The DPDP Act and Rules 2025: what Indian hospitals need to do, and by when

In short: Hospitals are Data Fiduciaries under the DPDP Act 2023. Most duties, including notice and consent, security, breach reporting, retention and patients' rights, apply from May 2027, eighteen months after the Rules took effect on 13 November 2025.

Every hospital runs on personal data: a name and phone number at registration, a diagnosis in the OPD, results from the laboratory, a policy number at billing. Most of it now lives in software. The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the Digital Personal Data Protection Rules, 2025 set out how that data may be collected, used, kept and protected.

The Rules were published in the Gazette dated 13 November 2025, after a consultation that drew 6,915 inputs (PIB, 2025). The main duties start in 2027. This post explains what the law asks of a hospital, where it meets existing medical-records duties, and what to do first.

This is general information, not legal advice. Take advice on your own hospital’s position.

The timeline

The Act and the Rules come into force in three stages, counted from 13 November 2025:

• Already in force: definitions and the provisions setting up the Data Protection Board and its procedures.
• After one year (November 2026): registration and duties of Consent Managers (Rule 4, section 6(9)).
• After eighteen months (May 2027): everything operational: notice and consent, legitimate uses, security, breach reporting, retention, children’s data, patients’ rights and Significant Data Fiduciaries (Rules 3, 5 to 16, 22 and 23; sections 3 to 17).

Lawyers count these dates slightly differently: AZB & Partners gives 12 November 2026 and 12 May 2027, others the 13th. Plan to the earlier date. In January 2026 MeitY also consulted on cutting the eighteen months to twelve, at least for some organisations (S.S. Rana & Co., 2026). A September 2026 review found no amending notification (MirvoLegal, 2026), but it is worth watching.

Is a hospital a Data Fiduciary?

Yes. A Data Fiduciary is any person who decides the purpose and means of processing personal data (section 2(i)), and “person” includes companies, firms, associations and the State. Private and government hospitals, nursing homes and single-doctor clinics are all covered. The patient is the Data Principal; for a child, that includes the parent or lawful guardian (section 2(j)).

A cloud host or transcription service working on the hospital’s behalf is a Data Processor. The hospital remains responsible for what processors do, may use them only under a valid contract, and must make them erase data when it erases its own (section 8).

The Act covers data collected digitally and paper data that is later digitised (section 3), which in practice reaches most patient records. Health data is not a separate category, but its sensitivity counts: the Board must weigh the type of data affected when setting a penalty (section 33(2)).

Consent and notice

A hospital may process personal data only with consent or for a legitimate use listed in section 7 (section 4).

Consent must be free, specific, informed, unconditional and unambiguous, and limited to the data needed for the stated purpose (section 6(1)). It must come with a notice that, under Rule 3:

• stands on its own, separate from other information;
• gives an itemised description of the data and the specific purposes, in plain language;
• explains how to withdraw consent, exercise rights and complain to the Board.

Patients must be able to read the notice and consent request in English or any language in the Eighth Schedule to the Constitution (sections 5(3), 6(3)). Withdrawing consent must be as easy as giving it, after which processing must stop within a reasonable time unless a law requires otherwise (sections 6(4), 6(6)). In any dispute, the hospital must prove notice and consent were given (section 6(10)), so consent records become evidence. Patients who consented before the Act need a fresh notice as soon as reasonably practicable (section 5(2)).

The legitimate-use exceptions

Section 7 lists situations where consent is not needed. Three matter most to hospitals:

• Medical emergencies. Section 7(f) covers a medical emergency involving “a threat to the life or immediate threat to the health” of the patient or anyone else. It does not cover routine or planned care.
• Public health. Section 7(g) covers treatment and health services during an epidemic, outbreak or other threat to public health.
• Legal duties. Section 7(d) covers disclosures a law requires you to make to the State; section 7(e) covers court orders.

Section 7(a) also allows use of data a person voluntarily provided for a purpose, unless she objects. The Act’s example is a pharmacy texting a receipt. How far that stretches to routine treatment is not settled. Our reading is to rely on it only for what the patient plainly came for.

The exceptions are narrow in time too. King Stubb & Kasiva, a law firm, notes that emergency processing must stay within the emergency; using that data later for marketing needs consent.

Children and guardians

A child is anyone under eighteen (section 2(f)). Normally a fiduciary needs verifiable parental consent before processing a child’s data, and may not track or behaviourally monitor children (sections 9(1), 9(3)). Rule 10 explains how a parent’s identity and age are checked.

The Rules exempt healthcare. Part A of the Fourth Schedule lifts sections 9(1) and 9(3) for clinical establishments, mental health establishments and healthcare professionals, but only for providing health services to the child, to the extent necessary to protect her health. Allied healthcare professionals have a similar exemption for supporting a treatment and referral plan. Marketing and research are not covered, and section 9(2), no processing likely to harm a child’s well-being, still applies.

For adults with a disability, Rule 11 requires the hospital to verify that a guardian was appointed by a court, designated authority or local level committee.

Security safeguards

Rule 6 sets minimum safeguards:

• encryption, masking or tokenisation of personal data;
• access control on systems used by the hospital and its processors;
• logs, monitoring and review to detect and investigate unauthorised access;
• backups, so care can continue if data is lost or locked;
• logs and related data kept for one year, unless another law says otherwise;
• security clauses in processor contracts.

Rule 8(3) separately requires personal data, traffic data and processing logs to be kept for at least one year from processing.

Breach notification

A breach includes unauthorised processing, accidental disclosure or loss of access that compromises confidentiality, integrity or availability (section 2(u)). Ransomware that locks the system counts, even if nothing leaks.

Under Rule 7, the hospital must tell affected patients without delay, in plain language: what happened, likely consequences, what is being done, what they can do, and a contact person. It must tell the Board without delay, then send a detailed report within 72 hours of becoming aware, covering causes, mitigation, who was responsible, prevention and the notices sent to patients. The Board may allow longer on written request. There is no minimum size for a reportable breach.

Retention and medical records

The Act asks for erasure once consent is withdrawn or the purpose is served, unless retention is needed to comply with a law (section 8(7)); erasure requests carry the same exception (section 12(3)). The fixed deletion periods in the Third Schedule apply only to large e-commerce, gaming and social media platforms.

Older medical-records duties still apply:

• The Indian Medical Council ethics regulations of 2002 require indoor patients’ records to be kept for three years from the start of treatment, with copies supplied within 72 hours of a request.
• Where the Clinical Establishments (Central Government) Rules, 2012 apply, establishments must maintain electronic medical or health records of every patient as specified by government (rule 9(iv)).

The Act applies in addition to other laws (section 38(1)), and its erasure duties give way where a law requires retention. A patient cannot make a hospital destroy records it must legally keep. But retention needs a reason. A written schedule linking each record type to its legal basis is the practical answer.

Significant Data Fiduciaries

The government may notify a fiduciary, or a class of them, as Significant, considering factors such as the volume and sensitivity of data (section 10). Large hospital chains and diagnostic networks should not rule this out. These must appoint a Data Protection Officer based in India and an independent auditor, run an impact assessment and audit every twelve months, check their algorithms, and may be required to keep specified data in India (Rule 13).

Penalties

The Board inquires into breaches and can impose penalties up to:

• ₹250 crore for failing to take reasonable security safeguards;
• ₹200 crore for failing to notify a breach;
• ₹200 crore for breaching duties on children’s data;
• ₹150 crore for breaching Significant Data Fiduciary duties;
• ₹50 crore for any other breach.

These are ceilings. The Board must weigh gravity, duration, the data involved, repetition, and how quickly the hospital acted to limit harm (section 33(2)). Patients must use the hospital’s grievance process before going to the Board (section 13(3)), and appeals go to the Telecom Disputes Settlement and Appellate Tribunal.

Consent Managers and ABDM

A Consent Manager is a platform registered with the Board through which people give, manage and withdraw consent (section 2(g)). It must be an Indian company with a net worth of at least ₹2 crore, must not be able to read the data it routes, and must keep consent records for seven years (First Schedule).

Under the Ayushman Bharat Digital Mission, the Health Information Exchange and Consent Manager (HIE-CM) already moves records between providers only after the patient’s consent (PIB, 2025). That consent can cover selected records rather than everything (PIB, 2024), and records stay with the provider that created them (SFLC.in, 2024). In our reading, ABDM consent governs sharing through the ABDM network. It does not replace the hospital’s own DPDP notice and lawful basis for billing, reminders, claims or analytics.

A checklist for the months ahead

1. Name an owner for data protection and publish their contact on your website and app (Rule 9).
2. Map your data: what each department collects, why, where it is stored, who can see it and who receives it.
3. Set a lawful basis for each purpose: consent or a section 7 use. Be strict about emergencies.
4. Rewrite registration notices: itemised, plain, standalone, in English and the Eighth Schedule languages your patients use. Plan notices for existing patients.
5. Keep consent records: which notice version, what was agreed, when, and any withdrawal.
6. Tighten access and logs: role-based access, encryption, and access logs reviewed and kept for a year.
7. Run a breach drill against the 72-hour clock, with templates for the Board and patients.
8. Review contracts with cloud vendors, outsourced labs, TPAs and insurers: decide who is a processor and who is a separate fiduciary, and add security, breach and erasure clauses.
9. Write a retention schedule grounded in the laws that apply to you, with secure erasure.
10. Set up rights and grievances: access, correction, erasure and nomination, with a published response period of no more than ninety days (Rule 14).
11. Check children’s processing against the Fourth Schedule exemption.
12. Train staff at the front desk, wards, MRD, billing and IT.

A closing word

Most of what the Act asks is what good medical-records practice already expects: collect what you need, say why, protect it, keep it as long as the law requires, and report quickly when something goes wrong. The difference is that it will now be enforceable. A data map and a new registration notice this year leave time to do the rest calmly.

Frequently asked questions

Do hospitals need parental consent to treat a child under the DPDP Rules?

Not for treatment itself. The Fourth Schedule to the DPDP Rules, 2025 exempts clinical establishments, mental health establishments and healthcare professionals from the verifiable parental consent and tracking rules, but only where processing is restricted to providing health services to the child, to the extent necessary to protect her health. Other uses, such as marketing, are not covered.

How quickly must a hospital report a personal data breach?

Rule 7 of the DPDP Rules, 2025 requires the hospital to inform affected patients and the Data Protection Board without delay, and to send the Board a detailed report within 72 hours of becoming aware of the breach, unless the Board allows longer on a written request.

Can a patient make a hospital delete medical records under the DPDP Act?

Only where no law requires the records to be kept. Sections 8(7) and 12(3) of the Act let a Data Fiduciary retain personal data where retention is necessary to comply with any law, such as the 2002 medical ethics regulations that require indoor patients' records to be kept for three years.