Healthcare providers hold some of the most sensitive personal data there is. With the DPDP Rules now operational, hospitals, clinics, diagnostic laboratories and fertility centres have a defined window to bring consent practices, vendor contracts and incident-response procedures into line. This note sets out what the Rules require and a practical order of work.

01 — Who this applies to

Any establishment that decides the purpose and means of processing patient data is a data fiduciary under the framework. That includes stand-alone clinics and single-doctor practices, not only hospital chains. Third-party laboratories, billing vendors and hospital-information-system providers will typically be data processors, and must be bound by written contract.

02 — What changes

Four obligations carry the most operational weight for providers:

  • Notice and consent. Consent must be specific, informed and capable of withdrawal, and notices must be available in the languages listed in the Eighth Schedule.
  • Breach notification. Personal data breaches must be reported to the Data Protection Board and to affected patients within the prescribed timelines, irrespective of scale.
  • Children’s data. Verifiable parental consent applies to paediatric records, with limited exemptions for treatment.
  • Retention. Data must be erased once the purpose is served, subject to record-retention periods under clinical-establishment and medical-council rules.

03 — Compliance checklist

  1. Map every category of patient data you hold and where it sits, including with vendors.
  2. Re-paper vendor contracts with processor clauses, security obligations and breach-assistance duties.
  3. Redesign registration and consent forms; add a withdrawal route.
  4. Appoint a grievance contact and publish the details on the website and at reception.
  5. Write and rehearse a breach-response plan with named decision-makers.

04 — How we can help

Our Healthcare Hotline Desk handles DPDP readiness reviews, contract re-papering and breach response for hospitals, clinics and ART centres. Get in touch or email the desk at hotline@mgco.legal.

This update is for general information only and is not legal advice. It reflects the position as at the date of publication.

← All insights Share by email ↗