Notice and consent at registration
Patients must be told what data is collected and why, in plain language. Consent for research or outreach must be separate from consent to treatment.
Hospitals and healthcare providers
Patient data is the most sensitive data you hold. The DPDP Act expects you to show how you protect it.
Hospitals collect health records, test results, images, insurance details and the contact details of families every day, across desks, wards, laboratories and apps. vDPO helps you find the gaps and fix them, department by department.
The DPDP Act
What it means for hospitals
The Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 apply to every organisation that processes digital personal data in India. These are the areas that need the most attention in this sector.
Emergencies and legal duties
A medical emergency and duties to report to health authorities are legitimate uses that do not need consent. Record which basis each activity relies on.
Children and families
Patients under 18 are children under the Act. The DPDP Rules exempt some processing by clinical establishments for health services, and parental consent is needed elsewhere.
Access to records
Individual logins, role-based access and access logs stop staff looking up patients they are not treating, and let you investigate when they do.
Breaches and ransomware
A breach must be reported to the Data Protection Board of India and the patients affected, with a detailed report within 72 hours. Hospitals are frequent ransomware targets.
Insurers, laboratories and vendors
Insurers, Third Party Administrators, laboratories and software providers receive patient data. Each needs a contract with data protection terms, and only the data it needs.
vDPO
What vDPO gives hospitals
Start with the free gap analysis. A client workspace then turns the gaps into an inventory, notices, assessments and registers you can keep up to date.
Gap analysis
Answer 35 questions written for hospitals and get a score, the gaps found and the corrective action for each. Free, with no login.
Start gap analysisPersonal data inventory
Start from a list of the activities, systems and recipients typical of hospitals, then confirm or edit each one.
Privacy notice and retention schedule
A plain-language privacy notice for each group of people, and a retention schedule, written from the inventory.
Data Protection Impact Assessments
Assess new systems and uses of personal data, with questions for hospitals alongside the standard ones.
Risk register
Turn gap analysis answers into risks, and add the risks hospitals commonly face as a starting list.
Breaches, requests and grievances
A breach register with the 72-hour countdown and draft notices, and a log of requests and grievances with their due dates.
What the DPDP Act Means for Hospitals
Patient records, emergencies, children, access to records, ransomware and insurers: what India’s DPDP Act asks of hospitals and healthcare providers, and where to start.
Read the article