The DPDP Rules 2025 for hospitals: what changes, and by when

The short answer

Picture a patient at your front desk asking what you do with their records, and who else sees them. From around May 2027, India’s data protection rules expect a hospital to answer that in plain words, and to have a breach plan and processing logs ready. Start now with the list below, rule by rule.

India’s Digital Personal Data Protection Rules, 2025 put most of the DPDP Act’s duties into force eighteen months after their publication in the gazette of 13 November 2025, so around May 2027.¹¹ For a hospital or clinic, the work is: plain-language notices, verifiable parental consent outside direct care, minimum security safeguards, a breach report to the Data Protection Board within 72 hours, one year of processing logs, contracts with every data processor, and a published contact for privacy questions.

This is a plain summary of the rules’ text, not legal advice. The Act and the Rules govern, and your counsel should read them against your own setup.

The timeline

The Rules start in three steps:¹

So the duties a hospital feels day to day all land in the third step. Eighteen months sounds long until you count the contracts, systems and training involved.

Health data has no special category

The DPDP Act defines personal data as any data about an individual who is identifiable by or in relation to it, and it has no separate sensitive or health category.² A discharge summary and a newsletter sign-up are both personal data. What changes for health is context: the Act lets a fiduciary process data without consent to respond to a medical emergency involving a threat to life or an immediate threat to health, and to provide treatment or health services during an epidemic or outbreak.² Those are narrow, named uses, not a general health exemption.

Notice and consent at the front desk

Where you rely on consent, Rule 3 sets out what the notice must do. It must make sense on its own, use clear and plain language, give an itemised description of the personal data and the specific purpose, and give a link and means to withdraw consent as easily as it was given, to exercise rights, and to complain to the Board.¹

In a hospital that touches registration forms, patient apps, websites and any portal where patients book or pay. A practical test: could a patient in your OPD queue read the notice on a phone and tell you what you collect and why?

Rule 9 adds that every fiduciary must publish the business contact of its Data Protection Officer, if it has one, or of a person who can answer questions about processing.¹ Rule 14 asks for a grievance process with a published response period of no more than ninety days.¹

Children’s data and the health exemption

Rule 10 requires verifiable consent from a parent before processing a child’s personal data, with checks that the parent is an identifiable adult.¹ For hospitals, the important part is Rule 12 and the Fourth Schedule: the Act’s child-specific obligations in sections 9(1) and 9(3) don’t apply to a clinical establishment, mental health establishment or healthcare professional when processing is restricted to providing health services to the child, to the extent necessary for the protection of her health.¹

The condition does the work. Treating a child falls inside it. A paediatric wellness newsletter or a marketing campaign aimed at parents probably doesn’t, and needs the normal parental consent.

Safeguards, logs and breaches

Rule 6 lists minimum safeguards for data you hold, including data a processor handles for you: encryption, masking or tokens; access control; logs with monitoring and review; continuity measures such as backups; one year of log retention; safeguard terms in processor contracts; and organisational measures.¹ Rule 8(3) separately asks for personal data, traffic data and logs of processing to be kept for at least a year from the processing.¹

Rule 7 sets the breach timeline: tell each affected patient without delay, tell the Board without delay, and give the Board a detailed report within 72 hours.¹ Our breach notification post walks through what each message must contain.

Penalties are large. The Act’s Schedule allows up to Rs. 250 crore for failing to take reasonable security safeguards and up to Rs. 200 crore for failing to notify a breach.²

Large hospital groups should also watch Rule 13. If the government notifies a hospital as a Significant Data Fiduciary, it must run a Data Protection Impact Assessment and an audit every twelve months and take due care that algorithmic software it uses is not likely to put patients’ rights at risk.¹

A rule-by-rule work list

Where AI tools come in

AI scribes, chat assistants and coding agents are new processors and new accessors at the same time. Three rules catch them directly. Rule 6(1)(f) means the contract with an AI vendor needs safeguard terms.¹ Rule 6 and Rule 8(3) mean the tool’s access to patient data needs to show up in logs you can review and keep for a year.¹¹ And Rule 7 means a wrong disclosure by a tool is a breach you may have to report within 72 hours.¹

Our posts on AI vendors as data processors and AI agent audit logs under DPDP go deeper on both. For the national cyber-incident rules that sit alongside DPDP, read CERT-In’s directions for hospitals. For what Deedglass does around AI agent writes, see /healthcare.

To try the checks on synthetic data, open the playground in your browser. To see what an AI agent on your machine can change, run npx deedglass scan (what the grade means) or paste its MCP config into /check; neither uploads your data. Our AI agent permissions report shows what public agent setups commonly leave open.

Written with AI assistance and checked against our claims register.