Guide · For hospitals, nursing homes and clinics
DPDP for hospitals: what changes on 13 May 2027
India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 apply to every organisation that handles digital personal data. Hospitals handle some of the most sensitive data there is. Here is what the law asks of you, in plain language, and where to start.
Most DPDP duties start on 13 May 2027, 18 months after the Rules were notified on 13 November 2025. That leaves a few months to prepare: enough, if you start now.
By Anand Radhakrishnan, ProSuite OS Healthcare · 15 Nov 2026 · 5 min read
What the law asks of a hospital
Under the Act, your hospital is a “data fiduciary”: you decide why and how patient data is used, so these duties are yours.
- 1
Tell patients, in plain language, what you collect and why
A notice that stands on its own: the personal data you collect, what each item is used for, how a patient can withdraw consent, use their rights and complain. It has to be clear enough for the patient to understand, not a paragraph buried in a registration form.
- 2
Take consent properly, and make withdrawing it as easy as giving it
Consent must be free, specific, informed and clear, for a stated purpose. Some processing does not need consent, such as responding to a medical emergency, but most everyday uses (reminders, follow-up messages, sharing with a lab or insurer) need a clear basis that you can show.
- 3
Keep patient data safe
Reasonable security safeguards: who can see which records, protection such as encryption or masking where it fits, backups, and logs of who accessed what. The Rules expect those logs to be kept for at least a year.
- 4
Report a breach quickly
If patient data is leaked, lost or accessed by the wrong people, you inform the affected patients and the Data Protection Board without delay, and send the Board a detailed report within 72 hours.
- 5
Answer patients who ask about their data
Patients can ask what you hold about them, ask for corrections, and raise a grievance. Publish who they should contact, and answer grievances within a reasonable time, at most 90 days.
- 6
Keep data only as long as you need it
Hold personal data only while it serves its purpose or another law requires it (medical records have their own retention rules), then dispose of it safely.
- 7
Check your vendors
Your hospital software provider, lab, imaging centre or WhatsApp reminder service handles patient data for you. You remain responsible, so their contracts and practices matter too.
- 8
Take extra care with children's data
Children's data has its own rules, including parental consent, with some exceptions for healthcare. A paediatric or maternity unit should check how they apply to it.
Six things to do this month
None of these needs a consultant. Each one makes the rest easier.
- List what patient data you hold, where it sits (paper, hospital software, Excel, WhatsApp) and who can see it.
- Read your registration and consent forms as a patient would. Do they say what you collect and why?
- Name one person patients can contact about their data, and put their details on your notice.
- Write down what you would do in the first 72 hours after a data breach, and who does it.
- Ask your software, lab and messaging vendors how they protect your patients' data.
- Brief your front desk and nursing staff: they collect most of the data and answer most of the questions.
Questions hospitals ask us
We're a small nursing home. Does this apply to us?
Very likely, if you keep patient data digitally: the Act covers organisations of any size that process digital personal data. The government can exempt some classes of organisations from some provisions, so check how it applies to you with your legal adviser.
We're NABH accredited. Aren't we covered already?
Partly. NABH work on medical records and confidentiality helps, but DPDP adds its own documents and processes: the patient notice, consent records, breach reporting to the Board and answering patients' requests. Think of it as the next step after accreditation.
Is 13 May 2027 the only date?
It is when most duties start: the notice and consent rules, security safeguards, breach reporting and patients' rights. A few parts of the Rules started earlier. Check the timelines that apply to you against the official Act and Rules.
Start from drafts, not a blank page
Our DPDP Readiness Toolkit for Healthcare Providers gives you a patient privacy notice, consent forms, a data map, a breach response plan and register, a patient request and grievance process, and a vendor checklist, drafted around how your facility handles patient data.
These toolkits provide templates and guidance to help your team prepare. They are not legal advice, and they do not guarantee compliance, certification, accreditation, or approval for cashless insurance. Have your legal adviser review the drafts before you adopt them. Check the obligations and timelines that apply to you against the official DPDP Act and Rules.
Preparing for NABH Entry Level as well? See the NABH Toolkit