Key points
- The main DPDP duties apply from 13 May 2027, so hospitals have about six months to get ready.
- Start with a map of your personal data and your vendors: every other step depends on it.
- Notices, consent forms, security, vendor contracts and breach response each need a month of focused work.
- Hospitals in Odisha should offer notices in Odia as well as English, and check how data flows to government health schemes.
- Leave April for training and a breach drill, and the first half of May for a final check.
Why hospitals should start now
Hospitals collect health data, the most sensitive kind of personal data, at every counter: registration, wards, labs, pharmacy, billing and insurance. It moves through many systems and many outside parties: HIS vendors, outside labs, teleradiology, TPAs and insurers. Fixing this touches almost every department, and departments move slowly. Starting in May 2027 is too late. For a full overview of the law, see our DPDP guide for hospitals and clinics.
The plan, month by month
| Month | Focus | Done when |
|---|---|---|
| November 2026 | Owner and data map | A named owner with a mandate from management; a list of every process, system and vendor that handles personal data. |
| December 2026 | Gap assessment | Each area rated against the Act and Rules, with the top risks and a budget agreed. |
| January 2027 | Notices and consent | New notices at registration, admission and online; consent forms separated by purpose; a way to record consent. |
| February 2027 | Security safeguards | Individual logins, access logs kept for at least a year, tested backups, and an official channel for sharing reports. |
| March 2027 | Vendors and breach response | Data protection clauses with key vendors; a written breach plan with Board, patient and CERT-In reporting. |
| April 2027 | Rights, retention and training | A request and grievance process, a retention schedule, trained staff, and one breach drill. |
| 1 to 12 May 2027 | Final check | Contact details published, open items closed or owned, and a short report to management. |
November: an owner and a map
Name one person responsible for DPDP, with written backing from management. Then build an inventory: for each department, what personal data is collected, from whom, why, in which system, who can see it and who outside receives it. Build a vendor list at the same time, with IT and purchase together. A medium hospital usually ends up with 40 to 60 processes. This map drives every later step, so do not skip it.
December: find the gaps
Compare what you found against the Act and the DPDP Rules, 2025, area by area: governance, notice and consent, children's data, security, breach response, retention, vendors and rights. Rate each gap by risk, and agree the top ten with management. This is also the month to agree a budget, because some fixes (logging, HIS changes, contracts) take time to buy.
January: notices and consent
Every point where data is collected needs a clear notice that lists the data, the purpose, and how to withdraw consent, use one's rights and complain to the Data Protection Board (Section 5 and Rule 3). Keep consent for treatment separate from consent for teaching photos, research, testimonials or marketing. Record what was agreed, when and against which notice version, because the hospital must be able to prove it (Section 6(10)).
For patients under 18, check where verifiable parental consent is needed. The Rules exempt clinical establishments from some children's data duties, but only as far as needed to provide health services to the child (Rule 12 and the Fourth Schedule).
February: security safeguards
Rule 6 sets the minimum: protect data with measures such as encryption or masking, limit access, keep logs of access, keep logs and related data for at least one year, and protect backups. In practice for a hospital this means no shared logins at nurses' stations, access to the HIS by role, logs switched on and kept, backups tested by an actual restore, and reports shared through an official channel instead of staff members' personal phones.
March: vendors and breach response
The hospital stays responsible for what its processors do (Section 8(1) and 8(2)). Start with the vendors that hold the most data, usually the HIS or EMR vendor, outside labs and cloud providers, and add clauses on security, breach notice, sub-contracting and deletion at the end of the contract.
Then write a breach plan. A personal data breach must be reported to the Board and to affected people without delay, with a detailed report to the Board within 72 hours (Rule 7). Cyber security incidents may also need to be reported to CERT-In within 6 hours. See our guide to breach reporting in 72 hours.
April: rights, retention and training
Set up a simple process for patients and staff to ask for a summary of their data, correct it or erase it, with a register and an owner. Grievances must be answered within a published time of no more than 90 days (Rule 14). Write a retention schedule that reconciles DPDP with medical record rules, so records are neither deleted too early nor kept forever. Train every department that handles personal data, and run one breach drill so the plan is tested before it is needed.
1 to 12 May: final check
Publish the contact details of the person who answers data protection questions on your website and notices (Rule 9). Walk through the hospital once more as a patient would. Close or assign every open item, and give management a one-page status report.
For hospitals in Odisha
- Notices in Odia. People must have the option to read the notice in English or in any language in the Eighth Schedule of the Constitution (Section 5(3)). For most patients in Odisha, that means Odia.
- Government health schemes. Many hospitals share patient data with state and central health insurance schemes. Record this sharing in the data map, with its basis and the channel used.
- Paper still matters. Many hospitals in the state still run on paper registers alongside software. Paper that is scanned or typed into a system becomes digital personal data, so include both in the map.
- Local help. Corelinksys is based in Bhubaneswar and works on site with hospitals across Odisha. See DPDP compliance support in Odisha.
Where does your hospital stand?
Take the free DPDP readiness check for hospitals. It takes about 10 minutes and shows your score and top gaps, so you know where to begin in November.
Common questions
Does the DPDP Act apply to small hospitals and nursing homes?
Yes. The Act applies to any organisation that processes digital personal data, whatever its size, including personal data collected on paper and later digitised. A nursing home with a billing system, a lab software or even patient lists on a computer is covered.
Do we need consent to treat a patient in a medical emergency?
No. Section 7 of the Act allows personal data to be processed without consent to respond to a medical emergency involving a threat to life, and during an epidemic or other threat to public health. Outside these situations, consent or another legitimate use under Section 7 is needed, and it should be recorded.
Can a hospital share lab reports with patients on WhatsApp?
The Act does not ban any channel, but it requires reasonable security safeguards (Section 8(5) and Rule 6). Reports sent from staff members' personal phones are hard to control, log or delete. An official, controlled channel is the safer choice, and patients should be told how their reports are sent.
How long should a hospital keep medical records under DPDP?
The Act requires erasure once the purpose is served, unless a law requires the data to be kept (Section 8(7)). Medical records are covered by other rules, such as the Indian Medical Council Regulations, 2002, which require indoor patient records to be kept for three years from the start of treatment. Hospitals should write a retention schedule that reconciles these requirements.
Official sources
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, Ministry of Electronics and Information Technology)
- Digital Personal Data Protection Rules, 2025 (Ministry of Electronics and Information Technology)
- Government notifies DPDP Rules (Press Information Bureau, 14 November 2025)
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in plain language for operational planning. It is not legal advice; check details against the official text and with your legal counsel.