DPDP readiness

Ready for the DPDP Act before May 2027

The main duties of the Digital Personal Data Protection Act start eighteen months after the Rules were notified. Most of them land on the registration desk, the medical records department and the hospital's software.

Book a demo DPDP readiness checklist

General information, not legal advice. Take advice on your own hospital's position.

What the law asks of a hospital, and by when

The DPDP Rules were notified on 13 November 2025. Consent Manager provisions apply after one year; notice, consent, security, breach reporting, retention and patients' rights apply after eighteen months — May 2027. [2][3][4]
A hospital is a Data Fiduciary. Consent must come with a standalone, itemised notice, withdrawing must be as easy as agreeing, and in a dispute the hospital must prove notice and consent were given. [1][2]
Rule 6 sets minimum safeguards: encryption, masking or tokenisation; access control; logs and monitoring to detect unauthorised access; backups; and logs kept for a year. [2]
After a breach, the hospital must tell affected patients and the Data Protection Board without delay, and send the Board a detailed report within 72 hours of becoming aware. [2]
Penalties go up to ₹250 crore for failing to take reasonable security safeguards and ₹200 crore for failing to notify a breach. [1]
Erasure gives way where a law requires records to be kept — such as the three years the 2002 medical ethics regulations set for indoor patients' records. [1][5]

What MedBrains does about it

Consent, purpose by purpose

Patients agree purpose by purpose — ABDM linking, insurance claims, reminders, research — recorded with the notice version, language and where it was given. A withdrawal is a new entry, so the history stays.

Channel consent for messages

WhatsApp and email updates go only to patients who agreed to that channel, and they can withdraw in the patient app.

Who saw what

An append-only audit log of changes, an access log for each patient's record, break-glass reviews and alerts on unusual access.

Access by role, walled by hospital

Role-based permissions, row-level security that keeps each hospital's data to itself, and sensitive fields masked or withheld by class.

A breach register with the clocks

Record when a breach was discovered and track the Board's 72-hour report, the notices to each affected patient and the CERT-In six-hour report.

Patients' rights requests

Access, correction, erasure, nomination and grievance requests tracked against a 90-day window; patients can raise them and export their record from the patient portal.

Retention and processors

Retention periods per record type in the medical records department, and a register of the processors that handle your data.

Your servers, if you prefer

Install on the hospital's own servers so patient data stays in the building, or let us host it.

Software helps you keep the records the law asks for; it does not make a hospital compliant — your notices, policies and contracts do. Records past their retention date are flagged for a supervised destruction step rather than deleted automatically, and an approved erasure request is carried out by staff.

Free download · no sign-up

DPDP readiness checklist

Thirty-three items, each citing the section or rule it comes from — notice, consent, security, breaches, retention, rights and vendors. Fits two A4 pages.

Download PDF Open the printable page

Questions

When do the main duties apply?

Eighteen months after the Rules were notified on 13 November 2025 — May 2027. Lawyers count the date slightly differently; plan to 12 May 2027.

Can a patient make us delete medical records?

Only where no law requires them to be kept. The Act lets a hospital retain data needed to comply with a law, such as the three-year rule for indoor patients' records.

Do we need parental consent to treat a child?

Not for treatment. The Fourth Schedule to the Rules exempts clinical establishments and healthcare professionals, for providing health services to the child. Marketing is not covered.

Does ABDM consent cover the DPDP Act?

In our reading, no. ABDM consent governs sharing through the ABDM network; the hospital still needs its own notice and lawful basis for billing, reminders, claims and analytics.

Sources

Checked 22 October 2026. Rules change — check the source before you act on any figure here.

Book a demo

See it run on your departments.

Tell us about your hospital. We'll walk through the screens your teams would use — with your workflows, not a slideshow.

A 30-minute walkthrough, online or at your hospital
Your departments, your tariff, your forms
A clear plan and price for going live

Rather talk now? WhatsApp us or write to hello@medbrains.in.