Industry guide
DPDP for Healthcare
Health services process deeply personal data, often for children and for persons with lawful guardians, and often under other laws that continue to apply alongside the DPDP framework.
How to read this page. The obligations belong to your organisation, not to a role or a sector. Everything here is practical emphasis: which official duties this audience usually leads or feeds into, with links to the official text. Finishing one function's work never makes the company compliant by itself.
Where the framework usually bites first
Verifiable consent for guardiansRule 11, official text →
Processing for persons with lawful guardians has its own verification duty.
Child patientsRule 10, official text →
Parental verifiable consent applies, and the Fourth Schedule exemptions for health contexts need careful legal reading.
Records retention against other lawsRule 8, official text →
Clinical record retention duties under other laws can require keeping data the DPDP timers would otherwise erase; the rules defer to such laws.