DPDP Act checklist for hospitals (free PDF)

Ownership and data map

Name an owner for data protection and publish their contact on the website and patient appRule 9
Map each department's data: what is collected, why, where it is stored, who sees it and who receives itGood practice
Set a lawful basis for each purpose — consent, or a legitimate use under section 7s 4, s 7
Rely on the emergency exception only for a threat to life or an immediate threat to healths 7(f)

Registration notice stands on its own, itemises the data and purposes in plain languageRule 3
Notice says how to withdraw consent, exercise rights and complain to the BoardRule 3
Notice and consent available in English and the Eighth Schedule languages your patients uses 5(3), 6(3)
Plan a fresh notice for patients who consented before the Acts 5(2)
Withdrawing is as easy as agreeing, and processing stops after withdrawals 6(4), 6(6)
Keep consent records: notice version, what was agreed, when, and any withdrawals 6(10)

Children's data used only to provide health services, within the Fourth Schedule exemptions 9, Sch. 4
Verifiable parental consent for anything else, such as marketings 9(1), Rule 10
Guardians of adults with a disability verified as court- or authority-appointedRule 11

A written breach procedure that treats loss of access (e.g. ransomware) as a breachs 2(u)
Inform affected patients and the Data Protection Board without delayRule 7
Detailed report to the Board within 72 hours of becoming awareRule 7
Templates for the Board and for patients, and a drill run against the 72-hour clockRule 7

List processors (cloud host, transcription, outsourced labs) and hold a valid contract with eachs 8(2)
Contracts carry security, breach and erasure clausess 8, Rule 6
Decide whether each TPA and insurer is your processor or a separate fiduciarys 2(i), 2(k)

A retention schedule linking each record type to the law that requires its 8(7), 12(3)
Indoor patients' records kept at least three years (IMC Regulations, 2002)IMC 1.3.1
Secure erasure once the purpose is served and no law requires the records 8(7)

Large chains and diagnostic networks: assess whether you may be notified as a Significant Data Fiduciarys 10, Rule 13
Train front desk, ward, MRD, billing and IT staffGood practice