Hospitals, clinics, labs and health-tech platforms are Data Fiduciaries under the DPDP Act and must comply by 13 May 2027. Health data has no separate 'sensitive' category, but its volume and sensitivity can lead the government to notify large providers as Significant Data Fiduciaries. Key duties: a clear notice at registration, consent or a legitimate use (medical emergencies are one), strong security, 72-hour breach reporting, and parental consent for under-18 patients outside the Fourth Schedule exemption for clinical establishments.
- Deadline
- 13 May 2027
- Emergency treatment
- Legitimate use, no consent needed
- Children (clinical care)
- Fourth Schedule exemption
- Likely SDF?
- Large chains and platforms
Where hospitals and healthcare face the most DPDP risk
| Area | What to do |
|---|---|
| Patient registration and records | Notice at the front desk and in the app; consent for anything beyond treatment (e.g. marketing health packages) |
| Lab reports on WhatsApp and email | Encryption or secure links, correct recipient checks, breach plan for misdirected reports |
| Insurance and TPA sharing | Share only what the claim needs; contracts with TPAs and insurers as fiduciaries or processors |
| Health-tech apps and wearables | Purpose-specific consent; no reuse of health data for ads; children's data rules |
| CCTV in wards and reception | Notice signage, access control, short retention |
Other rules that apply alongside the DPDP Act
- Telemedicine Practice Guidelines, 2020 and NMC rules on confidentiality
- Ayushman Bharat Digital Mission (ABDM) Health Data Management Policy, for ABHA-linked records
- Clinical Establishments Act and state rules on keeping medical records
Where another law sets a stricter or longer requirement, follow both: the DPDP Act does not override sector rules on retention or storage.
Six steps to comply
- Map patient data from registration to discharge, including labs, pharmacy, billing and insurance.
- Put a short notice at registration (paper forms count once digitised) and in the app.
- Separate treatment use from marketing; add an unticked opt-in for health camps and offers.
- Lock down report sharing: secure links, access logs kept for at least a year.
- Write a breach plan covering ransomware, the most common hospital incident.
- Set retention: keep medical records as medical and state rules require, delete enquiry data sooner.
Most DPDPA duties apply from 13 May 2027, with penalties up to ₹250 crore per breach. See the DPDPA 2027 roadmap and the DPDP compliance checklist.
Want it done for you? Our DPDP compliance service covers data mapping, notices, consent, vendor contracts, breach plans and staff training for hospitals, clinics, diagnostic labs and health-tech platforms.
Frequently asked questions
Does the DPDP Act apply to hospitals and clinics?
Yes. Any hospital, clinic, lab or health-tech platform that processes patients' personal data digitally is a Data Fiduciary and must comply by 13 May 2027.
Do hospitals need consent to treat patients' data in an emergency?
No. Section 7 allows processing without consent to respond to a medical emergency involving a threat to life or health, and for treatment during an epidemic or disaster.
Is health data 'sensitive personal data' under the DPDP Act?
The Act has no separate sensitive category. All personal data gets the same protection, but the sensitivity of health data is a factor in notifying Significant Data Fiduciaries and in setting penalties.
DPDP guides for other industries
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- DPDP compliance cost in India
- DPDP compliance for edtech, schools and coaching
- DPDP compliance for fintech, nbfcs and lending apps
- DPDP compliance for e-commerce and d2c brands
- DPDP compliance for hr, staffing and recruitment firms
- DPDP compliance for real estate developers and brokers
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.