DPDP Act for Hospitals, Diagnostics and IVF Clinics
The DPDP Act gives health data no special label, yet hospitals, laboratories and fertility clinics face its hardest questions: when consent is needed, how long records must be kept, and who answers for a vendor's breach.
- CATEGORY
- Article · Healthcare
- POSITION AS OF
- October 2026
- READING TIME
- 8 min read
- TAGS
- Healthcare, Diagnostics, IVF and ART, Data retention, DPDP Act
Introduction
A diagnostic chain sees thousands of patients a day. Each visit generates a name, a phone number, a prescription, a sample, a result and, often, a WhatsApp message with the report. A fertility clinic holds even more sensitive material: the medical histories of commissioning couples, the identities of gamete donors, and embryo records that outlive the treatment by years.
India's Digital Personal Data Protection Act, 2023 (the DPDP Act) applies to all of it. Unlike Europe's GDPR, the Act does not create a special category for health data. Every item of digital personal data is treated the same way. That sounds simpler, but for healthcare it pushes the hard questions into three places: the legal basis for each use, the interaction with sector laws that require records to be kept, and the conduct of the vendors that handle patient data.
Most of the Act's obligations, and Rules 3, 5 to 16, 22 and 23 of the DPDP Rules, 2025, commence on 13 May 2027, eighteen months after the Rules were notified on 13 November 2025.
The legal position
Who is responsible. The Act calls the hospital, laboratory or clinic that decides why and how patient data is used a data fiduciary. The patient is the data principal. A vendor that handles data on the provider's instructions, such as a laboratory information system or a sample-collection partner, is a data processor. Under section 8(1) the data fiduciary remains responsible for compliance even when a processor does the work, and under section 8(2) it may engage a processor only under a valid contract.
Grounds for processing. Section 4 allows processing on two grounds: consent, or one of the "certain legitimate uses" in section 7. For healthcare, the key legitimate uses are section 7(f), responding to a medical emergency involving a threat to life or an immediate threat to health, and section 7(g), providing medical treatment or health services during an epidemic, an outbreak of disease or another threat to public health. Section 7(a) covers data a person voluntarily provides for a specified purpose, where they have not indicated that they do not consent to that use.
Routine treatment is not on that list. For an ordinary out-patient visit or a lab test, the realistic grounds are consent, or section 7(a) where the patient walks in and hands over details for a stated purpose. Marketing, follow-up campaigns and research reuse sit outside both and need consent of their own.
Children. Section 9 requires verifiable parental consent before processing a child's data (anyone under 18) and bars tracking, behavioural monitoring and targeted advertising directed at children. The Fourth Schedule to the Rules exempts clinical establishments, mental health establishments, healthcare professionals and allied healthcare professionals from the parental-consent and monitoring rules, but only for providing health services to the child, to the extent necessary to protect the child's health. A paediatric clinic treating a child is covered. The same clinic's newsletter to parents about vaccination packages is not.
Security and breaches. Section 8(5) requires reasonable security safeguards. Rule 6 sets the minimum: encryption, masking or tokenisation; access controls; logs and monitoring; backups and continuity; and contracts that make processors adopt safeguards. Logs and related personal data must be kept for at least one year. If a breach occurs, Rule 7 requires notice to each affected patient and to the Board without delay, followed by a detailed report to the Board within 72 hours.
Erasure. Section 8(7) requires erasure once consent is withdrawn or the purpose is no longer served, whichever is earlier, "unless retention is necessary for compliance with any law for the time being in force". That exception is where healthcare differs most from other sectors.
Penalties. The Schedule to the Act sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for failing to notify a breach and for breaching the children's provisions, and up to ₹50 crore for other breaches.
The transition. Until section 44(2) commences in May 2027, section 43A of the Information Technology Act, 2000 and the SPDI Rules, 2011 continue to apply.
Analysis
Retention: the law already decides most of it
Section 8(7) does not override the record-keeping duties in health legislation. It defers to them. The practical task is to map each record type to the law that fixes its retention, and to delete what is not covered once the purpose ends.
| Record | Law | Minimum period |
|---|---|---|
| In-patient records | Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, reg. 1.3.1 | 3 years |
| Pre-natal diagnostic records | PCPNDT Act, 1994, s.29 | 2 years (longer if proceedings are pending) |
| ART clinic and bank records | ART (Regulation) Act, 2021, s.23(c) | At least 10 years, then transferred to the National Registry |
| Surrogacy records | Surrogacy (Regulation) Act, 2021, s.46 | 25 years |
| Ethics committee records for a clinical trial | New Drugs and Clinical Trials Rules, 2019, rule 13 | 5 years after the trial ends |
| Security logs | DPDP Rules, 2025, Rule 6 | 1 year |
Two cautions. The 2002 Regulations still govern doctors because the National Medical Commission's 2023 replacement regulations were placed in abeyance in August 2023, and we found no later change. And the Telemedicine Practice Guidelines, 2020 require records to be kept "for the period as prescribed from time to time" without fixing a figure, so teleconsultation platforms should apply the general medical record rules.
Data outside these categories, such as marketing lists, abandoned bookings and app analytics, has no statutory shelter. It must be deleted once its purpose ends.
IVF and ART clinics: three sets of data principals
A fertility clinic serves several people whose interests diverge: the commissioning couple or woman, the gamete donor, and eventually the child. The ART Act already demands written informed consent (section 22), confidentiality of information about all of them (section 21(e)), and ten-year record retention with transfer to the National Registry (section 23).
The DPDP Act sits on top of this. Section 38(1) says it applies in addition to other laws, and section 38(2) says it prevails in a conflict. In practice, conflicts are rarer than they look. A commissioning couple's right of access under section 11 covers their own personal data. It does not extend to the donor's identity, which is the donor's personal data and protected by the ART Act. The clinic's duty is to keep the two sets of records logically separate, so that answering one person's request never exposes another's.
Disclosures to the National Registry are made under a legal obligation and do not need fresh consent. They should still appear in the clinic's records of who data is shared with.
Vendors are where breaches happen
Diagnostic businesses depend on processors: phlebotomy partners who visit homes, courier firms, cloud-hosted laboratory systems and messaging providers that deliver reports. Each holds personal data on the provider's behalf. The DPDP Act makes the provider answerable for each of them.
That has two consequences. Contracts must require the safeguards in Rule 6 and prompt notice of incidents, because the provider's own clock for notifying patients and the Board starts when it becomes aware of the breach. And on erasure, section 8(7)(b) obliges the provider to make its processor erase the data too, so retention schedules must be written into vendor contracts.
Research reuse
Section 17(2)(b) exempts processing for research, archiving or statistics if the data is not used to take decisions about specific individuals and the processing follows the standards in the Second Schedule to the Rules. That is narrower than it looks. A hospital that pools records to train a commercial triage tool is not doing exempt research if the tool will be used on patients. Clinical trials also bring their own regime under the New Drugs and Clinical Trials Rules, 2019 and the ICMR National Ethical Guidelines.
Practical implications
A worked example. A regional diagnostics chain with 40 collection centres and a home-collection app makes four changes:
- It splits consent. Test processing and report delivery are tied to the patient's request. Health-package promotions get a separate, optional consent with its own withdrawal button.
- It maps retention. Ultrasound records under PCPNDT are kept for two years. Lab reports follow its medical-record policy. Marketing data is deleted after twelve months of inactivity.
- It rewrites vendor contracts. The phlebotomy and messaging partners must notify incidents within hours, keep logs for a year and certify deletion at contract end.
- It runs a breach drill. The drill tests whether patient notices and the Board's 72-hour report can be produced from the systems it actually has.
The same steps apply to hospitals, with more record types, and to IVF clinics, with stricter separation between patient and donor files.
| Area | Action | Legal basis |
|---|---|---|
| Grounds | Record the ground for each use: consent, s.7(a), or emergency under s.7(f) or (g) | DPDP Act ss.4, 6, 7 |
| Notice | Itemise data and purposes in plain language | Rule 3 |
| Children | Apply the Fourth Schedule exemption only to treatment | s.9; Rule 12 |
| Retention | Map records to sector laws; delete the rest | s.8(7) |
| Vendors | Contract for safeguards, incident notice and deletion | ss.8(1), 8(2); Rule 6 |
| Breaches | Prepare patient notices and the 72-hour Board report | s.8(6); Rule 7 |
| Contact | Publish a contact person for data queries | s.8(9); Rule 9 |
Conclusion
The DPDP Act treats health data like any other personal data, but healthcare providers carry heavier practical duties. Sector laws decide most retention periods, vendors carry most breach risk, and the treatment exemptions are narrower than many assume. Providers who map their records and contracts now will meet the May 2027 deadline with time to spare.
Key takeaways
- Routine treatment usually rests on consent or on data the patient volunteers for a stated purpose (s.7(a)); only emergencies and public-health threats have their own legitimate use.
- Erasure under s.8(7) gives way to sector retention laws such as the PCPNDT Act (2 years), the ART Act (10 years) and the IMC Regulations (3 years).
- The Fourth Schedule frees healthcare providers from parental-consent and monitoring rules only for treating the child.
- Providers are answerable for vendors such as sample collectors and messaging providers, and must contract for safeguards, incident notice and deletion.
- IVF clinics must keep donor and patient records separate so that one person's access request never reveals another's data.
Sources
Primary sources, accessed 9 October 2026.
- Digital Personal Data Protection Act, 2023 (MeitY copy of Gazette). (opens in a new tab)
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E). (opens in a new tab)
- Assisted Reproductive Technology (Regulation) Act, 2021 (India Code record; text via PRS). (opens in a new tab)
- Surrogacy (Regulation) Act, 2021 (India Code). (opens in a new tab)
- Pre-Conception and Pre-Natal Diagnostic Techniques Act, 1994 (Government of Puducherry copy). (opens in a new tab)
- Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 (Delhi Medical Council copy). (opens in a new tab)
- NMC notification placing the 2023 RMP Regulations in abeyance, 23 August 2023. (opens in a new tab)
- Telemedicine Practice Guidelines, 25 March 2020. (opens in a new tab)
- New Drugs and Clinical Trials Rules, 2019, G.S.R. 227(E) (CDSCO). (opens in a new tab)
- ICMR National Ethical Guidelines for Biomedical and Health Research, 2017. (opens in a new tab)
This piece is general information, not legal advice.
Anonymisation and Pseudonymisation Under the DPDP Act
The DPDP Act never mentions anonymisation, so whether a dataset escapes it turns on one word in section 2(t), 'identifiable', and on who could do the identifying.
SDKs, Pixels and Trackers: Who Is Responsible Under the DPDP Act?
Every SDK in an app sends data to someone, and the DPDP Act holds the app answerable for what its code collects while making a vendor that uses the data for itself answerable too.
DPDP Act vs Singapore's PDPA: Taking Your Programme Into Asia
An Indian company with a DPDP programme already has most of what Singapore's PDPA asks for, but breach triage, transfers back to India, a DPO and Do Not Call checks are new work.