Key points
- Hospitals, clinics and labs are Data Fiduciaries under the DPDP Act.
- Section 7 allows processing without consent in a medical emergency or epidemic.
- Healthcare providers have a limited exemption on children's data, only for providing health services.
- Access logs to patient records should be kept for at least one year (Rule 6).
- Breaches must be reported to patients and the Board, with a detailed report within 72 hours.
Why healthcare is high-risk under DPDP
A hospital processes health records, identity documents, insurance details, payment data and often children's data, across HIS, LIS, PACS, pharmacy, billing and dozens of vendors. A single breach can expose thousands of patients, and the penalty for failing to take reasonable security safeguards goes up to ₹250 crore.
Where personal data sits in a hospital
| Where the data is | Examples | DPDP point to watch |
|---|---|---|
| Registration and front desk | Name, phone, address, ID proof, photo | Notice at collection (Section 5, Rule 3) |
| Clinical records (HIS / EMR) | Diagnoses, prescriptions, case notes | Access control and logging (Rule 6) |
| Lab and imaging (LIS / PACS) | Reports, scans, sample IDs | Encryption and vendor access (Rule 6) |
| Billing and insurance / TPA | Policy numbers, claims, payments | Sharing only for the stated purpose |
| Paediatric and maternity care | Children's records, guardian details | Children's data (Section 9, Rule 10) |
| CCTV, visitor and attendant passes | Video, visitor names and phones | Retention and erasure (Section 8(7)) |
| Staff and doctors | HR files, credentials, payroll | Employment legitimate use (Section 7) |
| Vendors | HIS provider, labs, cloud, telemedicine apps | Valid processing contract (Section 8(2)) |
Consent and medical emergencies
For routine care, patients should receive a clear notice and give consent for each purpose. Section 7 allows processing without consent to respond to a medical emergency involving a threat to life or health, and to provide medical treatment or health services during an epidemic or outbreak. Do not stretch these grounds to cover marketing, research or sharing with third parties.
Children's data in hospitals
The Rules relax the parental-consent and tracking restrictions for clinical establishments, mental health establishments and healthcare professionals, but only to the extent needed to provide health services to the child and protect their health. Anything beyond care, such as marketing or analytics, still needs verifiable parental consent.
Security and breach response
Rule 6 expects encryption or masking, role-based access, logs of who viewed which record kept for at least one year, and tested backups. Ransomware is a real risk for hospitals: your breach plan must let you inform affected patients and the Data Protection Board without delay, and send the detailed report within 72 hours. See our breach reporting guide.
Retention of medical records
DPDP requires erasure once the purpose is served, unless another law requires you to keep the data. Medical records are often subject to minimum retention periods under medical council regulations and state rules. Record each period and its legal basis in a retention schedule, and erase or anonymise when it ends.
10 steps for hospitals
- Name a data protection lead and publish their contact on your website and at the front desk.
- Map patient, staff and visitor data across every system and vendor.
- Put a plain-language notice on registration forms, in English and the local language.
- Record consent per purpose; keep marketing and research separate from treatment.
- Restrict EMR access by role and review access lists every quarter.
- Keep access logs for at least one year and monitor unusual access.
- Add DPDP clauses and breach timelines to HIS, lab, cloud and TPA contracts.
- Write a breach plan with templates and run a ransomware drill.
- Set retention periods for records, CCTV and visitor data.
- Train doctors, nurses and front-desk staff, and keep attendance records.
Want to know where your organisation stands? Take the free 40-question DPDP Readiness Check, or see our full DPDP compliance checklist.
Frequently asked questions
Does the DPDP Act apply to private clinics and diagnostic labs?
Yes. Any clinic, lab, hospital or healthcare professional that processes digital personal data of patients in India is a Data Fiduciary under the DPDP Act, regardless of size.
Can a hospital process patient data without consent in an emergency?
Yes. Section 7 allows processing without consent to respond to a medical emergency involving a threat to the life or health of the patient or another person, and for health services during an epidemic or outbreak.
Do hospitals need parental consent for treating children?
The DPDP Rules relax the parental-consent and tracking restrictions for clinical establishments and healthcare professionals to the extent needed to provide health services to the child. Uses beyond care still need verifiable parental consent.
How fast must a hospital report a data breach under DPDP?
Affected patients and the Data Protection Board must be informed without delay, with a detailed report to the Board within 72 hours of becoming aware of the breach.
Official sources
- Digital Personal Data Protection Rules, 2025 (Ministry of Electronics and Information Technology)
- Government notifies DPDP Rules (Press Information Bureau, 14 November 2025)
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in plain language for operational planning. It is not legal advice; check details against the official text and with your legal counsel.