DPDP Act for hospitals: what healthcare providers must do
Patient consent, the medical emergency and epidemic uses in section 7, children’s records, retention against medical-record laws, and the Rule 7 breach timeline, for hospitals, clinics and diagnostic centres.
Last updated 22 October 2026
How does the DPDP Act apply to hospitals?
A hospital that keeps patient data in digital form is a Data Fiduciary. It needs consent or a listed legitimate use, such as a medical emergency, to process that data, must protect it with reasonable safeguards, must report breaches to patients and the Data Protection Board, and must erase data once no law requires keeping it.
Where the DPDP Compliance Suite is today
The Perimattic DPDP Compliance Suite is in development. It is not yet live or for sale, and the features on this page are planned, not shipped.
Sign upIs patient health data covered by the DPDP Act?
Yes. The DPDP Act, 2023 defines personal data as any data about an individual who is identifiable by or in relation to it (section 2(t)). Diagnoses, prescriptions, scans, lab reports, bills and insurance details all qualify. The Act applies to such data collected in digital form, and to data collected on paper and digitised later (section 3(a)), so scanned case files and records keyed into a hospital information system are covered.
The Act does not create a separate “sensitive” category with stricter rules, as some other laws do. Health data is protected by the same duties as other personal data. That does not make it low-risk: the sensitivity of data is one of the factors the government weighs in naming Significant Data Fiduciaries (section 10(1)(a)), and the type and nature of the data affected is a factor in setting penalties (section 33(2)(b)).
| Data you hold | DPDP duty | Section or rule | Applies from |
|---|---|---|---|
| Registration and contact details | Notice and consent limited to what care requires | Sections 5 and 6(1); Rule 3 | 13 May 2027 |
| Emergency admissions | Process without consent while the emergency lasts | Section 7(f) | 13 May 2027 |
| Children’s case records | Parental consent not required for health services, within limits | Section 9; Rule 12, Fourth Schedule Part A | 13 May 2027 |
| EMR, PACS and lab systems | Encryption, access control, logs kept one year, backups | Section 8(5); Rule 6 | 13 May 2027 |
| Records shared with insurers and TPAs | Accuracy where data drives a decision or goes to another Fiduciary | Section 8(3) | 13 May 2027 |
| Closed patient files | Erase unless retention is necessary for compliance with law | Sections 8(7) and 12(3) | 13 May 2027 |
| Any of the above, if breached | Tell patients and the Board; detailed report in 72 hours | Section 8(6); Rule 7 | 13 May 2027 |
Every date in the table comes from two Gazette notifications of 13 November 2025: the order bringing sections 3 to 17 of the Act into force on 13 May 2027 (G.S.R. 843(E)), and Rule 1 of the DPDP Rules, 2025, which starts Rules 3 and 5 to 16 on the same day.
When can a hospital process patient data without consent?
Consent is the default ground (section 4), and it must be free, specific, informed, unconditional and unambiguous, and limited to the data necessary for the purpose (section 6(1)). The Act’s own illustration is a telemedicine app that asks for access to the patient’s phone contacts: because the contact list is not necessary for telemedicine, the consent is limited to the telemedicine data alone.
Section 7 lists uses that need no consent. Four matter most to healthcare providers:
- Section 7(a), voluntary provision. Data a patient voluntarily gives for a specified purpose, where she has not said she does not consent. The Act’s example is a pharmacy texting a payment receipt.
- Section 7(f), medical emergency. Responding to a medical emergency involving a threat to the life or an immediate threat to the health of the patient or any other individual.
- Section 7(g), epidemics. Taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease or any other threat to public health.
- Section 7(d) and (e), legal obligations. Disclosures a law requires you to make to the State, and compliance with a judgment, decree or order.
These grounds are narrow. Emergency processing does not cover a later marketing call about a health package, and an epidemic does not cover routine elective care. For those, seek consent with a notice that itemises the data and states each purpose (Rule 3).
How should hospitals handle children’s records and record retention?
Children’s records
Anyone under eighteen is a child (section 2(f)), and section 9(1) normally requires verifiable parental consent before processing a child’s data. The Fourth Schedule to the DPDP Rules, 2025 (Part A, read with Rule 12) lifts that requirement, and the bar on tracking and behavioural monitoring in section 9(3), for:
- a clinical establishment, mental health establishment or healthcare professional, where processing is restricted to providing health services to the child, to the extent necessary for the protection of her health; and
- an allied healthcare professional, where processing is restricted to supporting a treatment and referral plan recommended for the child, to the same extent.
The exemption is tied to treatment. A paediatric patient portal, a newsletter or research use outside the exemption needs verifiable parental consent under Rule 10. Section 9(2), which bars processing likely to harm a child’s well-being, is not exempted at all.
Retention
Section 8(7) requires erasure once consent is withdrawn or the purpose is no longer served, “unless retention is necessary for compliance with any law for the time being in force”. Section 12(3) carries the same exception for erasure requests. Other laws and regulations may require you to keep medical records longer than the DPDP Act would on its own; the Act does not override them, so set retention per record type by the longest legal requirement, then erase. Rule 6(1)(e) and Rule 8(3) separately require access logs, and personal data and logs of processing, to be kept for at least one year.
What must a hospital do after a patient data breach?
A personal data breach includes unauthorised processing, accidental disclosure, and loss of access to data (section 2(u)), so ransomware that locks the EMR counts even if nothing leaves the building. Rule 7 sets two parallel duties once you become aware of it:
| Who | When | What to include |
|---|---|---|
| Each affected patient | Without delay | What happened and when, likely consequences for her, what you are doing, what she can do, and a contact person |
| Data Protection Board | Without delay | Description, nature, extent, timing, location and likely impact |
| Data Protection Board | Within 72 hours, or longer if the Board allows on a written request | Updated details, causes, mitigation, findings on who caused it, steps to prevent recurrence, and a report on the patient intimations |
Patients are told through their user account or any contact mode they registered with you (Rule 7(1)). Failing to give the Board or affected patients notice of a breach may attract a penalty extending to two hundred crore rupees, and failing to take reasonable security safeguards one extending to two hundred and fifty crore rupees (section 33 and the Schedule). Sector rules may add their own reporting duties; the DPDP Act applies in addition to them (section 38(1)).
How will the Perimattic DPDP Compliance Suite help hospitals?
For hospitals, clinics and diagnostic centres, the planned features most relevant are:
- A personal-data inventory across HIS, EMR, lab, imaging and billing systems.
- A notice builder for patient notices in English and Eighth Schedule languages.
- Consent capture and records, kept separate from emergency and other legitimate-use processing.
- A children’s data workflow for verifiable parental consent where the treatment exemption does not apply.
- Retention and erasure schedules per record type, set by the longest period the law requires.
- A breach response workflow for patient intimations and Board reports under Rule 7.
Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. Using it will not by itself guarantee compliance. Sign up to tell us how your hospital handles patient data.
General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.
More on DPDP compliance
The DPDP Act for hospitals, answered
Is health data “sensitive personal data” under the DPDP Act?
No. The DPDP Act has no separate category of sensitive personal data; health data is personal data like any other under section 2(t). Sensitivity still counts: section 10(1)(a) names the volume and sensitivity of data as a factor in notifying Significant Data Fiduciaries, and section 33(2)(b) makes the type and nature of the data affected a factor when the Board sets a penalty.
Does a hospital need consent to treat an unconscious patient?
No. Section 7(f) allows processing, without consent, for responding to a medical emergency involving a threat to the life or an immediate threat to the health of the patient or any other individual. Once the emergency has passed, continued processing needs consent or another ground, and a notice under section 5 should follow when consent is sought.
Can a patient ask a hospital to delete her medical records?
She can ask, under section 12(3), but the hospital must erase only if retention is not necessary for the specified purpose or for compliance with any law in force. Other laws and regulations may require you to keep medical records longer than the DPDP Act would on its own; where they do, the hospital keeps the records for that period and erases them afterwards.
Want DPDP compliance built around how your business handles data?
Sign up to tell us what personal data you handle, follow the build and be first to try the DPDP Compliance Suite when it opens.
Sign up