What the DPDP Act Means for Hospitals and Clinics
Patient data duties in plain words, and the timeline set by the DPDP Rules, 2025.
Patients, staff and the hospital's role
A hospital decides why and how it uses patient records, billing data, CCTV and staff files, which makes it a Data Fiduciary under the Digital Personal Data Protection Act, 2023. Software vendors, labs and billing partners working on its instructions are Data Processors and should work under written contracts. Patients are Data Principals with rights to information, correction, erasure and grievance redressal.
Health information is among the most sensitive data any organisation holds. Even where the Act does not create a separate category for it, treat it with the strongest protection you have.
Timeline and core duties
The DPDP Rules, 2025 were notified on 13 November 2025. Most operational duties, including notices, security safeguards, breach reporting and retention, take effect 18 months after notification, so hospitals have time to prepare but should begin now.
- Notices that explain each purpose in clear language.
- Security safeguards: encryption, access control, logging, backups.
- Breach reporting to the Data Protection Board and patients, with a detailed report within 72 hours.
- Erasure when the purpose ends, unless a law requires keeping records.
Consent at the front desk
Look at how consent is taken at registration, for teleconsultation, for sharing with insurers and for marketing messages. Each purpose should be explained separately, and marketing consent must never be bundled with consent for treatment. Front-desk scripts and forms are where most hospitals can improve fastest.
- A hospital is a Data Fiduciary for patient and staff data.
- The DPDP Rules, 2025 phase in most duties over 18 months from 13 November 2025.
- Separate consent for treatment, insurance sharing and marketing.
Collect every form and message a patient sees from registration to discharge. Mark where consent is taken and whether each purpose is explained separately.
Check your understanding
1. What is a hospital under the DPDP Act for its patient records?
2. Should marketing consent be bundled with treatment consent?
3. Within how many hours is a detailed breach report due to the Board?
Turn what you learn into monthly income
Resell AI agents and apps under your own brand. Up to 30% off credits, up to 30% recurring share, and apps built by XDQ Labs for your clients. Free to join.
From USD 49 or INR 2,999 a month. A person approves every step.