DPDP for Clinics, Hospitals and Health Apps
How India's DPDP Act applies to clinics, hospitals and health apps handling sensitive patient data, consent, records retention and vendor risk.
Clinics, hospitals, diagnostic labs, and health apps handle some of the most sensitive personal data that exists, patient histories, diagnoses, prescriptions, and test results, which makes DPDP compliance a genuine operational priority, not a paperwork exercise.
Key facts at a glance
- DPDP applies to any entity processing personal data digitally in India, including small clinics, diagnostic labs, and health apps, not just large hospital chains.
- Full substantive DPDP obligations, including notice and consent, become enforceable 13 May 2027, with no stated grace period.
- Penalties for inadequate security safeguards can reach up to Rs 250 crore per instance.
- Health data is widely treated as sensitive in practice, warranting stronger safeguards even though DPDP does not carve out a separate statutory category for it.
- Medical record-keeping requirements from health regulators can require longer retention than DPDP's default purpose-based erasure rule.
- The Consent Manager registration framework under DPDP Rules 2025 becomes operational 13 November 2026.
Why healthcare data carries extra weight under DPDP
DPDP applies a single consent-and-notice framework across all personal data rather than a separate tier of rules exclusively for health information. But the practical risk profile of health data is higher than most other categories: a leaked patient diagnosis, prescription history, or mental health record can cause real reputational, social, or even employment harm to the individual involved. Regulators and courts are likely to view lapses involving health data as more serious in effect, even under a single general framework, because the potential harm from a breach is greater.
This means clinics, hospitals, and health apps should treat "reasonable security safeguards" as a materially higher bar than a generic retail business would, given what is at stake if patient data is exposed.
Where healthcare providers collect and share personal data
Registration and appointment booking
Patient name, contact details, and sometimes preliminary symptom information are collected at booking, often through third-party appointment or clinic-management software.
Consultation and treatment records
Diagnoses, prescriptions, lab results, and treatment notes are the core sensitive data a clinic or hospital holds, typically stored in an electronic health record (EHR) system or, for smaller clinics, a practice-management tool.
Billing and insurance
Billing data often needs to be shared with insurers or third-party administrators for claims processing, which is a distinct sharing event requiring its own basis and, generally, patient awareness.
Health apps and wearables
Apps that track symptoms, medication, fitness, or menstrual and reproductive health collect ongoing, often continuous personal data, and frequently rely on cloud infrastructure and analytics vendors that also need to be brought into the compliance picture.
Key vendor relationships in healthcare
| Vendor type | Data typically shared | Key DPDP consideration |
|---|---|---|
| EHR or practice-management software | Full patient medical records | Access controls, encryption, audit logging |
| Diagnostic lab partners | Test orders and results | Data used only for the specific test requested |
| Insurance/TPA for claims | Billing and diagnosis-linked claims data | Sharing basis documented, scope limited to claim |
| Cloud hosting provider | All digitised patient data | Security certifications, data residency clarity |
| Health app analytics/marketing tools | Usage, symptom, and behavioural data | Clear separation from core medical record data |
Building a practical compliance approach
Start by mapping exactly which systems hold patient data end to end, from booking software through EHR to billing and insurance sharing. Confirm that consent language used at registration or in an app's onboarding flow clearly describes what data is collected and how it may be shared, particularly with insurers or third-party labs. Review contracts with EHR, cloud, and diagnostic vendors for security and breach-notification commitments. Finally, align your retention schedule with both DPDP's purpose-based principle and any longer retention periods required by medical record-keeping norms, so the more stringent requirement governs.
If you are not sure where your clinic, hospital, or health app stands on DPDP compliance, ComplianceCheck's DPDP assessment gives you a clear picture in a few minutes.
Sources
- Ministry of Electronics and Information Technology - meity.gov.in
- Data Protection Board of India (as constituted under DPDP) - meity.gov.in
- Ministry of Health and Family Welfare - mohfw.gov.in
This guide is general information, not legal advice. Requirements vary by state, sector and headcount - confirm specifics with a compliance professional or the relevant authority.
Frequently Asked Questions
- Does DPDP treat health data differently from other personal data?
- The Digital Personal Data Protection Act 2023 does not create a separate statutory category with extra rules purely for health data the way some other countries' laws do, but health information is widely treated as sensitive in practice and warrants stronger safeguards given the harm a leak could cause.
- Do small clinics need to worry about DPDP or is it only for large hospital chains?
- DPDP applies to any entity processing personal data digitally in India, so a small clinic using digital appointment booking, billing software, or patient record systems falls within its scope just as a large hospital chain does.
- Can a health app share patient data with insurance companies without consent?
- Sharing patient data with a third party such as an insurer generally requires a valid basis, most commonly the patient's consent obtained with clear notice of that specific use, rather than being bundled into a general terms-of-use acceptance.
- When do DPDP's notice and consent obligations become enforceable for healthcare providers?
- Full substantive DPDP obligations, including notice and consent requirements, become enforceable on 13 May 2027, with no stated grace period after that date.
- How long should a clinic or hospital retain patient records under DPDP?
- DPDP's default principle is to erase data once its purpose is served, but healthcare-specific and medical council record-keeping requirements often mandate longer retention, and those requirements take precedence for that data.
- What is the penalty risk if a health app suffers a data breach?
- Penalties for failing to implement reasonable security safeguards can reach up to Rs 250 crore per instance, and the sensitivity of health data makes robust safeguards especially important to demonstrate if an incident occurs.
Check your status
DPDP Gap Assessment
A 45-question gap assessment for the Digital Personal Data Protection (DPDP) Act 2023, scoring data-protection maturity across 6 phases.