DPDP Act 2023: What Every Hospital Must Do Before May 2027

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive data protection legislation. Passed in August 2023, it establishes clear rights for individuals over their personal data and clear obligations for organisations that process it.

For hospitals, this is not an IT issue. It is a governance issue. Every hospital processes personal data: patient health records, staff information, vendor contacts, billing data. Under the DPDP Act, this processing now comes with legal obligations and financial exposure.

The Ministry of Electronics and Information Technology (MeitY) has released draft rules and is moving toward full enforcement. Understanding the timeline is the first step.

Timeline That Matters

August 2023 — DPDP Act passed by Parliament.

November 2025 — Rules finalized. Key obligations around consent, privacy notices, and data principal rights become legally operative.

November 2026 — Consent manager framework becomes effective. Organisations using third-party processors must ensure consent is tracked through registered consent managers.

May 2027 — Full enforcement begins. The Data Protection Board (DPB) of India becomes fully operational. Investigations, fines, and public disclosures begin.

Hospitals that wait for 2027 to start will find themselves scrambling. The compliance infrastructure — consent records, privacy notices, data deletion workflows, breach notification procedures — takes months to build correctly.

What Hospitals Must Do

1. Consent Management

The DPDP Act requires explicit, informed, specific consent before processing personal data. For hospitals, this means:

• A clear consent form for each processing purpose (treatment, billing, research, marketing)
• A mechanism for patients and staff to withdraw consent at any time
• Consent records that can be produced on demand

2. Privacy Notices

Every individual whose data you process must receive a privacy notice in plain language (English and at least one scheduled language they understand) explaining:

• What data you collect
• Why you collect it
• How long you retain it
• Who you share it with
• How they can exercise their rights

3. Data Principal Rights

Hospitals must build workflows for:

• Right to access: Respond to data requests within the prescribed timeline
• Right to correction: Update or correct inaccurate personal data
• Right to erasure: Delete personal data when consent is withdrawn or the processing purpose ends (with lawful retention exceptions for medical records)
• Right to grievance redressal: A designated Grievance Officer and a functional complaint mechanism

4. Breach Notification

Any personal data breach must be reported to the Data Protection Board within 72 hours of discovery. Affected data principals must also be notified without undue delay.

This is one of the most demanding obligations. Hospitals must have:

• An incident detection capability (logs, monitoring, alerts)
• A breach response procedure with assigned roles
• Template notifications pre-approved by legal counsel
• A breach register maintained internally

5. Security Safeguards

The Act requires "reasonable security safeguards" — which the Rules interpret as technical and organisational measures appropriate to the sensitivity of the data. For hospitals processing health data (which is "sensitive" under the Act), this means:

• Encryption at rest and in transit
• Access controls and role-based permissions
• Audit logs for all data access
• Regular security assessments

6. Data Fiduciaries and Processors

If your hospital uses third-party software vendors, cloud services, or outsourced IT — and almost every hospital does — those vendors who process personal data on your behalf are "data processors." Your contracts with them must include specific DPDP-compliant data processing clauses.

The Penalties

The DPDP Act establishes a penalty schedule enforced by the Data Protection Board:

These are per-violation maximums. The DPB considers factors including the severity of the breach, the number of affected individuals, and whether the organisation acted in good faith. But the exposure is real and material for any hospital.

A Practical Compliance Checklist

Use this as your starting point. Each item needs an owner and a completion date.

1. [ ] Appoint a Grievance Officer — Named individual, contact details published on hospital website

2. [ ] Map your data flows — What personal data do you collect, from whom, for what purpose, stored where, shared with whom?

3. [ ] Update consent forms — All intake forms, employment forms, and vendor agreements must include DPDP-compliant consent language

4. [ ] Draft privacy notices — Separate notices for patients, staff, and vendors; in English and local language

5. [ ] Build a data deletion workflow — Ability to locate and delete individual's data across all systems when consent is withdrawn

6. [ ] Write a breach response procedure — Who is notified internally, timeline for DPB notification, template for data principal notification

7. [ ] Audit your vendor contracts — Add data processing clauses to all third-party service agreements

8. [ ] Implement access logging — All access to personal data should be logged with user ID, timestamp, and action

9. [ ] Train your team — All staff handling personal data must understand their obligations under the Act

10. [ ] Schedule annual review — DPDP compliance is not a one-time project; schedule quarterly reviews and an annual full audit

How Procurement Software Helps

Hospital procurement systems sit at an interesting intersection of the DPDP Act. They process:

• Supplier contact details (personal data of vendor staff)
• Staff approval records (who approved what, when)
• Delivery confirmation records (storekeeper identity, timestamps)

A DPDP-compliant procurement platform provides:

Audit trails — Every action logged with user identity and timestamp. When the DPB asks who approved a purchase order, you have a complete record.

Data deletion APIs — When a supplier contact or staff member leaves and requests data deletion, the system can anonymise their records while preserving the business transaction records required by other laws (GST, Companies Act).

Role-based access — Personal data is visible only to users who need it for their processing purpose. A storekeeper doesn't see supplier financial data; a supplier doesn't see internal approval notes.

Consent gates — Staff onboarding workflows that capture explicit consent before data is entered into the system.

Procurement systems that were built with DPDP compliance in mind reduce your overall data exposure. Systems that weren't — including many Excel-based workflows — create exactly the uncontrolled, unaudited data flows that the Act is designed to eliminate.

The May 2027 deadline is closer than it appears. Start the data mapping exercise this month.