DPDP Act for Healthcare: A Compliance Guide for Hospitals, Labs and Health Apps

Who this is for: compliance heads, DPOs, CISOs and legal teams at hospitals, clinic chains, diagnostic labs, pharmacies, telemedicine platforms and health apps.

Healthcare runs on some of the most personal information there is: diagnoses, test results, prescriptions, mental health notes, insurance details and identity documents. It also runs under pressure. Clinicians cannot pause treatment for paperwork, systems are often old and interconnected, and hospitals have become prime ransomware targets, as the 2022 attack on AIIMS Delhi showed.

The DPDP Act recognises some of these realities, with legitimate uses for emergencies and a targeted exemption for treating children. But it also raises the bar on how health data is explained, shared, kept and protected. This guide covers what changes for healthcare organisations. For the general law, see The DPDP Act, Explained.

Health data under the DPDP Act

Unlike earlier drafts of India's data protection law, and unlike the GDPR, the DPDP Act has no separate category of sensitive personal data. Health data is personal data like any other, with the same baseline rules.

That does not make it low-risk. Sensitivity matters in three ways:

• Penalties: under Section 33(2), the Board must consider the type and nature of the personal data affected when setting a penalty.
• Significant Data Fiduciary designation: Section 10 lists the sensitivity of data as a factor, making large hospital chains and health platforms likely candidates.
• Security: the Rule 6 safeguards must be "reasonable" for the data involved, and for health data, reasonable means strong.

The lawful basis for patient data

Most routine healthcare processing does not depend on consent in the narrow sense:

The key discipline is purpose limitation. Data provided for treatment can be used for treatment. It cannot quietly become marketing data. Any new purpose needs its own basis, and in most cases that means consent that meets the Section 6 standard.

Minor patients: a narrow exemption

Section 9 normally requires verifiable parental consent before processing a child's data, and bans tracking, behavioural monitoring and targeted advertising directed at children. For healthcare, Rule 12 and Part A of the Fourth Schedule provide an exemption:

• Who: clinical establishments, mental health establishments and healthcare professionals, with a related exemption for allied healthcare professionals
• What: processing restricted to providing health services to the child, to the extent necessary to protect her health

The exemption is purpose-bound. A paediatric ward treating a child does not need verifiable parental consent for that treatment. The same hospital sending birthday offers to that child, or running analytics on its paediatric patients for marketing, gets no exemption. Health apps and wellness platforms that are not clinical establishments or healthcare professionals may not qualify at all.

For patients with disabilities who have a lawful guardian, Rule 11 sets out how verifiable consent from the guardian must be obtained, where consent is the basis.

Notices patients can understand

Where consent is requested, Section 5 and Rule 3 require an itemised, standalone notice in clear language, available in English or any Eighth Schedule language. For legitimate-use processing, a clear notice of the purpose is still what makes Section 7(a) work, because it defines what "the specified purpose" was.

For healthcare, that means notices at registration, on patient portals and in apps that say plainly what data is collected, for which purposes, who receives it (labs, insurers, TPAs, referral doctors) and how patients can exercise their rights. Our guide to writing a DPDP privacy notice includes a template.

Medical records retention

Section 8(7) requires erasure when the purpose ends, unless retention is necessary to comply with a law. Medical records are subject to several retention rules outside the DPDP Act, including professional regulations for doctors, state clinical establishments rules and specific laws for certain procedures. Medico-legal case records are typically kept longer.

Build a retention schedule that maps each record type to its governing law and period, keeps clinical records as long as required, and erases what no law requires you to keep: unconverted enquiries, old marketing lists, call recordings and app analytics. Rule 8 also requires logs to be kept for at least one year.

Tracking pixels and health apps

One of the most underestimated risks in healthcare is the website. Analytics and advertising tags on appointment booking, symptom checker, test results or department pages can transmit health-related information, together with identifiers, to third-party platforms.

Under the DPDP Act, this processing needs consent, and you are responsible for it under Section 8(1). Remove advertising and session-recording tags from sensitive pages, gate analytics behind a DPDP-compliant cookie banner, and audit your tag manager regularly.

Health and wellness apps face the same issue through SDKs. Every analytics, advertising and attribution SDK in your app is a processor you are responsible for.

Research and analytics

Section 17(2)(b) exempts processing for research, archiving or statistical purposes from most obligations, provided the data is not used to take any decision specific to an individual and the standards in the Rules are followed. This is helpful for clinical research and public health analysis, but it is conditional. It does not cover commercial analytics, product development for third parties or the sale of patient data. Anonymise wherever possible.

Vendors and ABDM integration

Healthcare relies on vendors: hospital information systems, lab information systems, PACS, cloud hosting, telemedicine platforms, billing, TPAs and medical transcription. Each processor needs a valid contract with the Rule 6 safeguards and fast breach notification. See our guide to vendor risk under DPDP.

Organisations integrated with the Ayushman Bharat Digital Mission already work with consent-managed health information exchange. That is a useful foundation, but the DPDP Act applies in addition. Your own notices, purposes, retention and rights handling must meet the Act independently.

Security and breach response

Hospitals combine high-value data with legacy systems, many users and round-the-clock operations, a combination attackers exploit. Rule 6 requires encryption or masking, access controls, monitoring, backups and log retention. In clinical settings, role-based access matters most: staff should see the records their role requires, and access to records should be logged and reviewed.

When a breach happens, the DPDP Act requires notice to every affected patient and the Data Protection Board without delay, and a detailed report within 72 hours, alongside CERT-In's 6-hour reporting for specified incidents. A ransomware attack that encrypts patient records is a personal data breach even if nothing is stolen, because loss of access compromises availability. Our 72-hour response plan and Rule 7 playbook cover each step.

Significant Data Fiduciaries

Large hospital chains, diagnostic networks, health platforms and insurers process high volumes of sensitive data, exactly the factors Section 10 uses. Designated SDFs must appoint a DPO based in India, an independent data auditor, and conduct an annual DPIA and audit (Rule 13). Prepare as if designation is likely.

Healthcare DPDP checklist

Common mistakes in healthcare

• Treating all patient data as "consented". Treatment data and marketing data have different bases. Do not mix them.
• Reading the child exemption broadly. It covers health services only.
• Ignoring the website. Tracking pixels on appointment pages are a common, avoidable exposure.
• Keeping everything forever. Retention laws cover specific records, not every enquiry and recording.
• Shared logins in clinical areas. They make access logs, and breach investigations, meaningless.

How ConsentifyAI helps healthcare organisations

ConsentifyAI helps hospitals, labs and health platforms separate what patients provide for care from what needs consent. Purposes are defined once in the ROPA module with their lawful basis and retention law. Patient notices are versioned and multilingual. Consent for marketing and partner sharing is captured per purpose, and the cookie module keeps tracking off sensitive pages until patients agree. Every action is recorded in a tamper-evident audit trail.