Sec. 5, 6(1)
Consent at the point of care
Consent taken at admission has to cover the purposes it is later relied on for — treatment, insurance claim, research, marketing — and be separable. A single admission-form tick cannot carry all of them.
DPDP for healthcare and hospital groups
Health data attracts the closest scrutiny under the Act, and hospital estates are unusually fragmented — HIS, LIS, PACS, pharmacy, insurance desk and teleconsultation platforms each hold a copy of the same patient.
- Deadline
- 13 May 2027
- Pressure points
- 4 identified
- Controls
- 5 products
- Max penalty
- ₹250 Cr, per instance
Already regulated by
- MoHFW
- NHA / ABDM
- NMC
- CDSCO
- CERT-In
DPDP sits alongside these rather than replacing them. Where a sectoral rule requires retention and the Act requires erasure, both are satisfiable — but only where the basis is recorded per attribute.
Where the pressure lands
What DPDP actually changes for healthcare
The Act applies uniformly. The obligations that bite first do not — these are the ones this sector fails on.
Sec. 8(4)–(5)
ABHA and health-record access
Linking records to a health ID broadens who can reach them. Access control has to be continuous rather than login-only, because shared clinical credentials are the most common route to unauthorised processing.
Sec. 9
Children's data and guardian consent
Paediatric records require verifiable guardian consent, and the ban on behavioural advertising directed at children reaches any downstream marketing use of that data.
Sec. 8(7)
Erasure against clinical retention
Clinical records carry statutory retention; the marketing and analytics copies of the same patient do not. Erasure has to distinguish them, which requires knowing every copy exists.
What closes them
The controls, in the order they land
Discovery first, because every other obligation is undeliverable without a catalogue. Everything after that consumes what it built.
- 01
Consent Management
Collect and honor consent everywhere
Sec. 5, 6, 9
- 02
Intelligent Data Mapper
Find and map personal data automatically
Sec. 8(3), 8(7)
- 03
Data Anonymization & Masking
Keep data usable for analytics, testing and support while the individual behind it stops being exposed.
Sec. 8(4), 8(5)
- 04
DSAR Management
Fulfill data subject requests on time
Sec. 11–14
- 05
Data Breach Management
From detection to defensible intimation and closure — a structured workflow that beats the regulatory clock.
Sec. 8(6)
Sequence
A readiness plan that buys down the biggest exposure first
The same four phases apply in every sector; what changes is which systems go first.
Phase 1
Weeks 1–6
See the estate
- Deploy Discovery across priority systems
- Build the identity-resolved catalogue
- Reconcile collected data against notice
Phase 2
Weeks 4–12
Stop the bleeding
- Mask non-production and analytics estates
- Deploy breach detection and playbooks
- Wire intimation to the catalogue
Phase 3
Weeks 8–18
Fix the basis
- Roll out purpose-level consent and notice
- Enforce withdrawal parity and cessation
- Turn on children's age-band gating
Phase 4
Weeks 14–26
Prove it
- Automate DSAR intake and fulfilment
- Run DPIA cadence for SDF duties
- Open the auditor workspace
Also defending healthcare?
Provider authentication and telemedicine session integrity, closing the gap between who claims to be on the call and who actually is.
DPDP for other sectors
Find the gaps in your healthcare programme
A readiness walkthrough maps what you already run onto the eighteen obligations, and names what is missing with the exposure attached.