Industry guide
DPDP for Healthcare
Health services process deeply personal data, often for children and for persons with lawful guardians, and often under other laws that continue to apply alongside the DPDP framework.
What does the DPDP framework mean for Healthcare?
Health services process deeply personal data, often for children and for persons with lawful guardians, and usually under other laws that continue to apply alongside. Start with guardian verification and child patient flows, then records retention, which is where the DPDP timers meet medical record rules. Security and audit posture follows.
How to read this page. The obligations belong to your organisation, not to a role or a sector. Everything here is practical emphasis: which official duties this audience usually leads or feeds into, with links to the official text. Finishing one function's work never makes the company compliant by itself.
Where the framework usually bites first
Verifiable consent for guardiansRule 11, official text →
Processing for persons with lawful guardians has its own verification duty.
Child patientsRule 10, official text →
Parental verifiable consent applies, and the Fourth Schedule exemptions for health contexts need careful legal reading.
Records retention against other lawsRule 8, official text →
Clinical record retention duties under other laws can require keeping data the DPDP timers would otherwise erase; the rules defer to such laws.
Tools for this sector
Tool
Compliance Plan
Generate 1 company level action plan and see the work for your role first.
Open
Tool
Children's Data Checker
See whether child data obligations or exemptions are triggered and what they require.
Open