DPDP Act for Hospitals: A Practical Data Security Checklist

The DPDP Act changes how hospitals must think about patient data. Hospitals hold some of the most personal information anyone shares: diagnoses, test results, mental health notes, insurance details, Aadhaar and phone numbers. Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules notified in November 2025, a hospital is a data fiduciary responsible for how that data is collected, used, protected and deleted.

The obligations are being phased in. The Rules give organisations a transition period, with most core duties for data fiduciaries applying around 18 months after notification, which places them in 2027. That sounds like time, but changing consent flows, access controls and vendor contracts across a hospital takes most of it.

This guide explains what the DPDP Act means for hospitals in practice and gives you a hospital data security checklist you can start on now. It is not legal advice; involve your legal adviser for your specific situation.

The DPDP Act in plain terms for hospitals

The Act applies to digital personal data, and to personal data collected on paper and later digitised. For a hospital, that covers almost everything: registration details, EMR notes, lab results, images, bills, CCTV footage, and staff records too.

Key roles:

• Data principal: the patient, or the parent or guardian of a child, or a staff member whose data you hold
• Data fiduciary: the hospital, which decides why and how data is processed
• Data processor: vendors processing data on the hospital's behalf, such as your HMS provider, cloud host, lab partner or WhatsApp service
• Data Protection Board of India: the body that handles complaints and breaches and can impose penalties

The Act does not create a separate "sensitive health data" category, but the security obligations scale with the harm a breach can cause. Health data breaches cause serious harm, so expect to be held to a high standard. Penalties for failing to take reasonable security safeguards can go up to ₹250 crore per instance.

Consent and notice: what changes at the front desk

Processing personal data generally needs consent that is free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. Consent must be preceded by a notice explaining what data is collected, why, and how the patient can exercise their rights or complain. The notice must be in clear and plain language, and the patient can ask for it in English or any language in the Eighth Schedule of the Constitution, which in Kerala means Malayalam should be ready.

The Act also allows certain "legitimate uses" without consent, including responding to a medical emergency involving a threat to life or health, and providing treatment during an epidemic or disaster. Emergency care should never wait for a consent form.

For routine care, practical changes include:

1. A clear privacy notice at registration, on paper and on screen, in English and Malayalam
2. Separate consent for purposes beyond treatment, such as marketing messages, research or sharing with partner pharmacies
3. Recording in the HMS which consents a patient gave, when and through which channel
4. A simple way to withdraw consent, as easy as giving it
5. Updated scripts for front desk staff so they can explain the notice in a sentence

Do not bundle everything into one long form. A marketing opt-in hidden inside a treatment consent is exactly what the Act is designed to stop. Our post on WhatsApp automation for hospitals and clinics covers how to keep reminders and promotions on the right side of consent.

Children and guardians

For children under 18, the Act requires verifiable consent from a parent or lawful guardian. The DPDP Rules provide exemptions for clinical establishments and healthcare professionals, to the extent processing is necessary for providing health services. That helps hospitals, but it does not cover everything: marketing to parents, research use and app-based profiles for children still need care.

Your registration flow should capture the guardian relationship for minors and record who gave consent for non-treatment purposes.

Role-based access: who can see what

Most hospital data leaks are not dramatic hacks. They are staff looking at records they have no reason to see, shared logins, or a report emailed to the wrong person. Role-based access control is the single most effective defence.

Design permissions by role, not by individual. Add "break the glass" access for emergencies, where a clinician can open any record but must give a reason and the access is reviewed. Review access quarterly and remove leavers on their last day.

Audit logs and monitoring

The DPDP Rules expect reasonable security safeguards, including measures to detect unauthorised access, such as logs and monitoring, and they require relevant logs to be retained for at least a year. In a hospital system, that means logging who viewed, created, edited, printed or exported each record, with the time and terminal.

Logs are only useful if someone looks at them. Practical monitoring includes:

• Alerts on bulk exports or unusually high record views by one user
• Flags on access to VIP, staff or celebrity patient records
• Monthly review of break-the-glass access with reasons
• Reports of failed login attempts and logins at unusual hours

The same audit trail also supports NABH's expectations on record integrity, covered in our post on NABH compliant hospital management software.

Breach notification: have the plan before you need it

If a personal data breach happens, the DPDP Rules require the hospital to inform each affected data principal without delay, explaining what happened, the likely consequences, what the hospital is doing and what the person can do. The Data Protection Board must also be told without delay, followed by a detailed report within 72 hours, unless the Board allows more time. Separately, CERT-In directions require many cyber incidents to be reported to CERT-In within six hours.

A breach response plan for a hospital should include:

1. Who decides that an incident is a breach, and who is called first
2. How to contain it: disable accounts, isolate systems, change credentials
3. Who drafts patient and Board notifications, in which languages
4. How to keep the hospital running if systems are taken offline
5. How evidence and logs are preserved for investigation
6. A post-incident review and fixes

Rehearse it once a year with a tabletop exercise. The first time you read the plan should not be during a ransomware attack.

Backups, encryption and continuity

Security safeguards in the Rules include encryption or similar measures, access control, logging, and measures for continued processing such as backups. For hospitals, ransomware is the most realistic large-scale threat, and backups are the main defence.

Minimum practice:

• Encrypt data in transit and at rest, including backups and laptops
• Keep at least one backup copy offline or immutable, so ransomware cannot encrypt it
• Test restores regularly and measure how long a full restore takes
• Patch servers and workstations, and remove unsupported operating systems
• Use multi-factor authentication for remote access and admin accounts

Whether your system runs in the cloud or on premise changes who does what, but not what must be done. Our DevOps in healthcare team builds these controls into hosting from day one.

Vendors, retention and patient rights

Your HMS provider, cloud host, lab partner, telemedicine platform and messaging provider are data processors. Under the Act, the hospital must engage them under a valid contract and remains responsible for their handling of data. Contracts should cover security standards, breach notification to the hospital, sub-processors, data location and return or deletion of data at the end of the contract.

Patients have rights to access information about their data, seek correction and erasure, nominate someone to act for them, and have grievances addressed. Erasure has limits in healthcare: hospitals must keep medical records for periods required by other laws and regulations, and the Act allows retention where law requires it. Define retention periods by record type, and delete or anonymise what you no longer need, such as old marketing lists and CCTV footage.

Large hospitals and groups may be notified as Significant Data Fiduciaries, which brings extra duties such as a Data Protection Officer based in India, periodic data protection impact assessments and audits.

A hospital data security checklist

Use this as a starting point with your management, IT and legal teams:

• Map what personal data you hold, where, and which vendors touch it
• Publish a clear privacy notice in English and Malayalam
• Separate treatment consent from marketing and research consent, and record each
• Implement role-based access with break-the-glass and quarterly reviews
• Eliminate shared logins on clinical and billing systems
• Enable audit logs on clinical records and retain them for at least a year
• Write and rehearse a breach response plan, including Board and CERT-In timelines
• Encrypt data and keep offline or immutable backups, with tested restores
• Update vendor contracts with data processing terms
• Appoint a named person for grievances and data protection queries

Conclusion

The DPDP Act asks hospitals to treat patient data with the same discipline they apply to patient safety: clear consent, need-to-know access, a trail of who did what, a rehearsed plan for when things go wrong, and backups that actually restore. Much of this lives in your software, so it is worth checking now whether your hospital system can support it.

Algon builds consent capture, role-based access and audit trails into the hospital management system projects and healthcare software development work we do. If you want a practical review of your current setup, contact us.