Skip to main content

The DPDP Act: What Indian Hospitals Should Know

· 4 min read
Ciyex HIMS Team
Ciyex HIMS Team
Hospital software, India

Hospitals hold some of the most sensitive information people ever share. India's Digital Personal Data Protection (DPDP) Act, 2023 sets out how organisations must handle personal data in digital form. The government notified the DPDP Rules on 14 November 2025, with an eighteen-month period for phased compliance, which runs to around May 2027.

This is a general summary, not legal advice. Please speak with a qualified adviser about your hospital.

Key terms​

  • Data Principal: the person the data is about, such as your patient. For a child, this includes a parent or lawful guardian.
  • Data Fiduciary: the organisation that decides why and how data is processed. Your hospital will generally be one.
  • Data Processor: a company that processes data on your behalf, such as a software or laboratory vendor.

As the Data Fiduciary, your hospital stays accountable even when a vendor handles the data.

Consent must be clear, informed and specific, and notices must explain the purpose in plain language. People can also withdraw consent.

The Act does allow processing without consent in certain situations. These include responding to a medical emergency involving a threat to life or an immediate threat to health, and providing treatment during an epidemic or other threat to public health. Do not assume these cover all routine care. Ask your adviser how they apply to your hospital.

What patients can ask for​

Patients can ask what data you hold and how it is used, get a copy of it, correct or update it, and ask for it to be erased in certain situations. They can also nominate someone to act for them. Under the Rules, you must respond within ninety days.

Erasure needs care, because other laws can require you to keep medical records. Rules on record retention also differ by state.

If there is a data breach​

A hospital must inform affected people without delay, in plain language. The message must explain what happened, the likely impact and what was done, and give a contact for help. The Data Protection Board must be told too, with a detailed report generally due within 72 hours. Separate CERT-In reporting rules may also apply.

Plan this now. During a breach, you will not have time to work out who does what.

Penalties​

The Act sets penalties of up to:

FailureUp to
Not maintaining reasonable security safeguards₹250 crore
Not notifying a breach to the Board or affected people₹200 crore
Breaching obligations relating to children₹200 crore
Other violations by a Data Fiduciary₹50 crore

Steps to begin now​

  1. Map your data. List what you collect, where it sits, who sees it and which vendors handle it.
  2. Review your forms. Update consent and notice wording at registration and admission.
  3. Limit access. Give staff only the access their role needs, and end shared logins.
  4. Keep logs. Record who accessed what. The Rules expect logs to be kept for at least one year.
  5. Review vendor contracts. Check security, breach reporting and data return.
  6. Name a contact. Publish who patients can contact about their data.
  7. Write a breach plan. Decide who acts, who informs patients and who informs the Board.
  8. Train your staff. Include small habits, like not sharing reports through personal messaging apps.

Choosing software with this in mind​

When you assess hospital software, ask how it handles role-based access, activity logs, data export and backups. Our buying guide covers these questions. To see how Ciyex HIMS handles them, book a demo.

Sources​