DPDP Act for Hospitals and Clinics in India: What Changes by May 2027
Last updated:
India's Digital Personal Data Protection Act, 2023 becomes fully operational on 13 May 2027. Hospitals and clinics hold some of the most sensitive personal data there is. This plain-language guide explains the main duties, the healthcare-specific exceptions, and a practical checklist to start now.
A practical DPDP checklist for hospitals and clinics
Map your data
List what personal data you collect (registration, records, images, lab results, billing, CCTV, staff data), where it is stored, who can see it and which vendors process it.
Write clear notices
Plain-language notices explaining what is collected, why, and how people can exercise their rights or complain, available in the languages your patients use.
Fix consent flows
Separate, specific consent for uses beyond care, such as marketing, research or sharing with third parties, with an easy way to withdraw.
Update vendor contracts
EMR, lab, cloud, billing and AI vendors acting as processors must follow your instructions and protect the data.
Strengthen security and breach response
Access controls, logging, encryption where possible, backups, and a tested plan for reporting breaches.
Train staff and assign responsibility
Front desk, nurses, doctors and IT staff need to know the basics; name a contact for data requests and grievances.
Key DPDP terms in plain language
| Term | In a hospital or clinic |
|---|---|
| Data Principal | The patient (or a parent or guardian for a child), and also staff whose data you hold |
| Data Fiduciary | The hospital or clinic that decides why and how data is used |
| Data Processor | A vendor that processes data on your behalf, such as an EMR, lab software or cloud provider |
| Consent Manager | A registered platform people can use to give, manage and withdraw consent |
| Data Protection Board | The body that handles complaints, breaches and penalties |
Main duties for healthcare providers
| Duty | What a clinic should do |
|---|---|
| Notice | Tell patients what data you collect, why, and how to exercise their rights, before or when you collect it |
| Consent | Get free, specific, informed consent for each purpose, unless a legitimate use applies; make withdrawal as easy as giving consent |
| Purpose limitation and minimisation | Use data only for the stated purpose and collect only what you need |
| Accuracy | Keep records accurate and complete, especially when they are used for decisions or shared |
| Security safeguards | Reasonable measures such as access control, logging, encryption and backups |
| Breach notification | Inform the Data Protection Board and affected people without delay, with a detailed report to the Board within 72 hours |
| Erasure | Delete data when the purpose is served and no law requires you to keep it |
| Rights and grievances | Respond to requests for access, correction and erasure, and to complaints, within set timelines |
When patient data can be used without consent
Section 7 of the Act lists certain legitimate uses where consent is not needed. Two matter most in healthcare:
- Responding to a medical emergency involving a threat to the life or immediate threat to the health of the patient or anyone else
- Providing medical treatment or health services during an epidemic, outbreak of disease or other threat to public health
Can we use this patient data?
A team wants to use or share a patient's personal data
Is it to respond to a medical emergency or a public-health threat?
If Yes
A legitimate use may apply; use only what is needed and record why
If No
Has the patient given valid consent for this specific purpose?
If Yes
Proceed within that purpose, with security safeguards
If No or unclear
Don't proceed; get consent or advice from your data-protection contact
Children's data in hospitals and clinics
For anyone under 18, the Act generally requires verifiable consent from a parent or lawful guardian and bans tracking, behavioural monitoring and targeted advertising aimed at children. The DPDP Rules exempt clinical establishments, mental health establishments and healthcare professionals from the parental-consent requirement when processing a child's data to provide health services, and allied health professionals when supporting treatment or referral, but only as far as necessary for the child's care. Uses such as marketing or analytics are not covered by that exemption.
Vendors, EMRs and AI tools
Most clinics rely on vendors: EMR and hospital information systems, lab and imaging software, cloud storage, billing, appointment apps and, increasingly, AI tools. Under the Act, the clinic remains responsible for what its processors do.
- Use written contracts that limit vendors to your instructions and require security and breach reporting
- Know where vendors store data and who in their company can access it
- Check that AI tools do not use your patients' data to train their own models without a lawful basis
- Make sure data can be exported and deleted when a contract ends
- Don't paste identifiable patient information into public AI chatbots
Penalties under the DPDP Act
The Act sets maximum penalties in its Schedule; the Data Protection Board decides actual amounts case by case, considering factors such as the gravity and duration of the breach.
| Failure | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards to prevent a breach | Up to ₹250 crore |
| Failing to notify the Board or affected people of a breach | Up to ₹200 crore |
| Breaching the additional obligations for children's data | Up to ₹200 crore |
| Other breaches of the Act or Rules | Up to ₹50 crore |
Not legal advice
- This guide summarises the law for general understanding. Hospitals and clinics should take advice from a qualified lawyer or data-protection professional on their own situation, and check the current text of the Act and Rules.
Getting started before May 2027
Most of the work is organisational rather than technical: knowing your data, writing notices, fixing consent and vendor contracts, and training staff. Starting now spreads the effort and avoids a rush in 2027.
Dr. Ram Kumar G, a physician with public-health training who has overseen EMR set-up as a medical director, can help clinics and hospitals with the clinical and data-workflow side of this work, alongside their legal advisers. Email ramakumar.md@gmail.com or message on LinkedIn.
When to seek care
- Patients: if you think your health data has been misused or exposed, contact the hospital's grievance officer first; you can then complain to the Data Protection Board
- Patients: you can ask a hospital or clinic what personal data it holds about you and request corrections
FAQ
When does the DPDP Act apply to hospitals and clinics?
The DPDP Rules were notified on 13 November 2025. The main duties on notice, consent, security, breach reporting, erasure and rights apply from 13 May 2027.
Do clinics need consent to treat patients and keep records?
Routine care relies on valid consent backed by clear notices. Consent is not needed to respond to a medical emergency or a public-health threat, and laws that require records to be kept still apply.
How quickly must a data breach be reported?
Affected people and the Data Protection Board must be informed without delay, and a detailed report must reach the Board within 72 hours.
Do hospitals need parental consent to treat a child?
The Rules exempt healthcare providers from the DPDP parental-consent requirement when processing a child's data to provide health services, but only as far as necessary for the child's care.
Are EMR and software vendors responsible under the DPDP Act?
The hospital or clinic stays responsible as the Data Fiduciary, so contracts must require vendors to follow its instructions and protect the data.
What are the penalties under the DPDP Act?
Maximum penalties range up to ₹250 crore for failing to take security safeguards, and up to ₹200 crore for failing to report a breach or for breaching children's-data obligations.
Medical disclaimer: Content on this page is for general education and is not a substitute for individualized medical advice, diagnosis, or treatment. Outcomes vary between patients. Boston Diabetes Center is outpatient / day-care specialty centre with an on-site diagnostic lab and pharmacy — no inpatient beds; imaging and inpatient care are coordinated through partner facilities.