HealthTech
DPDP Readiness Infrastructure for HealthTech Companies
When NHA onboarding review or investor due diligence reviews your patient data governance posture, your answer must be documented. HealthTech companies processing health records operate under the DPDP Act and, inside the ABDM ecosystem, under the Health Data Management Policy and its consent framework. Diagnostic records, prescriptions, and patient identifiers require explicit consent with granular purpose specification. ABDM-integrated platforms face additional cross-system consent and data-sharing obligations that generic compliance platforms do not address.
- DPDP obligations on Data Fiduciaries take effect
- 13 May 2027
- Penalty ceiling for failing to notify a breach, Section 8(6)
- 200 Cr
- Maximum penalty under the DPDP Act
- 250 Cr
ABDM Compliance Readiness
An ABDM-integrated platform needs a documented position on patient data before the Act's obligations take effect on 13 May 2027. The answer "we are working on our compliance posture" is not a defensible position for a funded HealthTech company. ConsentOS builds the documented readiness position your reviewers and your investors can verify.
Obligations
Your DPDP Obligations as a HealthTech Company
The DPDP Act 2023 imposes specific requirements based on how your organisation processes personal data. These are the obligations most relevant to healthtech operations.
Ref 01
Explicit Health Data Consent
Section 6 requires informed consent for each processing purpose. Health data used for diagnosis, treatment, research, and insurance claims each require separate consent records.
Ref 02
Breach Notification
Section 8 mandates breach notification to the Board and affected individuals. Health data breaches carry severe reputational damage and potential class-action liability.
Ref 03
Data Principal Rights
Patients have the right to access, correct, and erase their health records under Sections 11-14. Medical record retention requirements must be reconciled with erasure requests.
Ref 04
Purpose Limitation
Health data collected for diagnosis cannot be repurposed for marketing, research, or insurance without fresh consent. Section 5 imposes strict purpose boundaries.
Ref 05
Security Safeguards
Section 8 requires reasonable security measures proportional to data sensitivity. Health data demands encryption, access controls, and audit trails exceeding baseline requirements.
Ref 06
Cross-border Transfers
ABDM integration and international telemedicine platforms may transfer health data across borders. The DPDP Act permits transfers outside India unless the Central Government restricts a country by notification under Section 16(1). Record each transfer and watch for notifications.
Ref 07
Medical Record Retention
The Health Data Management Policy under ABDM sets no retention period. Its clause 26.6 limits storage to the period the purpose needs. Retention duties come from medical record law, such as three years for inpatient records under the IMC Regulations 2002, Regulation 1.3.1. A platform that keeps a record longer needs a legal basis it can name when the patient asks for erasure.
Timeline
Your Compliance Roadmap
Key milestones between now and 13 May 2027, when the Act's obligations on Data Fiduciaries take effect.
Now
Build your NHA/ABDM compliance readiness position
Map all patient data processing across EHR systems, telemedicine, diagnostics, and billing. Document your DPDP posture and your ABDM consent position before your next onboarding review or investor due diligence.
Q3 2026
Consent framework deployment
Implement purpose-specific consent for diagnosis, treatment, research, and administrative processing.
Nov 2026
Rule 4 applies
From 13 November 2026, registration with the Data Protection Board is mandatory for entities that operate as Consent Managers. A Data Fiduciary is not required to register, or to route consent through one.
Q1 2027
Rights fulfilment workflows
Deploy patient data access, correction, and erasure systems with medical retention exemptions.
May 2027
Obligations and penalties take effect
The maximum penalty, 250 crore, is for failing to take reasonable security safeguards under Section 8(5).
Penalty Exposure for HealthTech Companies
Section 33 of the DPDP Act prescribes penalties based on violation type. Each amount is the ceiling for that category of breach.
Recommended Plan
Growth for HealthTech
Growth covers up to 500K patient records. Health data is where a thin consent record fails first, so the tier tracks consent per purpose with a complete audit trail.
₹1,25,000 one-time
- Up to 500K data principals
- Consent capture via API and dashboard, HMAC-signed
- Rights Management Portal
- Breach Incident Register
- Priority email support
Resources
Essential Reading for HealthTech
The DPDP provisions that bear most on your sector, in detail.
DPDP Breach Notification Timeline: 72-Hour Rule (India 2026)
Miss the 72-hour window and the exposure is ₹200 crore under Section 8(6). The Board deadline, the 6-hour CERT-In rule, and the reporting steps, mapped.
9 min read
Data Principal RightsDPDP Act 2023: The Data Principal Rights with Templates (India)
Access, correction, erasure, grievance, and nominee rights under the DPDP Act 2023: the response deadlines a Data Fiduciary must meet, with ready-to-use request templates.
7 min read
Implementation GuidesDPDP Compliance Checklist: 43 Controls for Indian Businesses (2026)
Audit your DPDP Act 2023 posture against 43 controls, then sequence remediation toward the 13 November 2026 and 13 May 2027 commencement dates.
10 min read
FAQ
HealthTech compliance, answered.
Is health data treated differently under the DPDP Act?
The DPDP Act does not create a separate category for health data. Section 10 lets the Central Government notify a Data Fiduciary as a Significant Data Fiduciary, having regard to factors that include the volume and sensitivity of the personal data it processes. No entity had been notified as of September 2026. A company processing health data at scale should build to the Section 10 standard so that preparation does not start on the day of a notification.
How does ABDM integration affect DPDP compliance?
ABDM creates digital health records that are personal data under the DPDP Act. Integration with ABDM does not exempt you from consent, rights fulfilment, or breach notification obligations.
Can patients request deletion of their health records?
Yes, under Section 12. However, medical record retention requirements under other laws may provide a legal basis exception. You must document this basis and inform the patient of the retention reason.
When the Data Protection Board Asks, Have the Answer Ready
The free DPDP Gap Assessment takes less than ten minutes. You receive a scored compliance report with a prioritised action list.