DPDP for the Company secretary in Healthcare

HIV results, mental health records, MTP registers and PCPNDT records each have their own law. HIV status needs informed consent before disclosure. Mental health records are confidential and cannot go to the media without consent. The MTP admission register is a secret document. PCPNDT records are kept for two years. Give these the tightest access in the hospital.

Section 8(5) asks for safeguards suited to the risk; the special laws set their own rules. Section 8(5) · Rule 6 · Section 8(7) · Rule 8

1. List where these records sit.
2. Restrict access to the treating team.
3. Keep the MTP register with the head of the hospital.
4. Set retention as each law says.
5. Log every access.

• Access settings
• Retention entries
• Access logs

• HIV results visible to all clinicians
• MTP details in general billing
• PCPNDT records deleted early

Yes, for a claim the patient has asked for, because that is part of the purpose. Share only what the claim needs, through the TPA portal or a secure channel, and keep a record of what was sent. Sharing for anything else, such as an insurer's own marketing, needs consent.

Section 7(a) covers the claim purpose; Section 8(1) and 8(5) apply to how data is sent. Section 7 · Section 8(5) · Rule 6 · Sections 11–14 · Rule 14

1. Use TPA portals, not email.
2. Send only claim documents.
3. Log what was sent, to whom, when.
4. Answer patient questions about sharing.
5. Check TPA agreements.

• Sharing log
• TPA agreement

• Full case files by email
• No record of what was sent
• Insurer representatives reading records on wards

Directors do not need technical detail. They need to know who is accountable, how the organisation would handle a breach, which outside parties hold data, and whether the plan to May 2027 is on track with evidence.

Ask about downtime, wrong sends and vendor lists.

The Act places duties on the Data Fiduciary, the organisation itself. Directors oversee whether management has put those duties into practice. Section 8(1)–(2) · Section 8(6) · Rule 7 · Section 10 · Rule 13

1. Ask who is accountable for personal data, by name.
2. Ask when the breach plan was last rehearsed and what was learnt.
3. Ask for the list of vendors holding the most personal data.
4. Ask how many requests and complaints came in, and how fast they were answered.
5. Ask for the plan to May 2027 with evidence, not colours.

• Quarterly note to the board
• Minutes showing the questions asked
• Management responses

• Discussing DPDP once and then never again
• Accepting 'IT is handling it'
• No date for the breach rehearsal

Only as far as the evidence behind it. Ask three things: what was actually tested, what rests only on someone's statement, and what was not looked at. A position built from answers alone may describe what people believe, not what happens with the data.

Accountability under the Act sits with the organisation; management oversight is how that accountability becomes real. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 10 · Rule 13

1. Ask for the position split into tested, stated and not looked at.
2. Ask for two or three samples you can see.
3. Ask who reviewed the evidence.
4. Ask what changed since the last review.
5. Record the answers in minutes.

• Position with tested and stated parts
• Samples seen
• Minutes

• Trusting a single summary slide
• No difference between stated and tested
• No record of what management saw

The organisation is accountable under the Act, and management decides who answers for each duty inside it. In practice that means a named owner for each duty and each major system, written down and accepted by that person. An owner whose name was typed in by someone else, without their agreement, is not really an owner.

Section 8(1) puts responsibility on the Data Fiduciary. Section 8(9) asks for a published contact person. Section 8(1)–(2) · Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

1. List duties and major systems.
2. Propose an owner for each.
3. Ask each owner to accept in writing.
4. Publish the overall contact person.
5. Review owners when people move.

• Owner register with acceptances
• Published contact
• Review dates

• Owners assigned without telling them
• One person owning everything
• Owners who left the organisation

Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.

Hospital chains and large labs should name a privacy lead.

Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

1. Name one accountable person, with a deputy.
2. Publish the contact on your website, app and notices.
3. Give the role time, a budget line and a route to management.
4. Set a short monthly report: requests, complaints, incidents, actions.
5. Review the role if you are notified as an SDF.

• Appointment letter
• Published contact
• Monthly report

• Giving the job to IT as a side task
• A contact email nobody reads
• No authority to make changes

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

Large hospital chains and health platforms hold sensitive data at scale; plan as a possible candidate.

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

1. Estimate how many people's data you hold and how sensitive it is.
2. Note any public or security role your data plays.
3. If you are a likely candidate, run a trial impact assessment this year.
4. Identify an auditor you could appoint.
5. Watch MeitY notifications.

• Volume and sensitivity note
• Trial impact assessment
• Board note

• Assuming 'not notified' means 'never'
• Waiting for notification to start
• Thinking only tech companies will be notified

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

A ransomware attack on the HIS needs a CERT-In report in six hours and the DPDP messages.

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

1. Name one incident lead and a back-up, with phone numbers that work at night.
2. Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
3. Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
4. Decide in advance who signs off each message.
5. Rehearse once a year with the people who would actually be called.

• Incident plan with clocks
• Rehearsal record
• Incident log with times of each step

• Waiting to finish the investigation before telling anyone
• Treating a wrong email or a lost laptop as 'not a breach'
• Only IT knowing the plan

Check that the request is in writing, comes from the right authority and cites the legal power. Share only what is asked for, record what you sent and to whom, and keep the request on file. The Act allows processing to meet a legal duty, but it does not mean sharing everything on a phone call.

Police requests for MLC records and court summons are common.

Section 7(d) and 7(e) allow processing to meet a legal duty to disclose to the State, or to comply with a judgment or order. Section 17(1)(c) exempts processing for preventing, detecting or investigating offences. Section 7 · Section 8(5) · Rule 6

1. Route every such request to Legal.
2. Check the authority, the legal power and the scope.
3. Share only what is asked, by a secure method.
4. Log the request, what was sent, by whom and when.
5. Tell the person, unless the law or the authority says you must not.

• Authority request log
• Copies of requests
• Record of what was sent

• Sharing on a phone call
• Sending whole files when a few lines were asked
• No log

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

Access control and vendor contracts take the longest.

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

1. Month 1: name the owner, set a budget line, start the inventory.
2. Months 2 to 3: notices, consent records, contact person, request register.
3. Months 3 to 6: vendor contracts, access control, logs, retention schedule.
4. Months 6 to 8: breach rehearsal, training, internal review.
5. Month 9: management review with evidence.

• Programme plan with owners
• Monthly status with evidence
• Management minutes

• Leaving it to the last quarter
• Buying a tool before knowing the gaps
• Status colours with no evidence behind them