Why hospitals should pay attention
The Digital Personal Data Protection Act, 2023 sets rules for how organisations handle the personal data of individuals in India. Hospitals and clinics hold some of the most sensitive data there is, so they are directly affected. In the Act's language the hospital is usually a “Data Fiduciary” and the patient a “Data Principal”.
The Rules under the Act were notified in November 2025 and are being phased in. Confirm current dates and obligations with qualified counsel; this article is engineering guidance, not legal advice.
Checklist: know your data
- ✓Map where patient data is collected, stored and sent: HIS, lab, billing, WhatsApp, spreadsheets, vendors.
- ✓Record the purpose for each use of data.
- ✓Identify who has access and why.
Checklist: notice and consent
- ✓Give clear notice in plain language, including a way to withdraw consent.
- ✓Collect consent that is specific to a purpose, not bundled with unrelated terms.
- ✓Record consent with time, version of the notice and the channel.
- ✓Make withdrawal as easy as giving consent. For ABDM sharing, the consent manager handles part of this; see the ABDM integration guide.
- ✓Handle children's data with verifiable parental or guardian consent as the law requires.
Checklist: security safeguards
- ✓Encrypt data in transit and at rest.
- ✓Apply role-based access and remove access promptly when staff leave.
- ✓Keep an audit trail of who viewed or changed records. See audit trails in healthcare software.
- ✓Test backups and recovery.
Checklist: breaches, retention and rights
- ✓Have a written incident-response plan with named owners and a way to notify the Data Protection Board and affected individuals as required.
- ✓Define how long each category of data is kept and how it is erased once the purpose is met.
- ✓Provide a way for patients to access, correct and request erasure of their data, and to nominate someone to act for them.
- ✓Contractually bind vendors that process data for you.
Compare with other regimes
If you also serve US or EU patients, other laws apply. See HIPAA vs DPDP vs GDPR: differences that affect architecture.
Frequently asked questions
Is a hospital a Data Fiduciary under the DPDP Act?
Generally yes, since it decides the purpose and means of processing patients' personal data. Confirm with counsel for your structure.
Does the DPDP Act replace medical confidentiality rules?
No. It adds to existing professional and sector obligations rather than replacing them.
Do we need a Data Protection Officer?
Only certain classes of organisations, known as Significant Data Fiduciaries, must appoint one. Good practice is to name a privacy owner regardless.
Need help with this in your hospital?
Tell us your systems and your goal. We'll map it to a scoped plan.
Talk to our team →This guide is general information for engineering and planning purposes. It is not legal advice, and regulations and specifications change; confirm current requirements with the relevant authority or qualified counsel.
