DPDP Act Compliance for Hospitals: A Practical Guide for Healthcare Providers

The Digital Personal Data Protection Act 2023 (DPDP Act) imposes specific obligations on every Indian hospital, clinic, diagnostic centre, and healthcare platform that collects, stores, or processes patient data. Unlike earlier sector-specific regulations under HIPAA or the IT Act, the DPDP Act creates a unified framework that treats patient health records, consent forms, billing data, and diagnostic reports as personal data subject to strict consent, rights, and governance rules. With the compliance deadline set for May 2027 and penalties reaching ₹250 crore per breach event, healthcare providers that have not started building their compliance infrastructure are running out of time.

This guide explains what the DPDP Act requires from healthcare providers, which patient data categories it covers, and what a compliant data management practice looks like in practice.

What the DPDP Act means for hospitals and healthcare providers

What is the DPDP Act and how does it apply to hospitals? The Digital Personal Data Protection Act 2023 is India's first comprehensive data protection law. It applies to any organisation — including hospitals, clinics, diagnostic chains, health-tech platforms, and insurance-linked providers — that processes the personal data of Indian residents in digital form. Because virtually all patient records, diagnostic reports, billing data, and appointment logs are now stored digitally, the DPDP Act effectively applies to every healthcare provider operating in India at meaningful scale.

Under the DPDP Act, hospitals are classified as Data Fiduciaries — entities that determine the purpose and means of processing personal data. Patients are Data Principals — the individuals whose data is being processed. The law creates a set of enforceable obligations for Data Fiduciaries and enforceable rights for Data Principals, with an independent Data Protection Board empowered to investigate complaints and impose penalties.

For hospitals, this means three things in practice: obtaining valid, purpose-specific consent before processing patient data; responding to patient rights requests within defined timelines; and maintaining governance infrastructure — audit logs, breach detection, vendor oversight — that can withstand a regulatory inquiry.

Which patient data is covered under the DPDP Act

The DPDP Act covers all personal data — any information that identifies or can identify a living individual. For healthcare providers, the categories that fall squarely within scope include:

• Patient name, Aadhaar number, mobile number, and date of birth
• Electronic Health Records (EHR) and clinical notes
• Diagnostic reports — pathology, radiology, imaging
• Prescription history and medication records
• Insurance claim data and billing records
• Appointment and scheduling data
• Emergency contact and nominee information
• Biometric data collected for patient identification
• Any data shared with third-party labs, cloud processors, or billing vendors

The Act does not distinguish between sensitive health data and routine administrative data — both are personal data and both require a lawful basis for processing. The practical implication is that every system that touches patient information — HIS, LIS, RIS, billing, CRM — is in scope.

Special obligations for children's data

Hospitals that treat minors are subject to heightened obligations. The DPDP Act requires verifiable parental consent before processing a child's personal data and prohibits behavioural monitoring of children. For paediatric departments, this means collecting and storing explicit parental consent at registration, not just a general admission form signature.

Consent requirements under the DPDP Act (Sections 5 and 6)

What does valid consent look like under the DPDP Act for hospitals? Section 5 requires that personal data be processed only for the specific purpose for which consent was given. Section 6 defines what valid consent must look like: it must be free, specific, informed, unconditional, and unambiguous — indicated by a clear affirmative action. Pre-ticked boxes, blanket admission consent forms, and bundled consent across multiple purposes are not compliant.

For a hospital, this translates into a significant change in how consent is captured at registration and across the care journey:

• Purpose-specific consent — separate consent for treatment, billing, insurance claims, research, and marketing. A patient who consents to treatment does not automatically consent to their data being used for research or pharmaceutical promotions.
• Multilingual notice — consent notices must be available in the patient's preferred language. The Act supports 22 scheduled languages.
• No pre-ticked boxes — consent must be an active, affirmative choice, not an opt-out.
• Consent for minors — verifiable consent from a parent or lawful guardian, not just a signature on an admission form.
• Withdrawal must be as easy as giving — patients must be able to withdraw consent without it affecting the quality of care they receive.

Most hospital admission processes currently collect a single, broad consent that covers everything from treatment to data sharing with third parties. That approach does not meet the DPDP Act's specificity requirement. Hospitals will need to redesign their consent capture workflows before the compliance deadline.

Data Principal rights patients can now exercise (Sections 11–14)

Sections 11 through 14 of the DPDP Act give patients four enforceable rights over their data. Hospitals must build processes to receive, acknowledge, and fulfil these requests within the timelines the Act specifies — and the Data Protection Board can act on complaints where hospitals fail to respond.

Right to access and information (Section 11)

Patients can request a summary of the personal data the hospital holds about them and the purposes for which it is being processed. Hospitals must respond with an accurate account, not a general privacy policy.

Right to correction and erasure (Section 12)

Patients can request correction of inaccurate data and erasure of data that is no longer necessary for the purpose it was collected. For hospitals, erasure requests are complex — clinical records may need to be retained for legal or regulatory reasons — but the process for receiving and assessing requests still needs to exist.

Right to grievance redressal (Section 13)

Every Data Fiduciary must provide a readily accessible grievance mechanism. Patients must be able to raise a complaint and receive an acknowledgement and resolution within a defined timeline. The Act does not prescribe the exact timeline for grievance resolution, but the expectation is that it is prompt — and the Data Protection Board can step in if it is not.

Right to nominate (Section 14)

Patients can nominate another individual to exercise their data rights on their behalf in the event of death or incapacity. Hospitals that hold long-term patient records need a process to verify and honour these nominations.

Managing these rights requests manually — tracking them in email inboxes or spreadsheets — is not viable at hospital scale. A compliance management platform that timestamps requests, tracks SLA clocks, and routes them to the right team is the practical requirement.

Governance and security obligations (Sections 8 and 25)

Section 8 imposes data quality, retention, and security obligations on Data Fiduciaries. Section 25 requires that significant breaches — those affecting a large number of Data Principals or involving sensitive data — be notified to the Data Protection Board and the affected patients within 72 hours. Together, these sections define the governance infrastructure a hospital must maintain.

Data quality and retention

Hospitals must ensure the personal data they hold is accurate and up to date for the purposes it is used. Data that is no longer necessary for the original purpose must be erased. This means hospitals need a systematic approach to data lifecycle management — not just storing records indefinitely because storage is cheap.

Vendor oversight and data processor agreements

Any third party that processes patient data on a hospital's behalf — a cloud EHR vendor, a diagnostic lab, a billing outsourcer, a telemedicine platform — is a Data Processor under the DPDP Act. Hospitals remain responsible for ensuring their processors comply with the Act and must have written agreements in place. A breach at a vendor can trigger the hospital's notification obligations.

Breach notification within 72 hours

When a personal data breach occurs, the hospital must notify the Data Protection Board within 72 hours. This requires a breach detection and escalation process that is far more structured than the periodic security reviews most hospitals currently conduct. Gaps in monitoring — undetected access to billing databases, unauthorised exports of diagnostic reports — can turn a technical incident into a regulatory violation.

Penalties and the compliance deadline

The DPDP Act's penalty structure is tiered. The Data Protection Board determines the quantum based on factors including the nature of the violation, its duration, the number of Data Principals affected, and whether the fiduciary cooperated with the inquiry. The maximum penalty for a single breach event is ₹250 crore. Failure to implement adequate security safeguards carries a penalty of up to ₹200 crore. Failure to notify the Board of a breach within 72 hours is separately penalised.

The DPDP Rules 2025 set the compliance deadline at 1 May 2027. That is not a distant target — building a compliant consent infrastructure, operationalising rights request workflows, and establishing vendor agreements takes six to twelve months for a mid-sized hospital. Organisations that start this work in 2026 are starting at the edge of the safe window.

Violation	Maximum Penalty
Failure to implement adequate security safeguards	₹200 crore
Failure to notify the Board of a personal data breach	₹200 crore
Non-fulfilment of Data Principal rights requests	₹50 crore
Breach of obligations related to children's data	₹200 crore
Any other provision of the Act	₹50 crore

How to build a DPDPA-compliant healthcare practice

A compliant DPDP programme for a hospital involves five workstreams. These are not sequential — they need to run in parallel to meet the May 2027 deadline.

1. Data inventory and mapping

Before you can manage consent or respond to rights requests, you need to know what patient data you hold, where it lives, who has access, and what purposes it is being processed for. This inventory becomes the foundation for everything else — consent notices, retention policies, vendor agreements, and breach response.

2. Consent workflow redesign

Existing admission consent forms need to be replaced or supplemented with purpose-specific, DPDP-compliant consent capture. This typically means redesigning digital and physical registration touchpoints, building a consent registry that timestamps and stores each consent decision, and creating a mechanism for patients to withdraw consent without affecting their care.

3. Data Principal rights operations

Build a dedicated intake channel for rights requests — a patient portal or dedicated email address — with a workflow that tracks SLA clocks from the moment of receipt. Every request needs to be acknowledged, assessed, and fulfilled or rejected with a documented reason. The assessment for erasure requests is particularly complex given clinical record retention obligations under the Clinical Establishments Act and state regulations.

4. Data processor agreements

Review every third-party vendor that touches patient data and establish written processor agreements that reflect DPDP Act requirements. This includes your EHR vendor, cloud storage provider, diagnostic lab partners, and any AI or analytics tools processing patient data.

5. Breach detection and 72-hour response

Implement monitoring across systems that hold patient data, with defined escalation paths and a pre-drafted notification template for the Data Protection Board. A tabletop exercise simulating a breach notification under time pressure is the best way to identify gaps before a real incident forces the issue.

SupaTrust: DPDP compliance management for healthcare providers

What is SupaTrust? SupaTrust is SupaDoc's DPDP consent management and Data Principal rights platform, built specifically for India's DPDP Act 2023. It handles the operational complexity of DPDP compliance — consent capture, rights request fulfilment, audit trails, and DPO reporting — so that healthcare providers can meet their obligations without building bespoke compliance infrastructure.

For hospitals and healthcare providers, SupaTrust provides:

• Purpose-led consent capture — multilingual consent notices in 22 languages, version-controlled, purpose-by-purpose. Works across digital channels including web, SMS, and patient portals.
• Consent lifecycle management — captures, stores, and timestamps each consent decision. Tracks withdrawals and triggers re-consent when a notice version changes.
• Data Principal rights portal — self-service portal where patients can view their active consents, withdraw, raise access or erasure requests, and file grievances. 72-hour SLA clocks start automatically on submission.
• DPO dashboard — real-time consent health, outstanding rights requests, breach-of-clock alerts, and audit-ready reporting for board and regulatory review.
• Tamper-evident audit trail — every consent decision is sealed with a SHA-256 fingerprint and stored in an immutable, append-only log with seven-year retention.
• India data residency — all data is stored on AWS Mumbai (ap-south-1) with no cross-border transfers.

Frequently asked questions