DPDPA Simplified for Hospitals: What You Actually Need to Know

There is no DPDPA certificate to buy, and compliance can’t be handed to an agency. Here is what India’s data protection law asks of hospitals, when it applies, and where to start.

Over the past few months, our team has spoken with hospitals across India about the Digital Personal Data Protection Act, 2023 (DPDPA). The conversations start in different places. Some administrators ask which certificate they should get. Others want to know which agency will “make us compliant”. A few have been told that a piece of software already makes them compliant.

We understand the confusion. The Act is new, the Rules arrived only in November 2025, and most guidance is written for technology companies, not for a registration desk at 9 a.m. on a Monday. We build software for hospitals, not legal opinions, so read this as a practitioner’s map rather than legal advice. Here is what we’ve learned so far.

Does the DPDP Act apply to hospitals?

Yes. If your hospital collects personal data about patients, attendants, staff or visitors in digital form, or on paper that is later digitised, the DPDP Act applies to you ([1]). Under the Act, the hospital is a Data Fiduciary: it decides why and how the data is used, and it carries the obligations.

Hospitals sit at the sharp end of this law for three reasons. Health information is among the most sensitive data a person has. It moves through many hands: registration, wards, labs, imaging, pharmacy, billing, TPAs and a long list of vendors. And it has to be available at all times. When five servers hosting the e-Hospital application at AIIMS New Delhi were hit by a cyber attack in late 2022, services had to be restored from backup ([8]). Availability is part of data protection, not just confidentiality.

Is there a DPDPA certification for hospitals?

No. The DPDP Act and the DPDP Rules, 2025 do not create a compliance certificate for hospitals, or for any other Data Fiduciary, and no government body issues one ([1], [2]). Compliance is something you do continuously and can prove, not a badge you buy once.

A few things do exist, and they are often confused with certification:

• Consent Manager registration. Consent Managers register with the Data Protection Board. This is a specific regulated role, not something hospitals need ([2]).
• Audits for Significant Data Fiduciaries. Organisations notified as Significant Data Fiduciaries must carry out a Data Protection Impact Assessment and an audit every twelve months (Rule 13 [2]). That is an obligation, not a certificate.
• Security and privacy standards. ISO/IEC 27001 and 27701 can strengthen how you manage security and privacy. They are useful, but holding them does not by itself mean you meet the Act.

If someone offers you a “DPDPA certificate”, ask what exactly it certifies, and against which section of the Act. What matters if the Data Protection Board ever asks questions is evidence: the notice you gave, the consent you recorded, the requests you answered, the breaches you reported and the decisions you documented.

Can a hospital outsource DPDP compliance?

Not the accountability. Section 8(1) of the Act makes the Data Fiduciary responsible for compliance, including for processing done on its behalf by a Data Processor, regardless of any agreement to the contrary ([1]). Lawyers, consultants and software can help you design and run the programme. The hospital still owns it.

In practice, five things have to sit inside the hospital:

Does a hospital need a Data Protection Officer under the DPDP Act?

Every hospital needs a named person who can answer questions about how it processes personal data, and it must publish that person’s business contact details (Section 8(9); Rule 9). A formal Data Protection Officer, based in India and responsible to the board, is mandatory only for organisations the government notifies as Significant Data Fiduciaries under Section 10 ([1]).

As of mid-October 2026, we are not aware of any notification designating hospitals as Significant Data Fiduciaries. Large hospital groups that process health data at scale should still prepare for it, because volume and sensitivity of data are among the factors the government considers.

For most mid-size hospitals, a sensible approach is to name a senior person, not only someone from IT, as the published contact and Grievance Officer, and to give them a small cross-functional committee. Whether you need a formal DPO is a question to settle with your legal counsel.

When do hospitals need to comply with the DPDP Act?

Most obligations apply from about 13 May 2027, eighteen months after the DPDP Rules were notified on 13 November 2025 ([2], [4]). That includes notice, consent, security safeguards, breach intimation, children’s data and patient rights.

Two cautions. First, in January 2026 the Ministry of Electronics and IT sought industry views on shortening the 18-month window to 12 months ([6], [7]). As of mid-October 2026, no amending notification has been issued, but it is a real possibility. Second, the slow parts of DPDP readiness are rarely the documents. They are changes to registration workflows, vendor contracts and staff habits, and those take months. Don’t plan around the latest possible date.

What are the penalties under the DPDP Act?

The Act sets maximum penalties in its Schedule ([1]):

The Data Protection Board decides the actual amount, considering the nature, gravity and duration of the breach, the type of data involved and the steps taken to reduce harm (Section 33(2)). For a hospital, the bigger cost is usually trust. Patients don’t come back to a hospital they believe leaked their records.

What does DPDP compliance look like inside a hospital?

Strip away the jargon, and it comes down to eight practical changes:

1. A data map. Every department, from registration and LIS to the TPA desk, CRM, HR and CCTV, listed with what data it holds, why, and who it shares it with.
2. A plain-language privacy notice at registration, in the languages your patients read (Section 5; Rule 3).
3. Purpose-wise consent. Consent for treatment kept separate from marketing, research, teleconsultation and photographs, each with its own signature (Section 6). Clinical consent forms for procedures remain separate again.
4. Care with children’s data. Hospitals are exempt from verifiable parental consent requirements for health services, to the extent needed to protect the child’s health (Rule 12 and the Fourth Schedule). Photos, testimonials, camps and marketing still need verifiable parental consent.
5. A rights and grievance desk. Patients can ask for access, correction, erasure and nomination, and grievances must be answered within a reasonable period, no later than 90 days (Rule 14). Clinical records are corrected by amendment, and erasure gives way where medical-records law requires you to keep data.
6. Reasonable security safeguards (Rule 6): role-based access, logs kept for at least a year, encryption, tested backups, and no patient data in personal WhatsApp groups.
7. A breach plan. Inform affected patients and the Board without delay, and file a detailed report with the Board within 72 hours (Rule 7). Cyber incidents also go to CERT-In within 6 hours ([5]).
8. Vendor contracts. Data processing agreements with your HIS, cloud, CRM, messaging and AI vendors, including what they may and may not do with patient data.

Hospitals preparing for accreditation will recognise some of this. The habits NABH builds around record confidentiality, access control and staff training make DPDP work easier. If you’re on that path, our NABH 6th Edition roadmap covers the accreditation side.

You don’t need to spend a fortune to get started

Large consulting engagements have their place, especially for big groups. But a mid-size hospital can make real progress in its first 30 days with a spreadsheet, a few good templates and a committed owner:

• Name an owner and a published contact this week.
• Map your data, department by department.
• Separate optional consents from treatment consent at registration.
• List every vendor that touches patient data, and send each one a data processing agreement.
• Write down who does what when a breach happens, including the 6-hour and 72-hour clocks.

That’s why we put together the DPDP Act Compliance Kit for Hospitals: a 14-page guide, an Excel readiness workbook with a 50-point checklist, a privacy notice, eight consent forms, a rights and grievance desk, a breach runbook, a vendor agreement, a policy, a DPIA template and a staff training pack, all written for hospital workflows.

A clarification we make every time: this kit is a starting point, not a shortcut to compliance. Qualified legal advice is essential to assess your hospital’s specific obligations, and you should establish clear internal ownership and decide, with counsel, whether a DPO or another designated role is required.

Many hospitals are already well into their compliance journey. If yours is still making sense of it all, we hope this brings some structure to the process.

Frequently asked questions

Is there a government-issued DPDPA compliance certificate for hospitals?

No. Neither the DPDP Act, 2023 nor the DPDP Rules, 2025 provide for a compliance certificate, and no government body issues one. Hospitals show compliance through records: notices given, consents recorded, rights requests answered, breaches reported and decisions documented.

Does the DPDP Act apply to paper medical records?

It applies to personal data collected digitally and to personal data collected on paper that is later digitised. In most hospitals, registration slips, case files and reports end up in the HIS or a scanned archive, so treat them as in scope.

Is our existing consent form enough for DPDP?

Usually not. Consent for a procedure is a clinical decision. DPDP consent is about using personal data for specific purposes, it must be free, specific and informed, and optional purposes such as marketing or research can’t be bundled with consent for treatment.

Do small hospitals and nursing homes need to comply with the DPDP Act?

Yes. The Act has no general size threshold for Data Fiduciaries. The government can exempt notified classes, such as start-ups, from some provisions (Section 17(3)), but hospitals and nursing homes should assume the core duties apply to them.

Can a patient ask a hospital to delete their medical records?

A patient can ask for erasure of personal data that is no longer needed. Where a law requires the hospital to keep records, such as medical-records or tax rules, the hospital keeps them, restricts their use to that purpose and explains why (Sections 8(7) and 12(3)).

Who is responsible if a hospital’s vendor causes a data breach?

The hospital. As the Data Fiduciary, it remains responsible for processing done on its behalf (Section 8(1)), and it must notify the Board and affected patients. Data processing agreements should require vendors to report breaches to the hospital within hours.

References

1. Ministry of Electronics and Information Technology — The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), 11 August 2023 — https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf
2. Ministry of Electronics and Information Technology — Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025 — https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf
3. Ministry of Electronics and Information Technology — Digital Personal Data Protection (Removal of Difficulties) Order, 2026, S.O. 5458(E), 5 October 2026 — https://www.meity.gov.in/static/uploads/2026/10/daf495a7b5798a3dfa72a944b51fc176.pdf
4. Press Information Bureau — Government notifies DPDP Rules to empower citizens and protect privacy, 14 November 2025 — https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014
5. CERT-In — Directions under section 70B(6) of the IT Act, 2000, 28 April 2022 — https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf
6. Storyboard18 — MeitY seeks industry views on fast-tracking DPDP Act rollout, proposes 12-month compliance timeline, January 2026 — https://www.storyboard18.com/digital/meity-seeks-industry-views-on-fast-tracking-dpdp-act-rollout-proposes-12-month-compliance-timeline-88332.htm
7. Takshashila Institution — MeitY considers reducing DPDPA compliance timelines, 26 January 2026 — https://takshashila.org.in/content/blogs/20260126-meity-considers-reducing-dpdpa-compliance-timelines.html
8. The Tribune — AIIMS cyber attack: No ransom was demanded, most data restored, government states in Parliament, 16 December 2022 — https://www.tribuneindia.com/news/delhi/aiims-cyber-attack-no-ransom-was-demanded-most-data-restored-government-states-in-parliament-461633

This article is general information, not legal advice. It reflects the DPDP Act, 2023, the DPDP Rules, 2025 and official notifications available on 15 October 2026.