DPDP Act for Hospitals and Clinics: What to Do

The DPDP Act and Rules in brief

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's law on digital personal data. Parliament enacted it in August 2023. The Digital Personal Data Protection Rules, 2025 were published in the Gazette of India on 13 November 2025 as G.S.R. 846(E); the government's press backgrounder announced them on 14 November 2025.

The Rules come into force in stages. Rules on the Data Protection Board applied at once. Registration of consent managers starts one year after publication. Most of the duties that matter to a hospital, including notice, security safeguards, breach intimation, retention, children's data and patients' rights, apply 18 months after publication, from 13 May 2027. The Act applies to personal data in digital form, and to data collected on paper that is later digitised, which covers almost every hospital using software. Short definitions of the terms below are also in our glossary.

Your hospital is the data fiduciary

The Act makes the data fiduciary responsible for complying with it, including for processing done on its behalf by a data processor. Moving records to cloud software moves the technical work to the vendor; it does not move the responsibility. The fiduciary may engage a processor only under a valid contract, which is why vendor contracts matter so much (see below).

The government can also notify some organisations as Significant Data Fiduciaries, with extra duties such as a yearly data protection impact assessment and audit.

Notice and consent at registration

Where processing rests on consent, the hospital must first give a notice. Under rule 3 of the DPDP Rules, the notice must be understandable on its own and give, in clear and plain language, an itemised description of the personal data, the specified purpose and the services it enables, and how the patient can withdraw consent, exercise their rights and complain to the Board. Withdrawing consent must be as easy as giving it.

Consent is not the only ground. The Act lists certain legitimate uses that do not need consent, including responding to a medical emergency involving a threat to the life or immediate threat to the health of a person, and providing treatment during an epidemic or other threat to public health. Map every other purpose, such as reminders or marketing, to a clear basis.

• Show a short notice at registration, at the counter and in the patient app, in the patient's language where you can.
• Separate consent for treatment from consent for marketing messages or research.
• Record when and how consent was given or withdrawn, against the patient's record.
• For ABHA and record sharing, rely on ABDM's consent flow, where the patient approves each request; see our ABDM guide.

How does the DPDP Act treat children's data in hospitals?

A child under the Act is anyone under 18. As a general rule, a data fiduciary must obtain verifiable consent of a parent or lawful guardian before processing a child's personal data, and must not track, behaviourally monitor or target advertising at children.

The Rules give healthcare an exemption. Under rule 12 and Part A of the Fourth Schedule, a clinical establishment, mental health establishment or healthcare professional is exempt from the verifiable parental consent and tracking provisions, where processing is restricted to providing health services to the child to the extent necessary for the protection of her health. Allied healthcare professionals have a similar exemption for supporting a treatment and referral plan. Using a child's data for anything beyond care, such as marketing, falls outside it.

Security safeguards and personal data breaches

Rule 6 sets minimum reasonable security safeguards, for the hospital and for processing done by its processors: encryption, obfuscation, masking or virtual tokens; access control; logs, monitoring and review to detect unauthorised access; backups for continued processing; keeping logs and personal data for one year to investigate incidents, unless another law requires otherwise; security terms in the processor contract; and technical and organisational measures to make all this work.

When the hospital becomes aware of a personal data breach, rule 7 requires it to inform each affected patient without delay, in plain language, with what happened, the likely consequences, the steps taken, what the patient can do and whom to contact. It must also inform the Board without delay, and send a detailed report within 72 hours, unless the Board allows longer. Separately, the CERT-In directions of 28 April 2022 require specified cyber incidents to be reported to CERT-In within 6 hours of noticing them.

Retention and erasure of patient data

The Act asks a data fiduciary to erase personal data when consent is withdrawn or the purpose is no longer served, and to have its processors erase it too, unless retention is necessary to comply with a law. For hospitals, other rules often require medical records to be kept for set periods, for example under medical council regulations, clinical establishment rules or accreditation standards, so erasure applies only once those periods end.

Rule 8 also requires every data fiduciary to keep personal data, traffic data and processing logs for at least one year from the date of processing for specified government purposes, and to make its processors do the same. The fixed erasure periods in the Third Schedule apply to large e-commerce, online gaming and social media platforms, not to hospitals. Write a retention schedule that lists each kind of record, the law that sets its period and who approves destruction.

Patients' rights and the grievance officer

• Access: a patient can ask for a summary of their personal data and how it is processed.
• Correction and erasure: a patient can ask for data to be corrected, completed, updated or erased, subject to retention required by law.
• Nomination: a patient can nominate someone to exercise their rights in case of death or incapacity.
• Grievance redressal: under rule 14, the hospital must publish how to make requests and must respond to grievances within a period it publishes, not exceeding 90 days.
• Contact person: under rule 9, the hospital must publish the business contact of its Data Protection Officer, if it has one, or of a person who can answer questions about processing, and mention it in every response.

Name a grievance officer, publish their contact on your website and in your privacy notice, and train the front desk to pass on requests the same day. A patient must use this channel before complaining to the Board.

Contracts with software vendors and other processors

Your HMS vendor, cloud host, lab software, SMS or WhatsApp provider and outsourced billing team may all be data processors. Put written terms in place with each one that cover at least:

• Processing only on your instructions and only for your purposes.
• The security safeguards in rule 6, including access control, logs and backups.
• Prompt notice to you of any breach, so you can meet your own deadlines.
• Where data and backups are stored.
• Help in answering patients' requests.
• Retention of logs for the required period, and erasure on your instruction or when the contract ends, confirmed in writing.
• A full data export in a standard format at any time.

If you are choosing software now, our buyer's checklist and free vs paid comparison include these points.

DPDP compliance checklist for hospitals and clinics

How Sehat Nxt helps

Sehat Nxt keeps patient data on servers in India. Access follows each staff member's role, IPD records carry an audit trail, clinical documents are opened through signed links that expire, never public ones, and owners can download all their patient records at any time. Our security page and privacy policy explain how we handle data as your processor, and our grievance officer's contact is listed there.

Software is only part of compliance; your notices, consent records, contracts and staff habits matter as much. Plans start from ₹999 per month. Book a free demo and ask us the vendor questions above.