DPDP Compliance for Healthcare: What Hospitals and HealthTech Teams Need to Prove

Proving DPDP compliance is the hard part for hospitals

India's Digital Personal Data Protection (DPDP) Act applies its core obligations to Data Fiduciaries from 13 May 2027, and healthcare organizations are among the most exposed. Hospitals, diagnostic chains and HealthTech platforms hold medical histories, test results and billing records across EMR, HIS, lab and billing systems, often with several teams owning a piece.

The difficulty is not writing a privacy policy. It is proof. Under Section 6(10), if consent is ever questioned, the Data Fiduciary must show that a notice was given and that consent was obtained as the Act requires. A static policy and a signed admission form will not carry that burden for every patient, every purpose and every vendor.

This guide maps what DPDP asks of healthcare organizations, what a working programme needs, what the penalties are, and where compliance software helps.

The DPDP timeline: 13 May 2027 is the date to plan around

The Act came into force in stages from 13 November 2025. The business-facing obligations switch on 18 months after that date.

The DPDP Rules, 2025 were notified on 14 November 2025 and set the detailed procedures, including breach reporting: tell affected individuals without delay, inform the Board without delay, then file a detailed report within 72 hours.

Six months is not long for a hospital group that has to inventory its systems, rework patient consent, and renegotiate vendor contracts.

What DPDP compliance software does for a healthcare organization

DPDP compliance software gives a healthcare organization one place to assign, evidence and audit the controls the Act requires, so that its position can be shown on any day rather than reconstructed when someone asks.

It works alongside, not instead of, the systems that touch patients. Consent capture at registration, patient-facing request channels and EMR configuration live in clinical and patient systems. The governance layer sits above them: which control covers which obligation, who owns it, what evidence proves it, and whether it is still current.

Generic tools often miss how hospitals actually work. Evidence is spread across registration, lab, radiology, billing and third-party systems, and ownership is split between clinical, IT, quality and compliance teams. That is the same multi-stakeholder, manual audit-prep problem hospitals already face with accreditation programmes such as NABH, NABL and JCI.

Larger groups should also check whether they may be notified as a Significant Data Fiduciary under Section 10. Those organizations must appoint an India-based Data Protection Officer and an independent data auditor, and run periodic Data Protection Impact Assessments and audits.

Five capabilities a healthcare DPDP programme needs

Each capability below is tied to the section of the Act it answers to, with the evidence an auditor or the Board would ask to see.

1. Notice and consent that can be proved (Sections 5, 6 and 9)

Every consent request must come with or after a notice naming the personal data, the purpose, how the patient can exercise their rights, and how to complain to the Board. The notice must be available in English or any Eighth Schedule language. Consent must be free, specific, informed, unconditional and unambiguous, limited to the data necessary for the stated purpose, and as easy to withdraw as to give.

The Act's own example makes the point for healthcare: a telemedicine app cannot bundle access to a patient's phone contacts into consent for consultations. A blanket intake form will not meet this for secondary uses.

For children, Section 9(1) requires verifiable consent from a parent or lawful guardian before processing, and Section 9(3) bars tracking, behavioural monitoring and targeted advertising aimed at children. Section 9(4) lets the Rules exempt prescribed classes of Data Fiduciaries, so check how that applies to clinical establishments before relying on it.

Evidence to keep: notice versions, consent records by purpose, withdrawal requests and what happened next.

2. A live inventory of where patient data sits (Section 8(4) and 8(5))

The Act does not name a data-mapping step, but you cannot protect, correct or erase data you cannot locate. Patient data moves between registration, EMR, HIS, lab and radiology systems, billing and external vendors. An inventory that shows each system, owner, purpose and processor is the foundation for every other control.

Evidence to keep: the data inventory, system owners, review dates.

3. Patient rights handled on time (Sections 11 to 14)

Patients may ask for a summary of the data processed and the identities of everyone it was shared with (Section 11), correction, completion, updating and erasure (Section 12), grievance redressal (Section 13), and may nominate someone to act for them (Section 14).

Erasure is not absolute. Under Sections 8(7) and 12(3), data may be kept where retention is necessary for the specified purpose or to comply with another law. For clinical records, that means documenting which medical-record retention rules apply and applying them consistently, while erasing what no rule requires you to keep.

Evidence to keep: request log with dates, identity checks, outcome, and the retention rationale for anything kept.

4. Emergency access and other legitimate uses (Section 7)

Consent is not required to respond to a medical emergency involving a threat to life or an immediate threat to health (Section 7(f)), or to provide treatment and health services during an epidemic, outbreak or other public health threat (Section 7(g)). Clinical care should never wait on a consent screen.

The Act does not prescribe a log for these uses, but recording who accessed what, when and why is sound practice and gives you a defensible record if the use is later questioned.

Evidence to keep: emergency-access records and the policy that defines when the exception applies.

5. Control over vendors and processors (Sections 6(6) and 8(1) to 8(2))

Labs, cloud hosts, TPAs, insurers and software vendors may process patient data only under a valid contract (Section 8(2)). The hospital stays responsible for compliance even when a processor does the processing (Section 8(1)), and must cause processors to cease processing on withdrawal of consent and to erase data when required.

Evidence to keep: processor contract register, vendor risk reviews, erasure instructions passed to processors.

Two duties run underneath all five. Section 8(5) requires reasonable security safeguards to prevent a personal data breach, and Section 8(6) requires intimation of a breach to the Board and each affected patient. Those two carry the highest penalties.

DPDP penalties: up to ₹250 crore for failing to secure patient data

The Schedule to the Act sets a maximum for each category of breach. The Board imposes a penalty only after an inquiry finds a breach to be significant (Section 33(1)).

When setting the amount, the Board must weigh the nature, gravity and duration of the breach, the type of data affected, whether the breach repeated, and whether the organization acted to mitigate it, and how quickly and effectively (Section 33(2)). Evidence of prompt, documented remediation is therefore part of the defence, not just the paperwork.

An eight-point DPDP readiness checklist for hospitals

1. Build a data inventory: every system holding patient data, its owner, its purpose and its processors.
2. Rewrite notices and consent flows by purpose, in English and relevant Eighth Schedule languages, with a simple withdrawal route.
3. Set a process for children's data, including verifiable parental or guardian consent, and check the Rules for any healthcare exemption.
4. Stand up a request process for access, correction, erasure, grievances and nominations, with a log of every request.
5. Document which medical-record retention rules apply, so erasure decisions are consistent and defensible.
6. Put valid contracts in place with every processor and review their security and erasure practices.
7. Test your breach response against the Rules: affected patients and the Board informed without delay, a detailed report within 72 hours.
8. Assign an owner and a review date to every control, and keep the evidence where an auditor can see it.

How Quantarra helps hospitals stay audit-ready

Quantarra is an AI-driven continuous compliance platform. For a hospital or HealthTech team preparing for DPDP, it works as the control-and-evidence layer above your clinical and patient systems.

• One control library, many frameworks. Map a control once and reuse it across the frameworks you answer to. Quantarra supports healthcare accreditation frameworks such as NABH, NABL and JCI, security frameworks such as ISO 27001 and HIPAA, and custom, business-specific frameworks, so your DPDP controls can sit beside the rest instead of becoming a separate spreadsheet.
• Evidence that collects itself. 300+ connectors collect evidence automatically from the systems you already use, replacing screenshots and email chains.
• Clear ownership. Every control has an owner and a due date, so the quality, IT and compliance teams work from one view, not four.
• An immutable audit ledger. Your team and your external auditors work from the same record, which cuts external audit fieldwork from months to days.
• Continuous monitoring. A live dashboard shows what is accepted, what is overdue and what is due this week, year round and not just before an audit.

If you are planning for 13 May 2027, book a demo and see how your DPDP controls, evidence and owners can live in one place.

Frequently asked questions

Q. Must a hospital delete a patient's records when asked?

Not always. Sections 8(7) and 12(3) require erasure unless retention is necessary for the specified purpose or to comply with another law. Hospitals should document which medical-record retention rules apply, keep clinical records for as long as those rules require, and erase data that no rule requires them to keep.

Q. Does a hospital need consent to treat a patient in an emergency?

No. Section 7(f) allows processing to respond to a medical emergency involving a threat to life or an immediate threat to health, and Section 7(g) covers treatment during an epidemic, outbreak or other public health threat.

Q. What must a hospital do after a patient data breach?

Section 8(6) requires the hospital to inform the Board and each affected patient. Under the DPDP Rules, 2025, that means informing affected individuals and the Board without delay, followed by a detailed report to the Board within 72 hours. Failing to give notice can attract a penalty of up to ₹200 crore.

Q. Does the DPDP Act require compliance software?

No. The Act requires you to meet its obligations and, where consent is the basis, to prove it. Software is a practical way to show ownership, evidence and an audit trail across many systems and teams, which is hard to do with spreadsheets and email.