DPDP Compliance Blueprint
Hospitals & Healthcare
How hospitals, clinics, diagnostic centres, and health-tech platforms must handle patient personal data under the DPDP Act 2023.
Overview
Healthcare organisations collect some of the most sensitive personal data in existence — diagnoses, prescriptions, genetic information, and mental health records. The Digital Personal Data Protection Act 2023 classifies health data as requiring heightened care. Hospitals, clinics, diagnostic labs, telemedicine platforms, and health-tech companies must establish lawful consent before collecting, processing, or sharing any patient data, and must respond promptly to Data Principal rights requests.
Key DPDP Obligations for Hospitals & Healthcare
Explicit Consent Before Collection
Obtain clear, informed, and specific consent from patients (or their guardians) before collecting any personal health data. Consent must be granular — separate consent for diagnosis, treatment, insurance sharing, and research.
Purpose Limitation
Health data collected for treatment cannot be repurposed for marketing, research, or third-party sharing without fresh, specific consent.
Data Minimisation
Collect only the health data strictly necessary for the stated purpose. Avoid collecting ancillary personal details unless directly relevant to care.
Data Principal Rights
Patients have the right to access their records, correct inaccuracies, withdraw consent, and request erasure of data no longer needed for the original purpose.
Breach Notification
Any personal data breach affecting patient records must be reported to the Data Protection Board and affected individuals without undue delay.
Third-Party Vendor Compliance
Hospitals sharing data with insurance companies, diagnostic labs, or cloud providers must ensure those processors are contractually bound to DPDP obligations.
Consent Architecture for Patient Data
A DPDP-compliant hospital must present consent notices in plain language at the point of registration — not buried in a multi-page form. Consent must be unbundled: a patient agreeing to treatment does not automatically consent to their data being shared with an insurer or used for clinical research. Digital consent records must be timestamped, attributable to the individual, and retrievable on request.
- Separate consent forms for treatment, insurance, research, and marketing
- Consent notices available in the patient's preferred scheduled language
- Digital audit trail linking each consent to a specific data processing activity
- Mechanism for patients to withdraw consent without affecting ongoing care
Health Data Classification
Not all data in a hospital is equally sensitive. DPDP compliance requires a clear classification framework so that the highest-risk data receives the strongest controls.
- Tier 1 — Highly sensitive: diagnoses, prescriptions, mental health records, genetic data, HIV/AIDS status
- Tier 2 — Sensitive: contact details, insurance IDs, billing records, appointment history
- Tier 3 — Operational: anonymised aggregate statistics, de-identified research datasets
- Access controls must be role-based, with Tier 1 data restricted to treating clinicians
Breach Notification Obligations
A personal data breach in a healthcare setting can have life-altering consequences for patients. The DPDP Act requires Data Fiduciaries to notify the Data Protection Board and affected Data Principals of any breach that is likely to cause harm.
- Maintain an incident response plan with defined escalation paths
- Designate a Data Protection Officer (DPO) or equivalent responsible for breach response
- Document all breaches — including those below the notification threshold — in an internal register
- Notify affected patients in plain language, explaining what data was exposed and what steps are being taken
Telemedicine and Health-Tech Platforms
Digital health platforms — teleconsultation apps, wearable integrations, and electronic health record (EHR) systems — face the same DPDP obligations as physical hospitals, with additional complexity around cross-device data flows and third-party API integrations.
- Consent must be obtained within the app before any data is transmitted to backend servers
- Third-party SDKs (analytics, crash reporting) must not receive identifiable health data without consent
- Data residency: patient data must be stored on India-hosted infrastructure unless cross-border transfer rules are satisfied
- Periodic privacy impact assessments for new features that process health data
Penalty Exposure
Failure to implement adequate security safeguards for health data can attract penalties of up to ₹250 crore per instance under the DPDP Act 2023. Repeated or wilful violations may result in higher penalties at the discretion of the Data Protection Board. Healthcare organisations are considered Significant Data Fiduciaries given the volume and sensitivity of data processed.
Implementation Checklist
- Appoint a Data Protection Officer or designated compliance lead
- Audit all patient data collection points and map to a lawful basis
- Implement granular, unbundled consent at registration
- Translate consent notices into relevant scheduled languages
- Establish a Data Principal rights portal for access, correction, and erasure requests
- Deploy role-based access controls for Tier 1 health data
- Draft and test a breach notification procedure
- Review all third-party data processor contracts for DPDP compliance clauses
- Conduct a data retention audit and implement automated deletion schedules
- Train clinical and administrative staff on DPDP obligations
Explore other sector blueprints
Ready to implement DPDP compliance for Hospitals & Healthcare?
Priraksha automates consent collection, Data Principal rights workflows, and breach notification — purpose-built for the DPDP Act 2023.
Book a Demo