The Kerala High Court issued an interim order directing the implementation of safeguarding measures to protect the confidentiality of data collected on patients or persons susceptible to COVID-19. A set of five petitions were filed in relation to a contract entered into by the Government of Kerala with Sprinklr Inc., a USA based software company, for creating an online data platform for data analysis of medical/ health data in relation to COVID-19. The petitions claimed that the contract lacked any safeguard against the unauthorised exploitation of health data collected by Sprinklr, on behalf of the State of Kerala. The Court stressed the urgency under the current circumstances to protect to confidentiality of personal data in order to avoid a “data epidemic.” In light of those concerns, the Court directed the State to anonymise all the sensitive personal data thus far collected with respect to COVID-19 before transferring it to Sprinklr, or any third-party service provider. Further, any future collection of data must be based on principles of informed consent where every individual will be informed about the access of such data by third parties. The Court also prohibited Sprinklr from committing any act in breach of confidentiality of the data and directed Sprinklr to entrust all the residual COVID-19 related data back to the State government.