every subsequent commercial use of their information.

C. Foreign cloud storage

Many healthcare providers use international cloud infrastructure.

For example, an Indian hospital may store patient records on servers operated by a foreign cloud service provider.

The legal analysis should consider:

The actual location of storage.

Remote access from foreign jurisdictions.

Subcontracting arrangements.

Governmental access powers.

Encryption and key ownership.

Contractual remedies.

Applicable localisation requirements.

The US Department of Health and Human Services has clarified that HIPAA does not categorically prohibit covered entities from using cloud providers storing electronic protected health information outside the United States, provided applicable HIPAA requirements and business associate arrangements are satisfied.

HHS.gov

D. Artificial intelligence and international health-data processing

AI-based healthcare systems frequently require large datasets for training, validation, and performance monitoring.

International transfers may involve:

Medical imaging.

Electronic health records.

Genomic datasets.

Patient monitoring data.

Clinical-trial datasets.

Predictive diagnostic information.

The principal legal concerns include:

Unauthorised secondary use.

Reidentification.

Algorithmic discrimination.

Lack of transparency.

Foreign access to medical databases.

Unclear liability between hospitals and AI developers.

Organisations should establish whether information can be anonymised or processed locally instead of transferring identifiable records.

E. Government access and national security

Cross-border health-data transfers can create conflicts between privacy rights and foreign governmental surveillance powers.

For example, a foreign authority may seek access to patient records stored within its jurisdiction.

The legal analysis should consider:

Whether the demand is legally binding.

Whether an international agreement applies.

Whether the request is proportionate.

Whether the patient can be notified.

Whether the disclosure can be challenged.

Whether the original jurisdiction's data protection law restricts disclosure.

The Schrems II judgment illustrates why the laws governing foreign government access are relevant to the legality of international transfers.

F. International public-health emergencies

During epidemics and pandemics, health information may need to move rapidly between countries.

Such information may include:

Infection rates.

Disease surveillance reports.

Pathogen sequencing.

Vaccination information.

Hospitalisation statistics.

Contact-tracing information.

Adverse-event reports.

The International Health Regulations provide a framework for international public-health cooperation, but they do not create a blanket exemption from privacy and confidentiality requirements.

8. Comparative Legal Position

The differences between these systems create compliance difficulties for multinational hospitals, biotechnology companies, and international research organisations.

9. Liability for Unlawful Cross-Border Health Data Transfer

Different forms of legal liability may arise depending on the nature of the violation.

A. Civil liability

A patient may seek compensation where unlawful disclosure causes legally recognised harm.

Possible claims include:

Breach of confidentiality.

Breach of contract.

Negligence.

Violation of statutory privacy obligations.

Misuse of personal information.

B. Regulatory liability

A healthcare organisation may face regulatory investigation or penalties for:

Processing without a lawful basis.

Failure to implement reasonable security safeguards.

Unauthorised international disclosure.

Failure to report a data breach where legally required.

Non-compliance with transfer restrictions.

Failure to respect data-subject rights.

Under Section 33 of India's DPDP Act, monetary penalties may be imposed for statutory contraventions, subject to the applicable provisions and enforcement arrangements.

C. Criminal liability

Criminal liability may arise under applicable legislation where the facts satisfy the elements of offences involving:

Unlawful disclosure of personal information.

Breach of contractual confidentiality.

Computer-related offences.

Identity theft.

Unauthorised access.

Fraudulent use of medical information.

Not every unlawful transfer automatically constitutes a criminal offence.

D. Contractual liability

A foreign data processor may become liable under contractual provisions where it:

Discloses information to unauthorised persons.

Uses information beyond agreed purposes.

Fails to maintain required security.

Transfers information to unauthorised subcontractors.

Fails to notify the hospital of a breach.

10. Major Legal Challenges

11. Legal Reforms and Recommendations

A comprehensive international framework for cross-border health-data transfers should incorporate the following safeguards.

1. International health-data transfer agreements

Countries should develop bilateral and multilateral arrangements addressing the transfer, processing, retention, and deletion of medical information.

2. Stronger patient consent mechanisms

Patients should receive understandable information about foreign recipients, research purposes, and onward disclosure.

3. Health-data-specific adequacy standards

International adequacy assessments should consider the particularly sensitive nature of medical and genetic information.

4. Mandatory transfer impact assessments

Healthcare institutions should evaluate the privacy and security risks of transferring identifiable medical information to foreign jurisdictions.

5. Independent regulatory supervision

Data protection authorities should have effective investigative and enforcement powers.

6. Stronger genomic-data safeguards

International genetic research should incorporate pseudonymisation, access restrictions, reidentification controls, and appropriate research governance.

7. Government-access safeguards

Foreign governmental requests should be assessed for legality, necessity, proportionality, and available remedies.

8. International patient remedies

Patients should have practical mechanisms for lodging complaints and obtaining compensation when foreign processors misuse their health information.

9. Clear allocation of liability

Hospitals, pharmaceutical companies, research institutions, and cloud service providers should have clearly defined contractual and statutory responsibilities.

10. Secure international health infrastructure

Technical safeguards should include encryption, access monitoring, secure authentication, and regular independent audits.

12. Important Legal Principles Emerging from the Case Laws

The major judicial decisions establish the following principles:

13. Hypothetical Legal Problem and Analysis

Situation:

An Indian hospital collects the medical records and genomic information of 5,000 patients. It transfers the records to a biotechnology company in the United States for AI-based disease prediction.

The patients were informed that their records would be used for hospital treatment, but they were not adequately informed about overseas commercial research.

The foreign company subsequently shares part of the dataset with another research organisation.

Legal questions:

Was the original international transfer lawful?

Was the use of health information compatible with the original purpose?

Was an appropriate legal basis available?

Did the hospital comply with applicable data protection requirements?

Was onward disclosure authorised?

Who is responsible for the misuse?

Legal analysis:

First, under India's DPDP framework, the hospital must establish a lawful basis for processing and comply with the applicable notice, consent, purpose limitation, and security requirements.

Second, Section 16 and Rule 15 must be considered when assessing the international transfer and any applicable government restrictions.

Third, the original treatment-related purpose cannot automatically justify unrelated commercial research.

Fourth, the foreign company must comply with its applicable contractual and statutory obligations.

Fifth, any onward disclosure must be examined independently against the applicable legal basis, contractual restrictions, and transfer requirements.

If the EU GDPR applies because the processing falls within its territorial scope, Articles 6, 9, and 44–49 must also be considered.

Possible legal consequences:

Regulatory proceedings.

Monetary penalties.

Contractual claims.

Civil claims where legally available.

Orders restricting further processing.

Data deletion or return obligations.

Criminal proceedings if the facts establish an applicable offence.

The final outcome would depend on the applicable laws, consent documentation, contractual arrangements, data-identification status, and evidence of misuse.

14. Conclusion

Cross-border health data transfer represents one of the most significant legal challenges arising from the internationalisation of healthcare and biotechnology.

Although international information exchange supports medical innovation, disease prevention, clinical research, and improved healthcare delivery, it creates serious risks involving patient confidentiality, genetic privacy, foreign governmental access, and accountability.

The Indian constitutional position established in Justice K.S. Puttaswamy v. Union of India provides an important foundation for protecting informational privacy. The GDPR provides a detailed international transfer framework, while Schrems II demonstrates that contractual safeguards cannot be evaluated without considering the practical legal environment of the receiving country.

Similarly, Z v. Finland and I v. Finland establish the particular importance of medical confidentiality and effective security arrangements.

Ultimately, lawful cross-border health data transfer requires a combination of legal authority, transparency, appropriate safeguards, purpose limitation, security, regulatory accountability, and effective patient remedies.

The objective should not be to prevent international medical cooperation but to ensure that the protection of individuals' health information does not disappear when their data crosses national borders.

15. Important Legislation and Research Materials

For further academic and legal research, the following primary materials are particularly useful:

Indian Constitution – Articles 14, 19 and 21.

Digital Personal Data Protection Act, 2023 – Sections 4, 5, 6, 8, 16 and 33.

Digital Personal Data Protection Rules, 2025.

Information Technology Act, 2000.

Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

European Union GDPR – Articles 5, 6, 9, 32, 44–49.

US Health Insurance Portability and Accountability Act.

UK Data Protection Act 2018.

Australian Privacy Act 1988.

Convention 108+.

International Health Regulations, 2005.

EU Cross-Border Healthcare Directive 2011/24/EU.

Useful authoritative research links:

India – Digital Personal Data Protection Act, 2023.

European Commission – International Data Transfer Adequacy Decisions.

CJEU – Lindqvist judgment.

Research on International Transfers of Health Data after Schrems II.

US HHS – HIPAA and Cloud Computing.

EU – Guidelines on Cross-Border Electronic Health Data Exchange.

Academic takeaway: Cross-border health data transfer is not merely a question of international data movement. It is a question of constitutional privacy, medical confidentiality, international jurisdiction, patient autonomy, biotechnology governance, and the accountability of multinational healthcare institutions.