DPDP Compliance for Hospitals

Published on 10/18/2026 • Updated on 10/22/2026

A hospital holds some of the most private data there is: diagnoses, test results, prescriptions, insurance details and the names of families waiting in corridors. It also runs a busy front desk, a visitor pass desk, pharmacies, labs and cameras. The Digital Personal Data Protection Act, 2023 applies to all of it that is digital or later digitised.

This guide explains what the Act and the DPDP Rules, 2025 mean for a hospital, the exemption the Fourth Schedule gives clinical establishments for children's data, how to handle visitor and patient records, and a checklist for administrators. It is general information, not legal advice. Confirm your approach with your legal adviser.

The hospital as Data Fiduciary

A hospital decides why and how patient data is processed, so it is a Data Fiduciary. Doctors, labs, pharmacies and billing teams act inside that responsibility. Outside labs, insurance administrators and software vendors may be processors, and the hospital must have contract terms with them, as Rule 6 expects.

The Act has no separate sensitive-data tier, but a health record leak does the most harm to a person, and the security duty is judged by reasonable safeguards. The highest penalty in the Schedule, up to Rs 250 crore, applies to a failure to take them.

The Fourth Schedule and children's data

Section 9 asks for verifiable parental consent before processing a child's data. Rule 12 and the Fourth Schedule exempt specified classes. A clinical establishment, mental health establishment or healthcare professional is exempt, with the condition that processing is restricted to providing health services to the child, to the extent necessary to protect the child's health. Allied healthcare professionals have a similar exemption for supporting a treatment and referral plan.

The condition is narrow. Using a child's data for marketing, for a research publication or for an unrelated service falls outside it. Ask your adviser how the wording applies to each of your uses.

Where patient data sits

Start with a list. Each row needs an owner who knows what is kept, who can see it and when it is deleted. Rule 8 sets a minimum one-year retention of data and logs for some specified purposes, so check which records are covered before you delete anything.

Visitors, attendants and the front desk

Hospitals have more visitors than most sites, and many are anxious. A paper register at the entrance often shows the patient's name and room next to the visitor's name and phone number. Anyone can read it.

• Record only what you need: visitor name, phone, patient or ward and time.
• Do not show other visitors' entries on screen or on paper.
• Give passes with the ward and the time limit, not the patient's name.
• Show a short notice at the entry, as Rule 3 expects.
• Keep ICU and maternity visits on a stricter list.
• Delete visitor records after a fixed period.

A visitor pass with the patient's name printed on it can disclose a diagnosis. Print the ward and bed instead.

CCTV in a hospital

Cameras at entrances, corridors and parking support safety. Cameras in treatment rooms, wards and washrooms need very careful thought, and washrooms and changing rooms should never have them. Put up signs, restrict access to footage and set a retention period. Our guide on DPDP and CCTV sets out the points.

Preparing for an incident

A lost file, a misdirected report or ransomware on the record system is a possible personal data breach. Rule 7 requires intimation to affected persons without delay and to the Board without delay, with details within 72 hours. Name a decision maker for incidents, keep contact sheets on paper and test the plan once a year. Include the ward staff in the drill, since a nurse or a ward clerk is often the first person to notice a lost file or a message sent to the wrong person, and the clock starts when the hospital becomes aware.

Doctors, nurses and front-line habits

Most privacy lapses in hospitals are small and human: a chart left on a counter, a report read aloud in a waiting room, a photo of a scan sent to a colleague on a personal phone. Training should be short and concrete.

• Do not leave charts or screens where visitors can see them.
• Use hospital-approved channels to share reports and images.
• Lock the screen when you step away.
• Report a lost file or a wrong-recipient message the same hour.

Add a few lines on this to the joining pack and repeat them at a yearly refresher. Keep an attendance record of the sessions.

Labs, insurers and software vendors

Hospitals share data with diagnostic labs, tele-radiology partners, insurers, billing agencies and software vendors. Make a list of each outside party, the data it receives and the contract that governs it. Rule 6 expects contract terms on security with processors. Add breach alert times, deletion on exit and a right to ask for proof.

Review the list each year. A vendor that was small when signed may now hold ten times the data.

A worked example for a mid-size hospital

The first fixes take weeks, not months, and cost less than a single breach would.

Common mistakes

Another mistake is sending reports by personal messaging apps. Use the hospital portal or an approved channel.

A third is assuming that the Fourth Schedule exemption ends all duties. Safeguards, notice, deletion and breach reporting still apply.

A 90-day plan

Spread the work over three months.

Report progress to the management committee each month, with a short table of what is done, what is open and what is blocked. Ask the committee to name one senior owner for the whole programme, because work that sits between departments is the work that does not get done. Repeat the review each year and after any new vendor, new wing or new system goes live.

Five-minute self-check

Check your hospital against these points.

Two or more no answers mean this is worth fixing before anything else on your list.

Reader Q&A

Bottom line

A hospital's data duties sit on top of a professional duty it has always had. The legal view is now written down, with penalties attached.

Fix the front desk first, then logins, vendors and an incident plan. Keep records of what you changed and when, so that the story is easy to tell.

Author of the Blog Post

Aadeshwar Modi

Technical Content Writer at VisitorFlow

Aadeshwar Modi is a marketing technical content writer who loves writing on technology and AI topics.