DPDP for hospitals

A hospital that keeps personal data in digital form is covered by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (s.3). Typical work: Admissions and outpatients, medical records, child patients, insurers and labs.

Where personal data sits

Reception and admission desk
Hospital software (patient records and billing)
Reports received from labs
Staff phones used for appointments

What Fohrkast maps

Patient name
Mobile number
Date of birth or age
Address
Medical history, prescriptions and reports
Details of child patients and their parents
ID numbers collected for identity checks
Bills and payment details
Staff names, phone numbers and salary records

Each use of the data is recorded as a purpose:

Admission and care. Register the patient, keep the medical record and share reports with the patient.
Bills and insurance claims. Make the bill, record the payment and send the claim to the insurer.
Appointment reminders. Send appointment and follow up reminders by SMS.

Which duties weigh most

Children's data. A child is anyone under 18 (s.2(f)). Before using a child's personal data, a parent's verified consent is needed (s.9(1), Rule 10). Penalty up to ₹200 crore (s.33, Schedule item 3).
People who act through a guardian. For an adult with a disability who acts through a lawful guardian, the guardian's consent comes first, after checking the appointment (s.9(1), Rule 11).
Decisions and sharing. Data used to make a decision about a person, or shared with another Data Fiduciary, must be complete, accurate and consistent (s.8(3)).
Security safeguards. Encryption or masking, control over who opens the systems that hold personal data, access logs, backups, and logs kept for one year (s.8(5), Rule 6(1)). Penalty up to ₹250 crore (s.33, Schedule item 1).
Breaches. Every personal data breach, with no size threshold: each affected person and the Board told without delay, and the detailed report to the Board within 72 hours (Rule 7). Penalty up to ₹200 crore (s.33, Schedule item 2).
Requests. A person can ask to see a summary of the data held (s.11), have it corrected or erased (s.12), raise a grievance (s.13) or name a nominee (s.14).
Vendors. A vendor that handles personal data for the business needs a valid contract with reasonable security safeguards; the business stays responsible (s.8(1), s.8(2)).

Sector rules

The sector regulator's rules for a hospital: not set.

A short case

Case: not set. Figures: not set. Customers: not set.

When do the duties start?

Date	What starts	Gazette reference
13 Nov 2026	Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4).	G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3)
13 May 2027	Nearly every duty on businesses, and the Board's penalties.	G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4)

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.

Privacy Check: a look at the website's notices, trackers and forms.
Plans and prices in INR.
Book a demo.

Not legal advice.