DPDP Act for Healthcare: Hospitals, Clinics & Health Apps
Hospitals, clinics, diagnostic labs, telemedicine platforms and health apps handle some of the most personal data there is. The DPDP Act, 2023 and the DPDP Rules, 2025 set common rules for all of it: when you may use a patient's data, what you must tell them, how you protect it, and what happens if it leaks.
If your organisation decides why and how patient data is used, you are a Data Fiduciary and the Act applies to you, whatever your size. The main duties of Chapter II are scheduled to take effect on 13 May 2027, so the time to prepare is now.
Who this covers
Hospitals, nursing homes and clinics are Data Fiduciaries for patient records, billing and appointment data.
Diagnostic labs and imaging centres are fiduciaries for their own patients, and may be processors when they work for another hospital.
Telemedicine and health apps are fiduciaries for what users enter, and for analytics and device data.
Hospital software, cloud and billing vendors are usually Data Processors. The hospital stays responsible for what they do on its behalf.
Insurers, TPAs and pharmacies are fiduciaries in their own right when they decide how patient data is used.
Personal data you are likely to hold
Key provisions for Healthcare
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
You need the patient's consent or a listed legitimate use.
A clear, itemised notice, and consent that is free, specific, informed and as easy to withdraw as to give.
Legitimate uses include a medical emergency, health services during an epidemic, and data a person voluntarily gives for a stated purpose.
Accuracy, security safeguards, breach intimation, erasure, a grievance process and written contracts with processors.
Children's data needs a parent's verifiable consent, with limited exemptions for health services.
Patient rights to access, correction, erasure, grievance redressal and nomination.
Large hospital chains and health platforms could be notified as Significant Data Fiduciaries.
01Treatment, emergencies and consent
Everyday treatment. When a patient gives you their details to be treated, data they voluntarily provide for that stated purpose can fall under a legitimate use in Section 7. Use it for that purpose. For anything else, such as marketing, a loyalty programme or sharing with a third party, get consent.
Emergencies. Section 7 allows processing without consent to respond to a medical emergency involving a threat to life or an immediate threat to health. Do what the emergency needs, record why, and inform the patient afterwards where practical.
Epidemics and public health threats. Section 7 also covers measures to provide treatment or health services during an epidemic or outbreak.
Notice. Every consent request comes with a plain-language notice listing the data, the purpose, how to exercise rights and how to complain to the Data Protection Board, in English or any Eighth Schedule language. See Rule 3.
02Children and patients under guardianship
A child is anyone under 18. Section 9 requires verifiable consent of a parent or lawful guardian, and bars tracking, behavioural monitoring and targeted advertising aimed at children. For people with a disability who have a lawful guardian, the guardian's consent applies (Rule 11).
The Rules exempt certain classes, including clinical establishments, mental health establishments and healthcare professionals, but only to the extent necessary to protect the child's health (Rule 12). The exemption covers delivering care. It does not cover marketing to the parent or ad-tracking in a children's health app.
03Medical records and the right to erasure
Patients can ask for correction and erasure (Section 12). That right gives way where retention is needed for the specified purpose or required by law. Medical-record retention is governed by sector rules, state laws and any programme you join, such as ABDM. In practice:
- Keep what the law requires, for as long as it requires.
- Stop using it for anything else.
- Erase the rest when the purpose ends or consent is withdrawn.
- Tell the patient clearly what you kept and why.
04Security and breaches
Section 8 requires reasonable security safeguards. Rule 6 lists the baseline: encryption or masking, access control, logging, backups and processor contract terms. For a hospital: role-based access to records, audit trails on who opened a file, encrypted storage and transfer, and tested backups.
If a breach occurs you must tell each affected patient and report to the Board. Rule 7 sets content and timelines, including a detailed report to the Board within 72 hours. Plan this in advance, with named owners.
05How the Act sits with other health rules
- Sector rules still apply. Medical council regulations, clinical establishment laws, telemedicine guidelines and ABDM policies continue. Section 38 says the DPDP Act is in addition to other laws.
- The IT Act's older regime goes. Section 44 removes Section 43A of the IT Act, the basis of the SPDI Rules, 2011 that treat medical records as sensitive personal data.
- Research. Section 17 exempts processing for research, archiving or statistics where the data is not used to take decisions about the individual and the Rules' standards are met (Rule 16). Ethics-committee and ICMR requirements continue.
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Check what the law requires you to keep. Keep only that, restrict its use, and erase the rest. Reply in writing within your grievance timelines.
Make sure the patient was told in the notice, and that the lab's contract with any software vendor meets Section 8.
Parental consent applies. The health-services exemption covers care, not tracking or targeted ads.
Treat non-essential tracking as a separate purpose with its own consent. Do not target ads at children.
You remain responsible as the Data Fiduciary. Start your breach plan and inform patients and the Board.
Compliance checklist
Common mistakes to avoid
Treating all patient data as consent-free "because it is medical". Only the listed uses are consent-free.
Using treatment data for marketing without separate consent.
Deleting records the law says you must keep, or keeping everything forever.
Assuming the cloud or software vendor carries the legal responsibility.
Collecting children's data in a health app and running analytics on it.
Common questions
Is health data "sensitive" under the DPDP Act?
The Act has no separate sensitive-data category. All personal data is covered by the same rules, but health data is high-risk, so safeguards should match.
Does a small clinic or solo doctor have to comply?
Yes, if they keep digital personal data and decide how it is used. The Act has no small-business exemption, although the Central Government can exempt classes by notification.
Do we need consent to treat a patient?
Not always as a separate step. Data a patient voluntarily gives for a stated purpose can fall under a legitimate use. For anything beyond that purpose, get consent.
Do we need a Data Protection Officer?
Only if you are notified as a Significant Data Fiduciary. Every fiduciary must, however, publish contact details of someone who can answer patients' questions (Rule 9).
Who is responsible if our software vendor leaks patient data?
You are. The Data Fiduciary stays responsible for processing done on its behalf, whatever the contract says.
Can we use patient data for research?
With consent, or under the Section 17 research exemption if the Rules' standards are met. Ethics-committee requirements still apply.