2. Understanding Your Regulatory Obligations

Every privacy law imposes a slightly different set of duties on organisations, but they share core principles. As a health tech data controller or processor, you’ll need to comply with requirements around: lawful bases for processing, user notice/transparency, data minimization, purpose limitation, data quality, security safeguards, and handling of data subject rights. Understanding these obligations in each jurisdiction is crucial to determining your overall risk exposure and operational priorities.

Some critical obligations to evaluate in your key markets:

• Legal Basis & Consent: On what grounds are you processing health data? GDPR (EU/UK) typically requires explicit consent from users to process sensitive health data, unless another narrow exception applies. Other regimes (like India’s DPDP Act) also put consent at the center for personal data use. By contrast, HIPAA in the US. allows data use by providers for treatment/payment/operations without patient consent, but it tightly restricts disclosures to third parties and uses for marketing. Ensure you identify an appropriate legal basis under each law (consent, contract necessity, legitimate interests, etc., as available) and that your user terms and notices reflect that. For sensitive data, consent or explicit authorisation is often the safest route globally.
• Transparency (Privacy Notices): Virtually all laws require telling individuals what data you collect, why and how it will be used, and with whom it will be shared. GDPR sets a high bar for detailed privacy notices; India’s law likewise demands clear notice at collection; in China you have to break out every process that uses personal data separately, with the data used and justifications listed for each one. If you use AI algorithms on user data, some laws (e.g. the EU, and soon the UK) also mandate explaining the logic of any automated decisions made in plain language[37]. Wherever you’re operating, you should make sure your online and in-app privacy notices are comprehensive and accessible. Keeping privacy notices up-to-date in a fast-evolving product is an ongoing challenge, but non-compliance can lead to penalties.
• Data Protection Impact Assessments (DPIAs): Many jurisdictions now require a form of privacy risk assessment for high-risk processing (which health data processing often is). The EU GDPR mandates DPIAs for processing likely to result in high risk to individual rights – processing health data at scale, or using AI on sensitive data, both typically qualify. The UK mirrors this requirement. Quebec’s Law 25 in Canada makes PIAs mandatory for a wide range of new projects involving personal information. California’s upcoming rules will force larger tech companies to perform privacy risk assessments for certain activities by 2026. Even where not explicitly required by law (e.g. in some APAC countries), doing DPIAs is considered best practice and is looked upon favorably by regulators. These assessments help you identify and mitigate risks proactively – e.g. uncover if your new AI diagnostic feature could adversely affect users or if your data sharing with a research partner has unchecked risks. Failure to conduct a required DPIA can lead to fines (under GDPR regulators have fined companies for ignoring this obligation). More importantly, skipping risk assessments means you may overlook serious issues until it’s too late.
• Cross-Border Data Transfer Compliance: Health tech companies often rely on cloud providers or need to send data back to a central server from users around the world. Most privacy laws restrict international data transfers – i.e. moving personal data out of the country/region – unless certain conditions are met. The EU/UK require that the destination country has an “adequate” privacy regime or that you implement approved safeguards like Standard Contractual Clauses (SCCs) (or the UK IDTA). The US. to EU data flows now have an option via the new EU-US Data Privacy Framework (for certified companies)[41], but otherwise SCCs are needed; you will also need to carry out documented Transfer Impact Assessments (TIAs). Other countries have their own rules: India plans a “negative list” of banned destinations (implying other transfers are allowed by default); China requires government security assessments or certifications for large transfers, and explicit consent must be obtained from all individuals to transfer their data internationally at all; Brazil mandates SCCs or similar agreements by August 2025. Laws in the Caribbean (e.g. Barbados, Jamaica) generally require that the receiving country has adequate protection or that you obtain consent or contracts for transfers[22]. In practical terms, if you’re using a centralised database or cloud hosted in another country, you likely need to implement these legal mechanisms (SCCs, etc.) and document them. Neglecting transfer rules can result in major fines (the largest GDPR fine to date – $1.3 billion against Meta – was for unlawful EU->US transfers[42]).
• Data Security & Breach Response: All jurisdictions insist on appropriate security measures to protect personal data (though specifics vary). Health data, being highly sensitive, typically calls for encryption, strict access controls, and robust cybersecurity practices (potentially aligning with standards like ISO 27001 or SOC 2 for best practice). Beyond preventing breaches, you must also prepare for the worst: incident response plans and breach notification procedures. GDPR requires notifying the regulator within 72 hours of a significant personal data breach[43]. US state laws have varying notification timelines (usually within 30–60 days to individuals, and HIPAA says no later than 60 days to affected individuals and the OCR, with additional rules if over 500 people are affected). Australia’s Notifiable Data Breaches scheme and many others also require prompt notification to authorities and victims in cases of serious breaches. Failure to report in time can compound your legal troubles. Companies therefore need to know the rules in each market and have a breach response procedure in place so that if (or when) an incident occurs, they can respond swiftly and in compliance with each region’s requirements.
• Data Subject Rights Management: Privacy laws grant individuals rights over their data – the right to access it, correct it, delete it, object to certain uses, etc. The GDPR pioneered broad rights (access, rectification, erasure, portability, objection, restriction, and not to be subject to purely automated decisions). Many of these rights are mirrored in other laws: for instance, California and other U.S. states give rights to access, delete, and opt-out of sale/sharing of personal info; India’s law will grant rights to access, correction, and grievance redressal; Jamaican law includes rights similar to GDPR like access and correction. Health tech firms must have processes (often via support or automated tools) to handle such Data Subject Requests efficiently and within legal timeframes (the GDPR gives you one month to respond). If an EU user requests a copy of all their wellness data or deletion of their account info, can you easily fulfill that kind of request? If a UK user objects to you using their data for research, do you have a mechanism to handle that? Setting up a DSAR (Data Subject Access Request) workflow early on is wise – it only gets harder as you accumulate more data and users.

Staying on top of these obligations is admittedly challenging, especially with differences across jurisdictions. But mapping out the commonalities can help. For example, nearly everywhere: have a lawful basis, get consent for sensitive data, protect data well, conduct risk assessments, be ready for breaches, and respect user rights. The differences tend to be in the details (e.g. 72 hours vs. 7 days for breach notice; explicit vs. implicit consent in some contexts; which types of processing need a DPIA). We recommend creating an obligations matrix for your company that lists key requirements in each major jurisdiction of operation – that way you can design controls to meet the strictest requirement and know where to tweak policy for local nuances.

Finally, don’t forget that non-compliance has real consequences beyond fines: regulators can issue enforcement notices that halt certain processing activities (imagine being ordered to stop processing EU data while you fix issues – effectively cutting off that market). They can also mandate compensation to individuals or cause class-action lawsuits. And losing user trust may manifest as users leaving your platform if word gets out that you mishandled data. Thus, understanding and meeting your obligations is not just a legal checkbox, but fundamental to sustaining your business.

Worried that you may not have fully appreciated your AI risks? Contact us to find out how we can help.