Hospitals hold the most sensitive personal data there is: diagnoses, test results, images and the details of the families who sit by the bed. The Digital Personal Data Protection (DPDP) Act asks every hospital to show how it protects that data.
The Act and the Digital Personal Data Protection Rules, 2025 apply to every hospital, clinic and healthcare provider that processes digital personal data in India. Here is what they mean in practice, and where most hospitals have gaps.
1. Know what you hold, and where it goes
Patient data rarely sits in one place. It moves from the registration desk to the Hospital Information System (HIS), the laboratory, the imaging archive, the pharmacy and billing, and then out to insurers, Third Party Administrators (TPAs), referral doctors and government health programmes. Copies also end up in email, messaging apps and paper files.
A personal data inventory, listing each activity, the data it uses, the systems that hold it and the parties that receive it, is the foundation for everything else the Act requires.
2. Tell patients, and keep consents separate
Patients must receive a clear notice explaining what personal data is collected and why, how to exercise their rights, and how to complain to the Data Protection Board of India. The notice should be available at registration desks and online, in the languages patients use.
Consent to data processing is not the same as consent to treatment. Using patient data for research, health camps or marketing needs its own, specific consent, recorded against the notice the patient saw.
3. Use the right basis: emergencies and legal duties
Not everything depends on consent. The Act recognises legitimate uses, including responding to a medical emergency and meeting an obligation under law, such as reporting notifiable diseases. Record which basis each activity relies on, so treatment never waits for a form and legal reporting never stops because consent was withdrawn.
4. Children and families
Anyone under 18 is a child under the Act. Verifiable parental consent is needed where the Rules require it, and the Rules exempt certain processing by clinical establishments and healthcare professionals to the extent needed to provide health services to the child. Record the age of every patient and document which applies.
Hospitals should also verify who an attendant or caller is before sharing a patient’s information, and record at admission who may receive updates.
5. Limit access to records
Shared logins and open access let staff look up patients they are not treating, such as colleagues or well-known people. Individual logins, role-based access and access logs that are actually reviewed are basic safeguards. Especially sensitive records, such as mental health, HIV status and reproductive health, need tighter controls still.
6. Prepare for breaches and ransomware
Hospitals are frequent ransomware targets. A personal data breach must be reported to the Data Protection Board of India and the patients affected without delay, with a detailed report within 72 hours. That needs a plan, templates written for patients, and a downtime procedure so care continues when systems are down.
7. Hold vendors and partners to account
The hospital remains responsible for its software providers, outsourced laboratories, telemedicine platforms and billing agencies. Each Data Processor needs a contract covering security, breach reporting and deletion. Insurers and TPAs should receive only what each claim needs.
A practical starting point
- Name the person accountable for DPDP compliance.
- Build the personal data inventory, department by department.
- Separate data processing consent from treatment consent.
- Give every user an individual login and review access logs.
- Write the breach response plan and test it.
- Add data protection terms to vendor contracts.
vDPO’s free DPDP gap analysis for hospitals asks 35 questions written for healthcare providers and gives you a score, the gaps found and the corrective action for each. A client workspace then gives you a patient data inventory to start from, privacy notices, DPIAs, a risk register and a breach register.
This article is general information, not legal advice.