DPDP for the CFO / Finance head in Healthcare

Usually not for the treatment itself. A patient who comes for care gives data voluntarily for that purpose, and a medical emergency involving a threat to life is a listed use. Clinical consent for procedures is a separate medical and legal requirement and stays. Extra uses such as research, marketing, testimonials and sharing beyond what care and billing need do require DPDP consent.

Section 7(a) covers data given voluntarily for a specified purpose; Section 7(f) and 7(g) cover emergencies and epidemics. Section 7 · Section 6 · Section 5 · Rule 3

1. Keep clinical consent forms as they are.
2. Add a short notice at registration.
3. Add separate boxes for research, offers and stories.
4. Record which box each patient ticked.
5. Train front desk to explain the difference.

• Registration notice
• Consent records for extra uses

• One form that bundles treatment and marketing
• Calling clinical consent 'DPDP consent'
• No notice at registration

Yes, for a claim the patient has asked for, because that is part of the purpose. Share only what the claim needs, through the TPA portal or a secure channel, and keep a record of what was sent. Sharing for anything else, such as an insurer's own marketing, needs consent.

Section 7(a) covers the claim purpose; Section 8(1) and 8(5) apply to how data is sent. Section 7 · Section 8(5) · Rule 6 · Sections 11–14 · Rule 14

1. Use TPA portals, not email.
2. Send only claim documents.
3. Log what was sent, to whom, when.
4. Answer patient questions about sharing.
5. Check TPA agreements.

• Sharing log
• TPA agreement

• Full case files by email
• No record of what was sent
• Insurer representatives reading records on wards

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

Access control and vendor contracts take the longest.

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

1. Month 1: name the owner, set a budget line, start the inventory.
2. Months 2 to 3: notices, consent records, contact person, request register.
3. Months 3 to 6: vendor contracts, access control, logs, retention schedule.
4. Months 6 to 8: breach rehearsal, training, internal review.
5. Month 9: management review with evidence.

• Programme plan with owners
• Monthly status with evidence
• Management minutes

• Leaving it to the last quarter
• Buying a tool before knowing the gaps
• Status colours with no evidence behind them

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

Labs, teleradiology, HIS vendors, TPAs and ambulance services.

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

1. List vendors who receive or can see personal data.
2. Rank them by how much and how sensitive.
3. Add a data-protection schedule to each contract, starting with the top ten.
4. Ask for evidence: certificates, test results, deletion confirmations.
5. Review the top vendors every year.

• Vendor register
• Signed data-protection schedules
• Annual review notes

• Relying on the vendor's standard terms
• No incident-notice time
• No exit and deletion clause

Before accepting a readiness statement, management should see evidence for each duty: dated notices, consent records, a request register with replies, signed vendor terms, access review sign-offs, log settings, a breach drill report and a deletion log. A status colour without these is a statement, not evidence.

The Act places duties on the Data Fiduciary as an organisation. Management is accountable for whether they are actually met. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(9)–(10) · Rules 9, 14

1. List the duties that apply.
2. For each, name the piece of evidence that would satisfy an auditor.
3. Ask owners to attach it.
4. Mark duties without evidence as open, not ready.
5. Review the list before each management sign-off.

• Duty-to-evidence list
• Attached evidence
• Sign-off record

• Accepting 'done' without seeing anything
• Counting policies as evidence
• One sign-off and no review after

Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.

Indoor records at least 3 years (2002 regulations), PCPNDT 2 years, MTP 5 years, Schedule H1 3 years.

Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

1. List the record types you hold.
2. Write the period for each, with the law, regulator rule or business reason.
3. Set a trigger for the period to start: end of relationship, date of transaction, exit date.
4. Automate deletion where you can; for paper, schedule shredding.
5. Keep a deletion log.

• Retention schedule approved by Legal
• Deletion log
• Shredding or disposal certificates

• 'Keep everything forever' because storage is cheap
• Deleting before the legal minimum
• Forgetting email, shared drives and backups

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

Large hospital chains and health platforms hold sensitive data at scale; plan as a possible candidate.

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

1. Estimate how many people's data you hold and how sensitive it is.
2. Note any public or security role your data plays.
3. If you are a likely candidate, run a trial impact assessment this year.
4. Identify an auditor you could appoint.
5. Watch MeitY notifications.

• Volume and sensitivity note
• Trial impact assessment
• Board note

• Assuming 'not notified' means 'never'
• Waiting for notification to start
• Thinking only tech companies will be notified

Under DPDP, yes, unless the government restricts a country, and none had been restricted when this page was last reviewed. A sector rule can be stricter, for example RBI's rule that payment system data must be stored only in India. Remote support access from abroad also counts as data going outside India.

Teleradiology and some software vendors use teams abroad; this is a transfer.

Section 16 allows transfers unless restricted, and keeps stricter sector laws in force. Rule 15 adds conditions on making data available to foreign states. Section 16 · Rule 15 · Section 8(1)–(2)

1. List where each system is hosted and where support teams log in from.
2. Check sector rules for localisation.
3. Put location and access terms in cloud and vendor contracts.
4. Keep the list current; new SaaS tools change it quietly.
5. Tell people in your notice if data goes abroad.

• Hosting and access-location list
• Contract clauses
• Sector rule check

• Forgetting email, CRM and helpdesk SaaS
• Ignoring overseas support logins
• Assuming 'Indian vendor' means 'data in India'

Usually not for normal employment purposes. Section 7(i) lets you process employee data for employment, such as payroll, attendance, safety and preventing corporate espionage. Anything beyond that, such as wellness apps, photos for marketing or sharing with a bank for offers, needs consent.

Staff health and vaccination records are sensitive; keep them apart from HR files.

Section 7(i) covers employment purposes and safeguarding the employer from loss or liability. Notice, security, retention and rights still apply to employees. Section 7 · Section 5 · Rule 3 · Section 8(7) · Rule 8 · Sections 11–14 · Rule 14

1. List what you collect from staff and why.
2. Mark which items are employment purposes and which are extra.
3. Take consent for the extras, separately.
4. Give staff a short employee privacy notice.
5. Set retention for ex-employee records.

• Employee data list with basis
• Employee privacy notice
• Consent for extras

• A blanket consent clause in the offer letter
• Keeping candidate data forever
• Sharing staff data with vendors without terms

Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.

Hospital chains and large labs should name a privacy lead.

Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

1. Name one accountable person, with a deputy.
2. Publish the contact on your website, app and notices.
3. Give the role time, a budget line and a route to management.
4. Set a short monthly report: requests, complaints, incidents, actions.
5. Review the role if you are notified as an SDF.

• Appointment letter
• Published contact
• Monthly report

• Giving the job to IT as a side task
• A contact email nobody reads
• No authority to make changes