Does DPDPA apply to hospitals, clinics and diagnostic labs in India?

Indian healthcare is digitising fast. Hospital information systems, lab portals, ABHA-linked records, WhatsApp appointment reminders and AI triage tools all hold personal data about patients. A question we hear from hospital administrators and CIOs is whether the DPDP Act treats medical data differently, or whether hospitals are somehow outside its scope. The short answer is that healthcare is squarely inside, and the clock is already running.

The topic is moving in the sector too. At the AHPI Leadership Summit in Jaipur on 18–19 September 2026, the Association of Healthcare Providers (India) signed an MoU with a hospital-software vendor on DPDPA implementation, framed around the May 2027 deadline. And on 5 October 2026, MeitY issued the DPDP (Removal of Difficulties) Order, 2026, which among other things tightened the wording of the periodic “data audit” that Significant Data Fiduciaries must run, a category large hospital chains and health platforms could well fall into.

Why is a hospital a Data Fiduciary under DPDPA?

Section 2(i) of the Act defines a Data Fiduciary as any person who, alone or with others, determines the purpose and means of processing personal data. A hospital decides why it collects a patient’s name, phone number, Aadhaar or ABHA number, diagnosis, prescriptions and bills, and how those are stored. That makes it a Data Fiduciary for every patient, every attendant and every employee whose data it holds.

Section 3 applies the Act to personal data collected in digital form, and to data collected on paper that is later digitised. A clinic that scans OPD registers into its HIS is covered. The Act does not create a separate “sensitive” or “health data” category, so medical records carry the same obligations as any other personal data, but the reputational and penalty exposure when they leak is far higher.

Which hospital activities need consent, and which do not?

Section 6 requires consent that is free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. Section 7 then lists “legitimate uses” that do not need consent. Three of them matter directly to healthcare: responding to a medical emergency involving a threat to life or immediate threat to health (s.7(e)), providing treatment or health services during an epidemic, outbreak or other threat to public health (s.7(f)), and ensuring safety during a disaster or breakdown of public order (s.7(g)). Section 7(a) also covers data a patient voluntarily hands over for a specified purpose, provided they have not objected.

Hospital activity	Likely basis under DPDPA	What to put in place
Emergency admission, trauma, ICU	Legitimate use, s.7(e)	Record the emergency basis; take consent for follow-on uses once the patient is stable
Outbreak surveillance, vaccination drives	Legitimate use, s.7(f)	Limit data to the public-health purpose; set a retention end-date
Routine OPD registration and treatment	s.7(a) or consent, s.6	Plain-language notice at registration in the patient’s language; itemised purposes
Billing, insurance, TPA claims	Consent, s.6	Separate purpose line; processor contract with TPA under s.8(2)
Appointment reminders, health camps, marketing	Consent, s.6	Opt-in, not pre-ticked; easy withdrawal under s.6(4)
Research, AI model training on records	Consent, s.6 (or anonymised data)	Fresh consent or true anonymisation; document the decision
Staff payroll, biometric attendance	Legitimate use, s.7(i), or consent	Employee notice; limit biometric retention

The practical lesson is that “we are a hospital” is not a basis for processing. Each purpose needs its own line in the notice, and the notice must let the patient withdraw consent as easily as they gave it. Section 5 also requires the notice to be available in English or any of the 22 languages in the Eighth Schedule of the Constitution, which matters in a multilingual OPD.

What do the DPDP Rules, 2025 say about children as patients?

Under Section 9, anyone under 18 is a child, and processing their data needs verifiable consent from a parent or lawful guardian, with a ban on tracking, behavioural monitoring and targeted advertising. For a paediatric ward that would be unworkable, so the Fourth Schedule of the DPDP Rules, 2025 exempts clinical establishments, mental health establishments, healthcare professionals and allied healthcare professionals from Sections 9(1) and 9(3), but only to the extent the processing is restricted to providing health services and protecting the child’s health.

The carve-out is narrow. Sending a child’s parent a reminder for a follow-up visit is within it; adding that family to a wellness-package marketing list is not. Our guide to children’s data and verifiable parental consent under DPDPA covers the verification mechanics.

How fast must a hospital report a data breach?

Section 8(6) and Rule 7 of the DPDP Rules, 2025 require a Data Fiduciary to inform every affected Data Principal without delay, in plain language, and to inform the Data Protection Board without delay and then file a detailed report within 72 hours. There is no “low-risk” threshold: a discharge summary emailed to the wrong patient or an unprotected lab-results link is a reportable breach. Failure to notify carries a penalty of up to ₹200 crore under the Schedule to the Act. See inside the 72-hour window for a runbook.

How long can a hospital keep medical records under DPDPA?

Section 8(7) requires erasure once the purpose is served and the patient has not approached the hospital for that purpose within a reasonable period, unless retention is required by law. Healthcare has such laws: the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 require registered practitioners to maintain indoor patient records for three years (regulation 1.3.1), and state clinical-establishment rules, insurance contracts and litigation holds may require longer. The Third Schedule of the Rules sets fixed three-year erasure windows for large e-commerce, gaming and social-media platforms, but not for hospitals.

What a hospital needs is a written retention schedule that cites the legal reason for each record class, and a system that can actually delete or anonymise when the period ends, rather than keeping every record indefinitely by default.

Who is responsible when the HIS, LIS or TPA vendor leaks data?

The hospital is. Section 8(1) makes the Data Fiduciary responsible for compliance even when a Data Processor does the work, and Section 8(2) allows processors to be engaged only under a valid contract. Hospital-software vendors, lab-interface providers, cloud hosts, TPAs and WhatsApp messaging partners are all processors. Contracts should bind them to role-based access, audit logs, breach notification within hours (not days) and verified deletion at exit.

Could a hospital chain be a Significant Data Fiduciary?

Section 10 lets the Central Government notify any Data Fiduciary as a Significant Data Fiduciary based on the volume and sensitivity of data processed and the risk to individuals. Large hospital networks, diagnostic chains and national health platforms are natural candidates. An SDF must appoint an India-based Data Protection Officer, engage an independent data auditor and conduct a periodic Data Protection Impact Assessment and data audit under Rule 13. The 5 October 2026 Removal of Difficulties Order replaced “audit” with “data audit” in Section 10(2)(c)(ii), so SDF audit charters should use that term. Non-compliance with SDF duties carries a penalty of up to ₹150 crore.

What should a hospital do before May 2027?

1. Map every system that holds patient or staff data: HIS, EMR, LIS, PACS, billing, CRM, messaging, and the spreadsheets in between.
2. Assign a lawful basis to each purpose using the table above, and rewrite the registration notice in the languages your patients read.
3. Build consent capture and withdrawal into registration and the patient app, with a tamper-evident record of who consented to what and when.
4. Write the retention schedule and test deletion on one record class.
5. Re-paper processor contracts with breach, access and deletion clauses.
6. Stand up a 72-hour breach runbook and run a tabletop exercise with the IT, medical-records and legal teams.
7. If you may be an SDF, nominate the DPO and schedule the first DPIA and data audit.

The full DPDPA timeline explains how the 13 November 2026 and 13 May 2027 dates were set, and the real cost of waiting sets out the penalty schedule.

How Qodequay helps hospitals get there

DAPro (Data Adhikaar), Qodequay’s DPDPA compliance platform, gives hospitals patient-facing notices and consent in 22 languages, a tamper-evident Evidence Vault that records every consent, withdrawal and breach action, and 25+ connectors to bring HIS, CRM and messaging systems into one compliance view. Qodequay is ISO 27001:2022 and ISO 9001:2015 certified. Book a 30-minute DPDPA readiness call for your hospital.

This article is for general information and is not legal advice. Confirm obligations against the official texts of the DPDP Act, 2023 and the DPDP Rules, 2025, and consult qualified counsel for your situation.