DPDP Rules status: compliance window active. Read the update

Skip to content
For Healthcare

Doctors, clinics and hospitals

Patient records need clear purposes, secure access and a retention plan. A child's health-service exemption is narrow. It does not replace medical consent rules.

Educational only · not legal adviceLast updated: 1 November 2026Written and edited by Sandesh Kokate

Consent Manager rule

Scheduled — 13 November 2026; s.6(9), Rule 4. Registration is for firms that want to operate a Consent Manager. This date does not require an ordinary business to register.

Scheduled — core duties: 13 May 2027. Rule 1(4) starts Rules 3, 5–16, 22 and 23 eighteen months after publication. Rule 1(3) starts Rule 4 after one year.

Registration in practice remains unconfirmed. Our limited official-source check on 1 November 2026 did not establish the Board's current appointments or a working application process. Board status

The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027. For Rule 4, the same publication-date distinction gives 13 versus 14 November 2026. We use 13 November for planning. Rule 1(3) and (4) measure from publication. See Methodology.

s.6(7)–(9); Rule 4; First Schedule — Act · Rules PDF page 25Rule 1 — commencement

Your role

Even a solo practitioner can be a Data Fiduciary when deciding why and how patient data is used (s.2(i)). Software acting on your behalf may be a Data Processor (s.2(k)). Labs, insurers and TPAs are not automatically Processors: check their own purposes.

Do by 13 May 2027 — Scheduled

Law references identify the duty. Suggested tools and proof are Good practice.

  1. Notice on consent forms

    s.5; Rule 3 — Act · Rules PDF page 24

    Use a short standalone notice: data, purpose, withdrawal and complaint routes.

    Proof to keep: Dated notice and form sample

    How to do it →

  2. Check grounds for non-treatment uses

    s.4(1); s.7 — Act

    Assess s.4 and s.7. Obtain valid consent where no legitimate use applies; do not assume treatment consent covers marketing.

    Proof to keep: Purpose and consent register

    How to do it →

  3. Apply the Rule 6 minimum. Good practice: use MFA, role-based access and tested backups.

    Proof to keep: Access matrix, log sample, restore test

    How to do it →

  4. Sign valid contracts with security clauses. Good practice: record instructions and sub-vendors.

    Proof to keep: Signed contract and vendor register

    How to do it →

  5. Notify users and the Board without delay; fuller Board report within 72 hours of awareness. Ask in writing for an extension.

    Proof to keep: Plan, templates and drill record

    How to do it →

  6. Publish who answers patient data questions and include details in rights replies.

    Proof to keep: Published contact and reply template

    How to do it →

What clinics and hospitals are exempt from

Law — s.9(4); Rule 12(1); Fourth Schedule, Part A, item 1: listed clinical and mental health establishments and healthcare professionals are exempt from ss.9(1) and 9(3) only for health services needed to protect the child's health. Item 2 covers allied professionals supporting a treatment and referral plan within that limit. Billing, marketing and research get no automatic exemption. This is a DPDP exemption, not permission to skip medical consent under other laws. Rule 12 does not lift s.9(2).

s.9(4); Rule 12; Fourth Schedule — Act · Rules PDF page 36

Your client's exemption is not yours

Law — Rule 12; Fourth Schedule: Part A names classes of Data Fiduciary, not software vendors as such. A client's class exemption is not your own exemption. Part B instead follows limited purposes: email-only accounts (item 3), location for safety (4), keeping harmful content away (5), and confirming a user is not a child or doing Rule 10 checks (6). The Note defines an educational institution as an institution of learning, including vocational education. Whether a specific online platform fits needs assessment. Good practice: ask which exemption the client relies on, record its limits, and build a parental-consent flow where needed.

s.9(4); Rule 12; Fourth Schedule — Act · Rules PDF page 36

Delete, but not too early

Law — s.8(7), DPDP Act 2023; Rule 8(3), DPDP Rules 2025 (G.S.R. 846(E), 13 November 2025): erase when consent is withdrawn or the purpose is no longer served, subject to legal retention. Rule 8(3) requires personal data, traffic data and processing logs to be kept for at least one year from processing, for Seventh Schedule purposes. Then erase unless another law requires longer. The Fiduciary must ensure its Processor follows that floor (Rule 8, Illustration, Case 2).

Our reading: do not erase before the Rule 8(3) floor when applying s.8(7). The opened text does not resolve every overlap. Confirm this reading before relying on it.

Rule 8(1), Third Schedule: the three-year dormancy rule is only for e-commerce and social media firms with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh. Account access and specified virtual-token access are excluded. Count from the latest relevant contact, rights exercise or Rules commencement, whichever is latest. Warn at least 48 hours before erasure (Rule 8(2)).

Good practice: write the floor and any longer legal period into the contract and deletion schedule. Agree who retains the records, returns data and confirms erasure.

s.8(7), (8); Rule 8; Third Schedule — Act · Rules PDF page 27

Two steps to the Board

Law — s.8(6), DPDP Act 2023; Rule 7, DPDP Rules 2025 (G.S.R. 846(E), 13 November 2025): on becoming aware of a breach, tell affected users without delay (Rule 7(1)). Give the Board an initial description without delay (Rule 7(2)(a)). Send the fuller Board report within 72 hours of awareness (Rule 7(2)(b)). The Board may allow longer on a written request.

Good practice for vendors: alert your client as soon as you become aware of a breach. Do not wait for confirmation or a full report. Put this alert duty in your contract. Rule 7 sets the Fiduciary's reporting duties, not a separate vendor clock.

s.8(6); Rule 7(1), (2)(a), (b) — Act · Rules PDF page 26

Hospital checklist

Good practice: map patient records, CCTV and staff data. Check the role of each lab, TPA, insurer and records vendor. Use processor terms where s.8(2) applies. Check sharing grounds under s.4. Accuracy under s.8(3) is a separate duty.

Do by 13 May 2027 — Scheduled

Law references identify the duty. Suggested tools and proof are Good practice.

  1. Apply the Rule 6 minimum. Good practice: use MFA, role-based access and tested backups.

    Proof to keep: Access matrix, log sample, restore test

    How to do it →

  2. Sign valid contracts with security clauses. Good practice: record instructions and sub-vendors.

    Proof to keep: Signed contract and vendor register

    How to do it →

  3. Notify users and the Board without delay; fuller Board report within 72 hours of awareness. Ask in writing for an extension.

    Proof to keep: Plan, templates and drill record

    How to do it →

  4. Publish a contact and reasonable grievance-response period no longer than 90 days (Rule 14(3)); put measures in place to meet it.

    Proof to keep: Published contact, response period and request log

    How to do it →

  5. Use the one-year processing floor and any longer legal period. Good practice: test erasure and keep evidence.

    Proof to keep: Retention schedule and deletion record

    How to do it →

  6. Provide routes for access, correction, erasure and nomination. Good practice: test a request.

    Proof to keep: Request log and test results

    How to do it →

Significant Data Fiduciary risk

Law — s.10(1) lists data volume, sensitivity and risks as factors. A hospital could be designated. Current notices remain unconfirmed. If designated, s.10(2) requires a Data Protection Officer, an independent data auditor and prescribed measures. Rule 13(1) requires yearly impact assessments and audits. A breach of s.10 can attract up to ₹150 crore (Act Schedule, item 4).

s.10; Rule 13 — Act · Rules PDF page 29

Other retention laws

Law — s.8(7), s.12(3): a required legal retention period can override erasure. These examples concern specified records, not every piece of personal data. Good practice: ask your client which law applies before deleting.

s.8(7), (8); Rule 8; Third Schedule — Act · Rules PDF page 27
GST books and records required under s.35(1)
72 months from the annual-return due date for the relevant year. For proceedings or investigation, keep subject-matter records one year after final disposal or the ordinary period, whichever is later.
Law — CGST Act 2017, s.36 · text opened 2026-11-01
Covered income-tax books and documents, not all personal data
Seven tax years from the end of the relevant tax year. Reopened assessments extend the hold until completion. Rule 46(2)–(3) limits professional-record coverage. The full Act s.62 text remains unconfirmed here.
Law — Income-tax Rules 2026, Rule 46(1), (4), (6), (9), (10) · text opened 2026-11-01
NBFC transaction records; identification and address records
Transactions: at least five years from the transaction date. Identification and addresses: at least five years after the business relationship ends. The explanation includes account files, correspondence and analysis results.
Law — NBFC KYC Directions 2025, Chapter VII, paragraph 47(1), (2) · text opened 2026-11-01

Client confidences continue after the work ends

An advocate may not disclose protected client communications, professional advice or document information without express client consent. The duty continues after service ends. The proviso excludes illegal-purpose communications and specified observed crime or fraud. Subsection (3) also covers interpreters and advocates' clerks or employees. The text does not settle whether independent vendor staff are covered. This is confidentiality, not a rule to keep every file forever. Good practice: use strict confidentiality and need-to-know terms in vendor contracts.

Law — Bharatiya Sakshya Adhiniyam 2023, s.132(1), explanation, (3)

Confirm before relying on this

  • Doctors' medical records: the current numeric period was not confirmed. The 2023 conduct text must not be relied on without checking the abeyance and operative successor position.
  • Hospital records: applicable establishment and state rules were not confirmed. No general three- or five-year period is asserted.
  • Company books: Companies Act s.128(5) could not be opened in substantive text. No eight-year period is published from this check.
  • Lawyers' files: no statutory file-retention period was established. Continuing confidentiality is not a retention clock.
Check your readiness →
What applies to you

Law — s.4(1): use consent or a listed legitimate use. Section 7(a) covers data given for a specified purpose, subject to its conditions. Section 7(f) covers a medical emergency; (g) covers epidemics and public-health needs. Check each use. Do not assume treatment grounds cover marketing.

Start here

Recommended first tool

Check your DPDP role

Answer eight questions about the data you handle.

Open

Deep dives

Health data

Sector rules and remaining source checks.

Read

Retention and erasure

The floor, legal exceptions and deletion.

Read

Written by Sandesh Kokate, reviewed against primary sources.Connect on LinkedIn →