CUSTODIAL KEYS, CONSENTING PRINCIPALS, Locating Agency and Data-Fiduciary Liability in Blockchain-Based Health Data Architectures under the Digital Personal Data Protection Act, 2023

Author

Ankul Prajapati,Astha Chauhan ,Karan Gangrade

Abstract

 Blockchain-based health data architectures promise that the patient, rather than the hospital, the insurer or the state, holds the cryptographic key to her own medical history. Key loss, however, is irreversible, and for a population-scale system in India it makes custodial or semi-custodial key management a practical necessity. This paper asks in what legal capacity a custodial key-holder acts when it signs consent grants and withdrawals on a patient’s instruction, and whether holding that key and executing transactions on her behalf makes the custodian a Data Fiduciary under Section 2(i) of the Digital Personal Data Protection Act, 2023. It adopts a doctrinal method, reading the Act and the Digital Personal Data Protection Rules, 2025, the Indian law of agency and trusts, Supreme Court decisions on privacy and medical confidentiality, Ayushman Bharat Digital Mission documents, and European and international guidance on blockchain roles and crypto-asset custody against a technical account of how consent and revocation operate on a ledger. The paper argues that an instruction-following custodian is ordinarily the patient’s agent, and that possession of the key does not by itself confer fiduciary status; status attaches, function by function, where the custodian exercises autonomous discretion over the terms of processing. It proposes a three-part framework comprising an instruction-fidelity test, a discretion-locus test and a registration-convergence rule, under which a custodian whose discretionary functions replicate the statutory role of a Consent Manager is treated as performing that role. It concludes with recommendations for the Data Protection Board, the Ministry of Electronics and Information Technology, the National Health Authority and system designers. Because the Act and the Rules commence in phases, with Consent Manager registration from 13 November 2026 and the main obligations from 13 May 2027, the analysis is prospective.

Keywords

Data Fiduciary; Custodial Wallets; Consent Manager; Blockchain; Health Data

Full Text:

Download Paper PDF

References

The deeper argument advanced in this paper is that the self-sovereignty promise at the heart of blockchain-based health-data design, however genuine its underlying commitment to patient autonomy, does not survive first contact with the realistic requirement of population-scale deployment intact. Key loss is not a marginal risk to be mitigated at the edges of an otherwise self-sovereign system; it is a structural certainty for a meaningful proportion of any large and digitally heterogeneous patient population, and the only serious engineering response to that certainty is some form of custodial or semi-custodial key management. What this means, in doctrinal terms, is that blockchain architecture does not eliminate intermediaries from health-data governance; it relocates them, from the data controllers and processors that conventional data protection law was built to regulate, to key custodians whose formal function, safekeeping and using a cryptographic credential, sits awkwardly astride the existing categories of agent, processor, and fiduciary.

Indian data protection law, and specifically the Digital Personal Data Protection Act, 2023, was drafted against the backdrop of a pre-blockchain data architecture in which the entity determining why and how personal data is processed is usually easy to identify by looking at who runs the database. That assumption does not fail in a blockchain-based system so much as it requires a more granular application, the relevant question is no longer simply which entity runs the system, but which entity, among potentially many technical participants, exercises genuine discretion over the terms on which a patient’s statutory rights are given cryptographic effect. This paper has argued that mere possession of a signing key does not answer that question; the exercise of autonomous discretion over retention, default access, bundling, or data-derived analytics does, and that a function-specific rather than an entity-wide approach to fiduciary characterisation, combined with a substance-over-form extension of the existing Consent Manager framework, offers a workable path for the Data Protection Board and for system designers alike. The recommendations in Section XV identify the guidance, decisions, and design practices through which that path could be made operational. Until such guidance is formalised, entities building custodial health-data wallets in India would be well advised to conduct exactly the functional self-audit proposed in Section XIV before assuming that the technical label of a wallet, rather than a consent manager, is sufficient to place them outside the reach of Chapter II of the Act.

Share your valuable work from Social Media Buttons