DPDP Act for hospitals, clinics and health apps: what applies

Search for the DPDP Act and hospitals and much of what comes back says health data is a special, sensitive category, often citing a section 3(d) that does not exist. The real position is less dramatic and more useful: the Act treats a hospital like any other Data Fiduciary, and the provisions that actually shape health work are 3 clauses of section 7, a narrow exemption for child patients, the retention rule and, for research, the section 17(2)(b) exemption. Here is each one, from the official text.

A hospital is an ordinary Data Fiduciary

A hospital, clinic, diagnostic laboratory, pharmacy or health app that determines the purpose and means of processing patient data is a Data Fiduciary, and the patient is the Data Principal. Health data gets no category of its own. Section 2(t) defines personal data once:

"“personal data” means any data about an individual who is identifiable by or in relation to such data"

A blood test result and a billing address pass the same test and attract the same duties under the Act. Why the sensitive data category is a myth, and where the word sensitivity does appear, is set out in does the DPDP Act have a sensitive personal data category.

Consent, or 1 of 3 health clauses in section 7

Section 4 allows processing only in accordance with the Act and for a lawful purpose, and on 2 grounds only: consent, or "(b) for certain legitimate uses", which section 7 lists in 9 clauses. 3 of them do most of the work in health settings.

Clause (f) is wider than it first looks: it covers a threat to "the Data Principal or any other individual", so a patient's details can be used to respond to an emergency affecting someone else. Clause (g) is tied to an epidemic, an outbreak or another threat to public health, not to ordinary care.

No clause of section 7 names routine treatment. On this site's reading, for everyday care a private provider relies either on consent or on clause (a); a State hospital may also look to clause (c), the performance by the State of any function under law, and clauses (d) and (e) cover disclosures to the State that a law requires and compliance with any judgment, decree or order. The Act's own first illustration to clause (a) is a health business:

"X, an individual, makes a purchase at Y, a pharmacy. She voluntarily provides Y her personal data and requests Y to acknowledge receipt of the payment made for the purchase by sending a message to her mobile phone. Y may process the personal data of X for the purpose of sending the receipt."

Read with its second illustration, in which a broker must stop processing once the individual says she no longer needs help, clause (a) looks tied to the purpose the patient provided her details for, such as a booked consultation. On this site's reading it does not stretch to a later and different purpose, such as marketing a health package; that needs consent. That is interpretation: no rule or Board decision on the point is held in this site's source registry. Research is separate: section 17(2)(b) disapplies the Act to processing necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and the processing follows the standards Rule 16 specifies in the Second Schedule. On this site's reading, research outside that exemption needs consent or another ground. How consent itself must be collected is covered in DPDP consent requirements.

Child patients: relief for health services, and its limits

Section 9(1) requires verifiable consent of the parent or lawful guardian before processing any personal data of a child or of a person with disability who has a lawful guardian. Section 9(3) bans tracking, behavioural monitoring and targeted advertising aimed at children. Both would bite hard on a paediatric ward, so the Rules lift them for the health providers named in Part A, subject to its conditions. Rule 12(1) provides:

"The provisions of sub-sections (1) and (3) of section 9 of the Act shall not be applicable to processing of personal data of a child by such class of Data Fiduciaries as are specified in Part A of Fourth Schedule, subject to such conditions as are specified in the said Part."

Item 1 of Part A names a clinical establishment, mental health establishment or healthcare professional, on this condition:

"Processing is restricted to provision of health services to the child by such establishment or professional, to the extent necessary for the protection of her health."

Item 2 gives an allied healthcare professional similar relief, restricted to supporting implementation of any healthcare treatment and referral plan recommended by such professional for the child, to the extent necessary for the protection of her health. 3 limits follow from the text.

1. The relief is purpose bound. It covers health services to the child to the extent necessary to protect her health. On this site's reading, a hospital app sending a child's family promotional offers is outside it.
2. Section 9(2) still applies. Rule 12 lifts sub sections (1) and (3) only, so the ban on processing likely to cause any detrimental effect on a child's well being stays in place.
3. Adults with a lawful guardian get no relief. Rule 12 speaks only of the personal data of a child, as does the exemption power in section 9(4). On this site's reading, a hospital treating an adult patient with disability who has a lawful guardian therefore still needs the guardian's verifiable consent under section 9(1), and when obtaining it Rule 11 requires due diligence that the guardian is appointed by a court of law, a designated authority or a local level committee under the law applicable to guardianship. For Rule 11, Rule 11(2)(d) defines a person with disability as an individual who, despite being provided adequate and appropriate support, is unable to take legally binding decisions. How section 9(1) interacts with a section 7 ground such as clause (f) in an emergency is not settled by any rule or Board decision held in this site's source registry.

Whether a provider falls within item 1 depends on definitions the Note to the Fourth Schedule imports from the Clinical Establishments (Registration and Regulation) Act, 2010, the National Commission for Allied and Healthcare Professions Act, 2021 and the Mental Healthcare Act, 2017. A health app that is not itself one of those establishments or professionals should not assume it is covered. The full scheme is in children's data under the DPDP Act.

Medical records: no Third Schedule clock

Rule 8(1) and the Third Schedule set erasure clocks for 3 classes only: e commerce entities with at least 2 crore registered users in India, online gaming intermediaries with at least 50 lakh, and social media intermediaries with at least 2 crore. A hospital is not one of those classes, so the 3 year inactivity clock does not apply to it as a hospital. A health app or online pharmacy platform is outside them too unless it meets a class definition in the Note to the Third Schedule, for example an e commerce entity within the Consumer Protection Act, 2019 with at least 2 crore registered users in India.

2 retention rules will apply from commencement. Section 8(7) requires erasure when the patient withdraws consent or when it is reasonable to assume the specified purpose is no longer served, whichever is earlier, but only "unless retention is necessary for compliance with any law for the time being in force". Medical record keeping duties under other laws therefore survive; this site holds none of those laws and makes no claim about their periods. Separately, Rule 8(3) requires every Data Fiduciary to keep personal data, traffic data and processing logs for at least 1 year from the processing, for the purposes in the Seventh Schedule. How the 2 interact is worked through in Rule 8 retention explained.

Until 13 May 2027: the SPDI Rules still name health data

As at 18 October 2026, the older framework is still in force. Rule 3 of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 lists 8 clauses of sensitive personal data or information, including clause (iii), physical, physiological and mental health condition, and clause (v), medical records and history. Those Rules were made under section 87(2)(ob) read with section 43A of the Information Technology Act, 2000. Section 43A makes a body corporate that possesses, deals with or handles sensitive personal data or information in a computer resource it owns, controls or operates liable to pay compensation if it is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person. Body corporate is defined to include a company, a firm, a sole proprietorship or other association of individuals engaged in commercial or professional activities.

Section 44(2)(a) of the DPDP Act omits section 43A, but section 44(2) sits in the 18 month commencement group, so this site recommends that a private hospital or clinic that is a body corporate keep its SPDI Rules compliance running until section 44(2) commences, on a computed 13 May 2027 that is interpretation until officially confirmed. What happens to the Rules when their parent provisions go is discussed in the SPDI Rules 2011 and the DPDP Act.

Large hospital groups and Significant Data Fiduciary status

The first factor section 10(1) lets the Central Government weigh when notifying a Significant Data Fiduciary is "the volume and sensitivity of personal data processed". On this site's reading, a large hospital chain or health platform could be a candidate, but status arises only by notification, and as at 9 October 2026 no notification under section 10(1) has been located in MeitY's published document library, unchanged on a diff run 18 October 2026. Section 10 has not commenced in any case. What the status would add is in Significant Data Fiduciary explained.

When this starts

Notification G.S.R. 843(E) places sections 3 to 5, sections 7 to 10, section 17 and section 44(2) in the group that comes into force 18 months after its publication, and Rule 1(4) does the same for Rules 6, 7, 8, 11, 12 and 16. Computed from the printed publication date of 13 November 2025, that is 13 May 2027, a computed date that is interpretation until officially confirmed. The definition in section 2 is already in force. The full picture is in what is in force in 2026.

What to do before then

These are recommendations, not statutory requirements:

1. List each patient data flow and name its ground: consent, a clause of section 7 such as 7(a), 7(f) or 7(g), or, for research, the section 17(2)(b) exemption and its Rule 16 standards. Treat marketing use of records as needing consent.
2. Separate child patient flows that stay within health services from everything else the same systems do with a child's data.
3. Build a guardian verification step for adult patients with a lawful guardian, because Rule 12 does not reach them.
4. Record, for each retention decision, the other law that requires keeping the record, since section 8(7) yields only to a law.
5. Plan security safeguards and breach intimation against Rule 6 and Rule 7.

Check your position with the applicability checker and the children's data tool, and see the healthcare guide for the related tools and articles.