DPDP for the CEO / MD in Healthcare

Usually not for the treatment itself. A patient who comes for care gives data voluntarily for that purpose, and a medical emergency involving a threat to life is a listed use. Clinical consent for procedures is a separate medical and legal requirement and stays. Extra uses such as research, marketing, testimonials and sharing beyond what care and billing need do require DPDP consent.

Section 7(a) covers data given voluntarily for a specified purpose; Section 7(f) and 7(g) cover emergencies and epidemics. Section 7 · Section 6 · Section 5 · Rule 3

1. Keep clinical consent forms as they are.
2. Add a short notice at registration.
3. Add separate boxes for research, offers and stories.
4. Record which box each patient ticked.
5. Train front desk to explain the difference.

• Registration notice
• Consent records for extra uses

• One form that bundles treatment and marketing
• Calling clinical consent 'DPDP consent'
• No notice at registration

• What should our privacy notice say, and where must people see it?
• Can we use patient data for research, audits or case studies?
• Can we share patient records with insurers and TPAs?

Yes, for a claim the patient has asked for, because that is part of the purpose. Share only what the claim needs, through the TPA portal or a secure channel, and keep a record of what was sent. Sharing for anything else, such as an insurer's own marketing, needs consent.

Section 7(a) covers the claim purpose; Section 8(1) and 8(5) apply to how data is sent. Section 7 · Section 8(5) · Rule 6 · Sections 11–14 · Rule 14

1. Use TPA portals, not email.
2. Send only claim documents.
3. Log what was sent, to whom, when.
4. Answer patient questions about sharing.
5. Check TPA agreements.

• Sharing log
• TPA agreement

• Full case files by email
• No record of what was sent
• Insurer representatives reading records on wards

• Someone asks what data we hold about them. What do we send?
• What must a vendor contract say about personal data?
• Do we need DPDP consent to treat a patient?

Research with identifiable patients needs informed consent under research rules and DPDP consent for that use. Clinical audit to improve care within the hospital usually fits the treatment purpose. Case studies and teaching material should be de-identified so patients cannot be recognised. Clinical trials follow the NDCT Rules, 2019.

Section 6 sets consent; Section 17(2)(b) covers research only where no decision is taken about the person and prescribed standards are followed. Section 6 · Section 7 · Section 8(5) · Rule 6

1. Route research through the ethics committee.
2. Take research consent separately.
3. De-identify teaching cases and photos.
4. Limit researcher access.
5. Delete or anonymise at the end.

• Ethics approvals
• Research consents
• De-identification checks

• Photos with faces or tattoos in slides
• Using records for studies without approval
• Keeping research data with names after the study

• Do we need DPDP consent to treat a patient?
• When do we need consent, and when can we rely on a legitimate use?
• How long can we keep personal data?

Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.

Hospital chains and large labs should name a privacy lead.

Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

1. Name one accountable person, with a deputy.
2. Publish the contact on your website, app and notices.
3. Give the role time, a budget line and a route to management.
4. Set a short monthly report: requests, complaints, incidents, actions.
5. Review the role if you are notified as an SDF.

• Appointment letter
• Published contact
• Monthly report

• Giving the job to IT as a side task
• A contact email nobody reads
• No authority to make changes

• Could we be a Significant Data Fiduciary?
• How do we handle a privacy complaint within 90 days?
• Something has gone wrong. What happens in the first 72 hours?

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

Access control and vendor contracts take the longest.

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

1. Month 1: name the owner, set a budget line, start the inventory.
2. Months 2 to 3: notices, consent records, contact person, request register.
3. Months 3 to 6: vendor contracts, access control, logs, retention schedule.
4. Months 6 to 8: breach rehearsal, training, internal review.
5. Month 9: management review with evidence.

• Programme plan with owners
• Monthly status with evidence
• Management minutes

• Leaving it to the last quarter
• Buying a tool before knowing the gaps
• Status colours with no evidence behind them

• Do we need a DPO?
• Where does personal data live in our organisation?
• What must a vendor contract say about personal data?

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

A ransomware attack on the HIS needs a CERT-In report in six hours and the DPDP messages.

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

1. Name one incident lead and a back-up, with phone numbers that work at night.
2. Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
3. Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
4. Decide in advance who signs off each message.
5. Rehearse once a year with the people who would actually be called.

• Incident plan with clocks
• Rehearsal record
• Incident log with times of each step

• Waiting to finish the investigation before telling anyone
• Treating a wrong email or a lost laptop as 'not a breach'
• Only IT knowing the plan

• Which logs must we keep, for how long, and where?
• What must a vendor contract say about personal data?
• Does deletion have to reach backups and test copies?

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

Labs, teleradiology, HIS vendors, TPAs and ambulance services.

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

1. List vendors who receive or can see personal data.
2. Rank them by how much and how sensitive.
3. Add a data-protection schedule to each contract, starting with the top ten.
4. Ask for evidence: certificates, test results, deletion confirmations.
5. Review the top vendors every year.

• Vendor register
• Signed data-protection schedules
• Annual review notes

• Relying on the vendor's standard terms
• No incident-notice time
• No exit and deletion clause

• Something has gone wrong. What happens in the first 72 hours?
• Can personal data be stored or accessed outside India?
• Does deletion have to reach backups and test copies?

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

Large hospital chains and health platforms hold sensitive data at scale; plan as a possible candidate.

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

1. Estimate how many people's data you hold and how sensitive it is.
2. Note any public or security role your data plays.
3. If you are a likely candidate, run a trial impact assessment this year.
4. Identify an auditor you could appoint.
5. Watch MeitY notifications.

• Volume and sensitivity note
• Trial impact assessment
• Board note

• Assuming 'not notified' means 'never'
• Waiting for notification to start
• Thinking only tech companies will be notified

• Do we need a DPO?
• Can personal data be stored or accessed outside India?
• What should the board of directors ask management about DPDP?

Marketing needs consent that is separate and specific, unless the person clearly expects it from the relationship. Bought or scraped lead lists are risky because you cannot show consent. Every message should carry an easy way to stop.

Health package offers to past patients need separate consent.

Section 6 sets the consent standard. Section 5 needs a notice. Section 9 bars targeted advertising at children. Section 6 · Section 5 · Rule 3 · Section 9 · Rules 10, 12

1. Separate service messages from marketing messages.
2. Ask marketing consent separately, with a clear action.
3. Stop using bought lists unless the seller can show consent for you.
4. Add an easy stop option to every message.
5. Respect the telecom preference rules for calls and SMS.

• Marketing consent records
• Lead source records
• Stop requests and their handling

• Treating account sign-up as marketing consent
• Agency lists with no consent proof
• A stop option that does not work

• When do we need consent, and when can we rely on a legitimate use?
• Someone withdraws consent. What has to stop, and how fast?
• Do we process children's data, and what changes if we do?