DPDP for clinics and hospitals

Last checked 22 Oct 2026 · Draft. Awaiting counsel review.

A clinic or hospital that keeps patient details in digital form, including paper records later typed into a computer or phone, is covered by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (s.3), and nearly every duty applies to it from 13 May 2027. The duties that weigh most are a parent's verified consent for a child's data (s.9(1), Rule 10), reasonable security safeguards (s.8(5), Rule 6(1)), breach intimations with the detailed report to the Data Protection Board within 72 hours (s.8(6), Rule 7(2)(b)), and requests to see, correct or erase data, received at the front desk (s.11, s.12(2), s.12(3)).

Which duties weigh most for a clinic or hospital?

• Children's data. A child is anyone under 18 (s.2(f)). Before using a child's personal data, the clinic or hospital needs the consent of a parent who is checked to be an identifiable adult (s.9(1), Rule 10). Some uses are exempt, for example a clinic giving health care to the child, and an exemption covers that use only (Rule 12, Fourth Schedule). Penalty up to ₹200 crore (s.33, Schedule item 3).
• Patients who act through a guardian. For an adult with a disability who acts through a lawful guardian, the guardian's consent comes first, after checking that the guardian was appointed by a court, by a designated authority under the Rights of Persons with Disabilities Act 2016, or by a local level committee under the National Trust Act 1999 (s.9(1), Rule 11).
• Security safeguards. Encryption, masking or tokenisation; control over who can open the computers, phones and apps that hold patient data; access logs, reviewed; backups; and logs and data kept for one year to investigate problems, unless another law says otherwise (s.8(5), Rule 6(1), Rule 6(1)(e)). This is the highest penalty band in the Act: up to ₹250 crore (s.33, Schedule item 1).
• Breaches. Every personal data breach, with no size threshold: each affected person and the Board told without delay (Rule 7(1), Rule 7(2)(a)), and the detailed report to the Board within 72 hours of becoming aware of the breach (Rule 7(2)(b)). Penalty up to ₹200 crore (s.33, Schedule item 2).
• Requests at the front desk. A patient can ask to see a summary of the data held (s.11), have it corrected (s.12(2)) or erased (s.12(3)), or name a nominee (s.14). Erasure leaves data a law requires the clinic or hospital to keep. Grievances are answered within the period the clinic or hospital publishes, at most 90 days (Rule 14(3)).
• Vendors. Billing software, cloud storage, a payment gateway or a WhatsApp Business provider that handles patient details is a vendor: the clinic or hospital stays responsible for it and needs a valid contract with reasonable security safeguards (s.8(1), s.8(2), Rule 6(1)(f)).

When do the duties start?

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early, until counsel confirms, and shows each duty as a recommended step until its start date.

What does Fohrkast do for a clinic or hospital?

• Front-desk staff log requests made at the counter, by phone, WhatsApp, SMS, email or letter. Identity is checked before any reply, and a request about a child also needs a parent (s.9(1), Rule 10). Fohrkast drafts each reply in English or Hindi; the clinic or hospital sends it.
• A clinic without a website uses a hosted consent and request page, opened by a short link or a QR poster.
• Fohrkast drafts the notice from the purposes and the data map; the clinic or hospital checks and publishes it, in English or a language of the Eighth Schedule (s.5(1), s.5(3), Rule 3). Consent is recorded per purpose, and withdrawal is as easy as giving it (s.6(4)).
• The incident desk records the time the business became aware of a breach, never pre-filled, and drafts the notice to each affected person (Rule 7(1)), the first intimation to the Board (Rule 7(2)(a)) and the detailed report due within 72 hours (Rule 7(2)(b)).
• A record of each vendor that processes personal data for the business (s.8(2)); for each erasure, the vendors asked to erase and their answers, and a deletion certificate (s.8(7)).
• A scanner that runs in the clinic's or hospital's own environment with a read-only login and sends Fohrkast labels and counts only, never personal data values or database credentials. It is tested on Microsoft SQL Server, Oracle Database, PostgreSQL and MySQL, among others.
• Every step is written to a hash-chained record (SHA-256) with times in IST, and the evidence pack can be exported on every plan.

What does Fohrkast not do?

• Give legal advice.
• File or send on a business's behalf. The clinic or hospital decides and sends every notice and report.
• Hold more personal data than a duty needs.
• Claim a security certification. Fohrkast holds none yet.

The clinic or hospital remains the Data Fiduciary, responsible for its duties (s.8(1)).

Which plan usually fits?

A clinic with one site and a few systems usually fits Professional: up to 50,000 people on record, 3 connected data sources and 5 seats. A hospital above any Professional limit moves to the lowest plan whose limits cover every figure, usually Business: up to 3 legal entities, 15 connected data sources and 10,00,000 people on record. Prices are before GST at 18% and billed yearly in advance, in INR. The rights desk, the grievance desk and the incident desk are on every plan and are never limited by plan or by non-payment. Full terms: fohrkast.com/pricing.

Questions and answers

Does the DPDP Act apply to a small clinic?

Yes, where the clinic keeps or uses patient details in digital form, including paper records later typed into a computer or phone (s.3). Nearly every duty applies from 13 May 2027, and the penalties start the same day.

Does a clinic need a parent's consent to use a child's data?

Yes, before using a child's personal data, a parent's verified consent is needed (s.9(1), Rule 10); a child is anyone under 18 (s.2(f)). Some uses are exempt, for example a clinic giving health care to the child, and the exemption covers that use only (Rule 12, Fourth Schedule).

What must a hospital do after a data breach?

Tell each affected person and the Data Protection Board without delay (Rule 7(1), Rule 7(2)(a)), then send the Board a detailed report within 72 hours of becoming aware of the breach, or a longer period the Board allows on a written request (Rule 7(2)(b)). The duty covers every breach, with no size threshold. The CERT-In report within 6 hours (CERT-In Directions, 28 April 2022) is a separate duty; Fohrkast shows it for reference and does not track it.

How long does a hospital have to answer an access or erasure request?

Rule 14(3) caps the grievance period at 90 days, and the PIB explainer of 17 Nov 2025 applies 90 days to access, correction and erasure requests; Fohrkast dates them 90 days from receipt, a reading pending counsel. For an erasure, each vendor holding the data is also asked to erase it (s.8(7)).

Which Fohrkast plan fits a clinic, and which a hospital?

Professional, ₹9,999 a month billed yearly with GST extra, fits one business with a few systems: up to 3 connected data sources and 5 seats. A hospital above any Professional limit usually needs Business, ₹49,999 a month billed yearly with GST extra, for up to 3 legal entities and 15 data sources.

Sources

• Digital Personal Data Protection Act, 2023 (22 of 2023): MeitY copy. Read 21 Oct 2026.
• G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: MeitY copy. Read 21 Oct 2026.
• G.S.R. 843(E), commencement of the Act, 13 Nov 2025: MeitY copy. Read 21 Oct 2026.
• S.O. 5458(E), DPDP (Removal of Difficulties) Order 2026: e-Gazette copy. Read 21 Oct 2026.
• PIB explainer, DPDP Rules 2025 Notified, 17 Nov 2025: PDF. Read 21 Oct 2026.
• Fohrkast rulebook in.dpdp version 1: published duties.

Related duties in the published rulebook: a parent's verified consent, a lawful guardian's consent, security safeguards, the 72-hour report, access requests, vendor contracts.

Not legal advice. Legal statements on this page are awaiting counsel review.