Hospital
DPDP Readiness Infrastructure for Hospitals and Clinical Establishments
When the Data Protection Board, or your own clinical governance review, asks how patient data is governed, the answer must be documented and verifiable. Medical record rules require specific patient records to be kept for fixed periods: three years for inpatient records under the IMC Regulations 2002, five years for clinical trial records. The DPDP Act gives patients the right to erasure from 13 May 2027. Your hospital records each retention mandate that applies to its records in the conflict-of-law register. The Legal Obligation Override then flags erasure requests against the recorded mandate and logs each refusal in a denial register.
- DPDP obligations on Data Fiduciaries take effect
- 13 May 2027
- Inpatient record retention, IMC Regulations 2002, Regulation 1.3.1
- 3 years
- Maximum penalty under the DPDP Act
- 250 Cr
Governance Readiness
A hospital needs a documented position on patient data before the Act's obligations take effect on 13 May 2027. The answer "we are still assessing our obligations" is not a defensible position for a clinical governance committee. ConsentOS gives your committee a printable readiness report and a documented position for a Data Protection Board inquiry.
Obligations
Your DPDP Obligations as a Hospital Company
The DPDP Act 2023 imposes specific requirements based on how your organisation processes personal data. These are the obligations most relevant to hospital operations.
Ref 01
Medical Record Retention Against Erasure
The IMC Regulations 2002, Regulation 1.3.1, require inpatient records to be kept for three years from the commencement of treatment. Clinical trial records carry five years under the NDCT Rules 2019. PCPNDT records carry two years, or until legal proceedings are disposed of. The Legal Obligation Override flags each erasure request against the mandate your hospital has recorded and logs the refusal in a denial register. The Health Data Management Policy under ABDM sets no retention period and is no basis for refusal.
Ref 02
Patient Consent for Data Processing
ABDM-integrated hospitals create digital health records that are personal data under the DPDP Act. Treatment, diagnosis, prescription, and surgical records each require purpose-specific consent chains. Bundled admission consent does not satisfy Section 6 of the Act.
Ref 03
Health Data Purpose Limitation
Patient data collected for treatment cannot be repurposed for clinical research, insurance underwriting, pharmaceutical partnerships, or health analytics without fresh, purpose-specific consent under Section 5.
Ref 04
Third-Party Processor Governance
Diagnostic laboratories, radiology centres, pharmacies, insurance TPAs, and ambulance operators all handle patient personal data. A party that processes it on behalf of the hospital is a Data Processor, and Section 8(2) requires a valid contract with it. A party that decides its own purpose and means is a Data Fiduciary in its own right.
Ref 05
Minor and Guardian Consent
Paediatric health records, maternal data, and records of minor patients require parental or guardian consent under Section 9. Age verification and guardian consent workflows are required before any data processing.
Ref 06
Breach Notification
From 13 May 2027, Rule 7 requires intimation of a patient data breach to the Data Protection Board and to affected patients without delay, then a detailed report to the Board within 72 hours. CERT-In incident reporting runs in parallel on its six-hour clock, which applies today.
Ref 07
ABDM Integration Compliance
Integration with the Ayushman Bharat Digital Mission creates cross-system data sharing obligations. ABDM health ID linkage, digital health record access, and PHR processing each carry independent DPDP consent obligations that must be documented separately.
Timeline
Your Compliance Roadmap
Key milestones between now and 13 May 2027, when the Act's obligations on Data Fiduciaries take effect.
Now
Build your readiness position
Map all patient data processing across admissions, treatment, diagnostics, pharmacy, and discharge. Document your DPDP posture before the Act's obligations take effect on 13 May 2027.
Q4 2026
Implement Legal Obligation Override
Deploy the Compliance Vault: record each statutory retention mandate in the register and open the denial register.
Nov 2026
Rule 4 applies
From 13 November 2026, registration with the Data Protection Board is mandatory for entities that operate as Consent Managers. A Data Fiduciary is not required to register, or to route consent through one.
Q1 2027
Patient rights workflows
Implement patient data access, correction, and erasure workflows, with each refusal tied to the retention mandate that requires it.
May 2027
Obligations and penalties take effect
The maximum penalty, 250 crore, is for failing to take reasonable security safeguards under Section 8(5).
Penalty Exposure for Hospital Companies
Section 33 of the DPDP Act prescribes penalties based on violation type. Each amount is the ceiling for that category of breach.
Recommended Plan
Compliance Vault for Hospital
Hospitals holding records under statutory retention mandates need the Legal Obligation Override and the denial register, which only the Compliance Vault tier provides. The retention schedule dashboard is on the roadmap for H2 2026.
₹5,00,000 one-time
- Legal Obligation Override (RBI / PMLA)
- Retention schedule dashboard, per data category (Roadmap: H2 2026)
- Denial register for statutory erasure exceptions
- DPBI-ready audit evidence packs
- 72-hour breach notification pipeline (Roadmap: H2 2026)
- Dedicated compliance support manager
Resources
Essential Reading for Hospital
The DPDP provisions that bear most on your sector, in detail.
HealthTech DPDP Compliance: ABDM and Health Data Rules in India
How the DPDP Act 2023 applies to health data processing, ABDM interoperability, telemedicine platforms, and clinical trial consent requirements in India.
10 min read
Compliance AreasDPDP Breach Notification Timeline: 72-Hour Rule (India 2026)
Miss the 72-hour window and the exposure is ₹200 crore under Section 8(6). The Board deadline, the 6-hour CERT-In rule, and the reporting steps, mapped.
9 min read
Data Principal RightsDPDP Act 2023: The Data Principal Rights with Templates (India)
Access, correction, erasure, grievance, and nominee rights under the DPDP Act 2023: the response deadlines a Data Fiduciary must meet, with ready-to-use request templates.
7 min read
FAQ
Hospital compliance, answered.
Can a hospital refuse a DPDP erasure request for patient medical records?
Yes, for records that a law requires to be kept, and for as long as that law requires. The IMC Regulations 2002, Regulation 1.3.1, require inpatient records to be kept for three years from the commencement of treatment. Section 8(7) of the DPDP Act preserves retention that is necessary for compliance with a law in force. The Health Data Management Policy under ABDM sets no retention period and is not a statute, so it is no basis for refusal. ConsentOS logs each refusal in a denial register with the mandate it rests on.
Does ABDM integration create independent DPDP obligations?
Yes. ABDM health ID linkage events, digital health record creation, and PHR access by healthcare providers are personal data processing activities under the DPDP Act. ABDM integration does not substitute for DPDP consent compliance. Each processing event must be traceable to a specific, purpose-limited consent record.
How does hospital data sharing with insurance companies work under DPDP?
An insurer that decides why and how it uses claims data is a Data Fiduciary in its own right, with its own obligations under the DPDP Act. The hospital records the basis on which it shares patient data for a claim and keeps a record of the disclosure. Purpose limitation applies. Claims data cannot be used for underwriting future policies without fresh consent.
Are diagnostic laboratory partners data processors under DPDP?
It depends on who decides the purpose and means. A laboratory that processes patient data on behalf of the hospital is a Data Processor, and Section 8(2) requires a valid contract with it. A laboratory that takes its own referrals and decides how it uses the data is a Data Fiduciary in its own right.
Medical record rules set the retention period. Document the basis before the erasure request.
The free DPDP Gap Assessment takes less than ten minutes. You receive a scored compliance report with a prioritised action list.