DPDP Act Obligations for Hospitals in India: A Complete Compliance Checklist 

Rule 6 of India’s DPDP Rules, 2025 names no product, no vendor and no technology brand. What it names is evidence: encryption, access control, logs, backups, and a year of records showing who touched which patient data. 

That is a useful clue for hospitals, which hold registration details, prescriptions, scans, insurance files and telemedicine records. This guide connects three threads: what the DPDP Act, 2023 and the DPDP Rules, 2025 ask of a hospital, how that becomes cybersecurity work, and how to sequence it. 

Timing matters. The DPDP Rules, 2025 were published in the Official Gazette dated 13 November 2025. Under the phased commencement schedule in Rule 1, the main obligations for data fiduciaries are scheduled to take effect after 18 months, on 13 May 2027 (Rule 1). Confirm dates and any other law that applies to your facility with qualified counsel. Items marked Action are our recommendations, not statutory requirements. 

What Is the DPDP Act, and Why Does It Matter to Hospitals? 

What Is the Digital Personal Data Protection Act, 2023? 

The Digital Personal Data Protection Act, 2023 regulates the processing of digital personal data in India, including information initially collected on paper and later digitized. A hospital that determines the purpose and means of processing patient data generally acts as a data fiduciary, while the patient is the data principal. The Act also applies to certain processing outside India involving goods or services offered to individuals in India. 

Why Patient Data Requires Strong Privacy and Security Controls 

In March 2025, an attacker copied data from Yale New Haven Health’s network, and the breach was later reported to affect 5,556,702 people. One analysis notes the exposed fields were identifiers such as names, contact details and medical record numbers, and that the electronic record system itself was not accessed. For DPDP purposes, that detail matters: any digital personal data is in scope, so a registration database deserves the same care as a clinical record. Action: Classify every system holding patient identifiers, not only the EMR. 

Which Hospitals and Healthcare Providers Should Assess Applicability? 

Assume yours should. As of 5 October 2026, one tracker found no official exemption that lets small providers skip the core duties, and counsel should confirm your position. 

Multi-speciality and private hospitals 

Action: Name one accountable executive and one privacy lead before you map anything. 

Small hospitals, clinics and diagnostic centers 

Action: Start with three basics: multi-factor authentication, tested backups and role-based access. 

Hospital groups, telemedicine providers and healthcare platforms 

For US readers: a US group with an Indian hospital, lab or back-office team has DPDP exposure for data processed in India, and HIPAA does not govern Indian hospitals by default. Action: List every India-based vendor that touches patient data and check each contract for security clauses. 

DPDP Act vs. General Cybersecurity Practices in Healthcare 

Security frameworks ask whether controls are strong. The Act also asks whether you gave notice, kept consent records, answered patient requests and reported breaches. Action: Add a “legal obligation” column to your security risk register. 

What Are the Key DPDP Act Obligations for Hospitals in India? 

Where we cite a section or rule, the statute decides. Where we write Action, we are offering judgment. 

Identify the Hospital’s Role as a Data Fiduciary 

The hospital stays responsible even when a lab or software vendor does the processing (Section 8). Action: For each vendor, record who decides the purpose. Insurers and TPAs may decide their own, which can make them fiduciaries in their own right. 

Provide Clear Privacy Notices to Patients 

Rule 3 requires a notice that stands on its own, in plain language, with an itemized data list, the specific purposes, and how to withdraw consent, exercise rights and complain to the Board. 

Explain the personal data being collected. 

Action: Replace “medical and personal information” with an itemized list that registration, billing and telemedicine teams can verify. 

State the specific purposes for processing 

Action: Write each purpose as a sentence a patient could repeat, such as “to schedule and deliver your treatment”. 

Obtain and Manage Valid Consent Where Required 

Under Section 6 of the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, expressed through clear affirmative action. Section 6(4) requires that withdrawing consent be as easy as giving it, while Rule 3 specifies how the notice must explain the withdrawal process (Rule 3). 

Record consent and withdrawal where applicable 

Action: Log the timestamp, notice version, purpose and channel for every consent and every withdrawal. 

Separate optional marketing consent from necessary healthcare processing where appropriate 

Action: Give health-camp promotions their own checkbox, and never make them a condition of treatment. 

Process Personal Data for Permitted Purposes 

Consent is one lawful ground for processing personal data, while Section 7 permits certain specified legitimate uses. For hospitals, these may include processing data voluntarily provided for a specified purpose, responding to medical emergencies involving threats to life or health, and providing healthcare during epidemics or public-health emergencies. However, these exceptions do not automatically cover every hospital activity, including routine marketing.  

Action: Map each processing activity to consent or a specific legitimate use under Section 7 and document the justification. 

DPDP Processing Grounds for Common Hospital Activities 

Hospital activity	Relevant legal provision	Practical compliance consideration
Routine patient registration and consultation	Section 6 consent or Section 7(a), where its conditions are satisfied	Document why patient information is collected and used
Emergency treatment involving a threat to life or health	Section 7(f)	Record the emergency-related justification
Treatment during an epidemic or public-health threat	Section 7(g)	Restrict processing to the relevant health-service purpose
Staff recruitment, employment and payroll	Section 7(i), where applicable	Maintain a separate employee-data processing inventory
Health-camp promotions and marketing	Section 6 consent, unless another valid ground applies	Keep promotional processing distinct from treatment-related processing
Treatment of children	Section 9 and Rule 12, Fourth Schedule	Assess whether the conditional healthcare exemption applies
Laboratory and cloud-vendor processing	Section 8(2) and Rule 6(1)(f)	Identify the fiduciary and processor and record contractual safeguards

Source: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf  

Protect Patient Data Through Reasonable Security Safeguards 

Section 8(5) and Rule 6 set the floor, covered in section 4 below. The Act’s highest penalty ceiling, up to ₹250 crore, sits here, and it applies only after a Board inquiry. Action: Treat Rule 6’s clauses as an audit checklist with a named owner for each. 

Establish Procedures for Patient Rights and Grievances 

Patients can seek access, correction and erasure, nominate a representative, and complain to you first. Rule 14 requires published request channels and a grievance response time of no more than ninety days. Action: Publish one request route, then test it with a staff member posing as a patient. 

Handle Personal Data Breaches According to Applicable Requirements 

Rule 7 sets two steps: inform affected individuals and the Board without delay, then send detailed information to the Board within 72 hours or a longer period the Board allows in writing. 

Review Retention and Erasure Procedures 

Section 8(7) of the DPDP Act requires erasure when the purpose of processing is no longer served or consent is withdrawn, subject to applicable legal retention requirements. Rule 6(1)(e) requires relevant logs and personal data to be retained for one year, unless another law requires otherwise. Rule 8(3) separately requires specified personal data, associated traffic data and processing logs to be retained for at least one year for purposes listed in the Seventh Schedule. Rule 8 also provides specific erasure provisions for the classes of data fiduciaries and purposes identified in the Third Schedule. Hospitals must consider these requirements alongside applicable medical record retention laws. Action: Maintain a documented retention schedule identifying the applicable legal basis for each category of records. 

Assess Additional Obligations if Designated a Significant Data Fiduciary 

Additional obligations apply to hospitals only if they are designated as Significant Data Fiduciaries under Section 10 of the DPDP Act. These include appointing a Data Protection Officer and an independent data auditor, alongside periodic data protection impact assessments and data audits. Rule 13 specifies a twelve-month assessment and audit cycle. The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 clarified the terminology concerning data audits under Section 10 without introducing a new obligation. 

What Types of Patient Data Must Hospitals Protect? 

Hospitals process several categories of digital personal data, including clinical, administrative, financial and employee information. Although the DPDP Act does not establish a separate legal category for sensitive health data, medical information requires particularly careful handling because unauthorized disclosure can cause substantial harm. Hospitals should identify all covered personal data while considering the Act’s scope and statutory exclusions. 

Electronic Health Records and Electronic Medical Records 

These tie diagnosis to identity over years. Action: Confirm each module logs reads as well as edits, which supports the visibility Rule 6 asks for. 

Diagnostic Reports, Prescriptions and Medical Images 

Action: Set one approved channel for sending reports to patients. 

Patient Identity, Contact and Insurance Details 

The Yale case shows identifiers alone can reach millions of people. Action: Mask identifiers in analytics extracts and test environments. 

Appointment, Billing and Telemedicine Records 

Action: Identify the systems and third-party service providers handling appointment, billing and telemedicine records. Review their access controls, data-sharing arrangements and contractual security obligations. 

Employee, Doctor and Contractor Personal Data 

Staff are data principals too. Action: Bring HR and payroll systems into the same data map. 

Children’s Data and Data Processed on Behalf of Patients 

Rule 10 generally requires verifiable parental consent for processing children’s personal data. However, Rule 12 and Part A of the Fourth Schedule provide a conditional exemption for clinical establishments, mental health establishments and healthcare professionals when processing is restricted to providing health services to the child, to the extent necessary to protect the child’s health. This exemption applies to Section 9(1) and Section 9(3) and does not remove all other data protection obligations. 

How Should Hospitals Secure Patient Data Under the DPDP Rules, 2025? 

Rule 6 reads like an engineering brief. Consider Frederick Health in January 2025: attackers copied files from a file share server while the medical record system was untouched, and 934,326 people were affected. Our view: protect the places where data gathers, not only the place you expect it to live. 

Implement Encryption and Data Protection Controls 

Rule 6(1)(a) names encryption, obfuscation, masking and virtual tokens. 

Protect data in transit and at rest 

Action: Encrypt databases, file shares, laptops and backups, and verify encrypted links between your hospital system, lab and billing platforms. 

Use masking or tokenisation where appropriate 

Action: Replace direct identifiers with tokens wherever teams only need patterns, such as reporting. 

Apply Role-Based Access Control and Least Privilege 

Rule 6(1)(b) calls for controls on access to computer resources. 

Limit access to patient records by job responsibility 

Action: Review access quarterly. A billing clerk should not open clinical notes. 

Review privileged accounts and remote access 

Action: Require MFA on every admin and remote path. The CISA advisory on Interlock ransomware lists MFA and least privilege among its core mitigations. 

Maintain Security Logs, Monitoring and Incident Records 

Rule 6(1)(c) requires appropriate logging, monitoring and review of access to personal data, while Rule 6(1)(e) requires relevant logs and personal data to be retained for one year unless another applicable law requires otherwise. Rule 8(3) establishes an additional one-year retention requirement for specified personal data and processing records. Separately, CERT-In’s 2022 directions require covered entities to maintain ICT system logs securely within India for a rolling period of 180 days. Action: Establish a log-retention policy that satisfies applicable DPDP and CERT-In requirements, preserves necessary records for investigations and documents the location of stored logs. 

Implement Backups and Disaster Recovery 

Rule 6(1)(d) asks for continued processing after loss of access. Kettering Health found its outage on 20 May 2025 and restored its record system on 2 June, with most operations back by 10 June. Action: Keep offline, immutable copies, rehearse a restore of your core hospital system, and write down how long it takes. 

Review Security of Hospital Applications and Cloud Infrastructure 

Healthcare providers in Sophos’s 2025 survey named exploited vulnerabilities as the top technical root cause, at 33% of incidents. Hospitals using overseas cloud infrastructure, telemedicine platforms or international support services should identify where patient data is stored, accessed and transferred. Section 16 of the DPDP Act and Rule 15 address cross-border transfers, subject to applicable government restrictions and other laws imposing stricter requirements. Action: Map international data flows and review applicable transfer restrictions before engaging overseas service providers. 

Maintain Contracts and Security Requirements for Data Processors 

Rule 6(1)(f) expects security provisions in processor contracts. Action: Require a vendor alert window short enough for you to meet the Board’s 72 hours, plus log access and erasure at contract end. 

How SASE Helps Hospitals Strengthen Their DPDP Compliance Programme 

SASE can carry some of the controls above. 

What Is Secure Access Service Edge (SASE)? 

A cloud-delivered architecture that combines software-defined WAN with security services such as secure web gateway, cloud access security broker, firewall as a service and zero trust network access (Cisco overview). Action: Ask any vendor to show which functions are included, not implied. 

Why Hospitals Need Secure Access Across Multiple Locations 

Secure access for doctors and clinical staff 

Action: Grant consultants application-level access with MFA rather than a flat network connection. 

Secure connectivity between branches, labs and cloud systems 

Action: Segment lab and imaging networks. CISA recommends segmentation to limit how far ransomware can spread. 

Zero Trust Network Access for Patient and Clinical Systems 

NIST SP 800-207 describes zero trust as granting no implicit trust based on network location. Action: Begin with the five systems holding the most patient identifiers. 

Secure Web Gateways and Protection Against Malicious Traffic 

Interlock actors gained access through compromised websites and fake CAPTCHA prompts, and CISA lists DNS filtering among its mitigations. Action: Enable DNS and web filtering on every clinical workstation. 

Cloud Access Security and Data Loss Prevention 

The same advisory describes data being moved to cloud storage before encryption. Action: Alert on bulk uploads to unsanctioned storage. 

Centralized Visibility, Policies and Security Monitoring 

One policy view across sites supports the visibility Rule 6 asks for. Action: Send logs from every site to one store with a one-year retention setting. 

SASE vs. Traditional VPN and Perimeter-Based Security 

Traditional VPN configurations may provide wider network access, depending on how they are implemented, whereas zero trust network access is designed to restrict access according to verified identity, context and application-level permissions. Our view: moving off VPN is a design choice, not a DPDP requirement. Action: Pilot on one department first. 

SASE alone does not make a hospital compliant. Notices, consent, vendor terms and breach procedures sit outside it. 

A Practical DPDP Compliance Checklist for Hospitals 

Companies can use this table to track each step. 

Control	Responsible owner	Evidence required	Status	Next review date
Data map and flows	Privacy lead	Current system and vendor map
Notice and consent log	Legal / compliance	Notice versions, consent records
Access control and MFA	IT security	Quarterly access review
Logs retained for one year	IT security	Log retention settings
Backup restore test	IT operations	Timed restore report
Vendor security terms	Procurement / legal	Signed contract clauses
Breach playbook drill	Incident lead	Tabletop notes and timings
Patient request route	Compliance	Request log with dates

What Should a Hospital Do if Patient Data Is Breached? 

Our view: the 72 hours in Rule 7 is won or lost in the first hour, when someone has to decide that an outage is an incident. 

Detect and Contain the Incident 

Kettering’s investigators traced initial access to 9 April, more than a month before the outage on 20 May. Action: Pre-authorise the on-call lead to isolate network segments. 

Assess the Scope and Potential Impact 

When two Delhi hospitals were hit in June 2025, staff first took the disruption for a technical glitch. Action: Add “unexplained outage is an incident until disproved” to your downtime procedure. 

Preserve Logs and Investigate the Cause 

Action: Snapshot logs and affected systems before rebuilding anything, because the Board report asks for the events and reasons behind the breach. 

Notify Affected Individuals and the Relevant Authority as Required 

Under Rule 7, hospitals must notify affected individuals and the Data Protection Board without delay after becoming aware of a personal data breach. Detailed information must reach the Board within 72 hours unless an extension is permitted. Separately, CERT-In’s directions require specified reportable cybersecurity incidents to be reported within six hours of being noticed or brought to notice. These are distinct obligations with different reporting requirements. Action: Maintain one incident record, assign reporting responsibilities and monitor both applicable deadlines. 

Document Corrective Actions and Prevent Recurrence 

Establish escalation roles and contact details 

Action: Name an owner for Board reporting and one for patient communication, each with a deputy. 

Test the incident response plan through exercises 

Action: Run a tabletop twice a year against the 72-hour clock, and test controls against attacker behaviors, as the CISA advisory recommends. 

Who Is Responsible for DPDP Compliance Within a Hospital? 

Hospital Management and the Governing Body 

Action: Ask for a short DPDP status report at every board meeting. 

IT and Information Security Teams 

Action: Own the Rule 6 control list and the evidence behind it. 

Privacy, Legal and Compliance Teams 

Action: Maintain notices, the consent log and the retention schedule. 

Doctors, Nurses and Administrative Staff 

Action: Give each role a short, practical session on what to share, with whom, and how to report a mistake. 

Third-Party Vendors and Data Processors 

Action: Request an annual security attestation from each vendor. 

When Does a Data Protection Officer Become Necessary? 

Under Section 10, the statutory requirement to appoint a Data Protection Officer applies to entities designated as Significant Data Fiduciaries. Other hospitals must still comply with Rule 9 by prominently publishing the business contact information of a person who can respond to questions about personal data processing. Hospitals should monitor official notifications to determine whether additional obligations apply (Rule 9). Action: Publish that contact on your website now. 

Common DPDP Compliance Mistakes Hospitals Should Avoid 

Treating a Privacy Policy as the Entire Compliance Programme 

Fix: pair it with logs, contracts and drills. 

Giving Excessive Staff Access to Patient Records 

Fix: remove shared logins and review roles each quarter. 

Overlooking Vendors and Cloud Service Providers 

Fix: inventory every processor, including free tools staff adopt on their own. 

Keeping Patient Data Without a Clear Retention Rationale 

Fix: attach a legal or clinical reason to every record class. 

Assuming a Firewall or SASE Solution Is Sufficient 

Fix: judge each tool by the Rule 6 clause it evidences. 

Failing to Test Backups and Incident Response 

Fix: schedule restores and tabletops, and keep the results. 

How a Technical Partner Can Help Hospitals Prepare for DPDP Compliance 

A technical partner implements controls and gathers evidence. It does not give legal opinions or guarantee compliance, and counsel should interpret the law. When you evaluate one, ask who performs each task directly and which tasks depend on other firms. 

Hospital IT and Security Gap Assessments 

Look for a gap report mapped to Rule 6 with ranked fixes. 

SASE and Zero Trust Security Implementation 

Look for a phased design that starts with your highest-risk systems. 

Vulnerability Assessment and Penetration Testing 

Look for retest evidence, because a finding without a verified fix is only a note. 

Endpoint, Network and Cloud Security 

Look for coverage across ward devices, networks and cloud accounts. 

Backup, Recovery and Business Continuity Planning 

Look for timed restore tests of your core systems. 

Security Monitoring, Logging and Incident Response Support 

Look for one-year log retention and a rehearsed escalation path. 

Compliance Documentation and Coordination with Legal Experts 

Look for evidence packs your counsel can review. 

If you would like a second opinion on this checklist, you can explore Consltek’s solutions across managed security, managed infrastructure, GRC and IT leadership, and confirm scope for a hospital engagement in conversation. 

Frequently Asked Questions About DPDP Act Compliance for Hospitals 

What are the DPDP Act obligations for hospitals in India? 

Hospitals must give clear notices, rely on consent or a permitted use, secure patient data, report breaches, honour patient requests, and manage retention. They must also control vendors. Counsel should confirm how each duty applies to your facility. 

When do the DPDP Act and Rules become applicable to hospitals? 

The core duties begin on 13 May 2027. Board-related provisions started on 13 November 2025, and consent manager rules start on 13 November 2026. Verify dates before you plan. 

Is patient consent required for every hospital activity? 

No. Consent is one ground, and Section 7 lists limited legitimate uses. Treatment consent should not be assumed to cover marketing. Counsel should map each activity to its ground. 

Does the DPDP Act apply to small hospitals and diagnostic centers? 

As of 5 October 2026, one tracker found no official exemption for small providers. Smaller sites can scale effort to risk, but should plan for the core duties. 

How should hospitals report a patient data breach? 

Under Rule 7, inform affected individuals and the Board without delay, then send detailed information within 72 hours unless the Board allows longer. CERT-In reporting is a separate duty. 

Is SASE mandatory for DPDP compliance? 

No. The Rules name no technology. SASE can support access control, filtering and visibility, but notices, consent, vendor terms and breach procedures still need separate work. 

Does every hospital need to appoint a Data Protection Officer? 

No. The DPO requirement applies to Significant Data Fiduciaries. Every hospital must still publish a contact who can answer patient questions about their data. 

How can a hospital assess its DPDP compliance gaps? 

Map your data, then score each Rule 6 clause, notice, consent flow and vendor contract as met, partial or missing. Assign owners and dates, and keep evidence for each item. 

Conclusion: Build a Secure and Accountable Healthcare Data Environment 

Hospitals that handle this well treat DPDP as a record-keeping discipline backed by good engineering. Three moves fit that approach. 

This week: name a privacy lead and start the data map. This quarter: turn on MFA for admin and remote access, run a timed restore test, and fix vendor contracts. Before 13 May 2027: publish your notice, request route and contact, rehearse a breach against the 72-hour clock, and confirm dates with counsel. Evidence you can show on a Tuesday afternoon is worth more than a policy that sounds complete.