DPDP for the Sales department in Healthcare

Research with identifiable patients needs informed consent under research rules and DPDP consent for that use. Clinical audit to improve care within the hospital usually fits the treatment purpose. Case studies and teaching material should be de-identified so patients cannot be recognised. Clinical trials follow the NDCT Rules, 2019.

Section 6 sets consent; Section 17(2)(b) covers research only where no decision is taken about the person and prescribed standards are followed. Section 6 · Section 7 · Section 8(5) · Rule 6

1. Route research through the ethics committee.
2. Take research consent separately.
3. De-identify teaching cases and photos.
4. Limit researcher access.
5. Delete or anonymise at the end.

• Ethics approvals
• Research consents
• De-identification checks

• Photos with faces or tattoos in slides
• Using records for studies without approval
• Keeping research data with names after the study

Usually not for the treatment itself. A patient who comes for care gives data voluntarily for that purpose, and a medical emergency involving a threat to life is a listed use. Clinical consent for procedures is a separate medical and legal requirement and stays. Extra uses such as research, marketing, testimonials and sharing beyond what care and billing need do require DPDP consent.

Section 7(a) covers data given voluntarily for a specified purpose; Section 7(f) and 7(g) cover emergencies and epidemics. Section 7 · Section 6 · Section 5 · Rule 3

1. Keep clinical consent forms as they are.
2. Add a short notice at registration.
3. Add separate boxes for research, offers and stories.
4. Record which box each patient ticked.
5. Train front desk to explain the difference.

• Registration notice
• Consent records for extra uses

• One form that bundles treatment and marketing
• Calling clinical consent 'DPDP consent'
• No notice at registration

Marketing needs consent that is separate and specific, unless the person clearly expects it from the relationship. Bought or scraped lead lists are risky because you cannot show consent. Every message should carry an easy way to stop.

Health package offers to past patients need separate consent.

Section 6 sets the consent standard. Section 5 needs a notice. Section 9 bars targeted advertising at children. Section 6 · Section 5 · Rule 3 · Section 9 · Rules 10, 12

1. Separate service messages from marketing messages.
2. Ask marketing consent separately, with a clear action.
3. Stop using bought lists unless the seller can show consent for you.
4. Add an easy stop option to every message.
5. Respect the telecom preference rules for calls and SMS.

• Marketing consent records
• Lead source records
• Stop requests and their handling

• Treating account sign-up as marketing consent
• Agency lists with no consent proof
• A stop option that does not work

For every use of personal data you need one basis: consent, or one of the legitimate uses in Section 7, such as a legal duty, employment, a medical emergency, or data a person gave voluntarily for a specific purpose. Anything beyond what the person expects, such as marketing, profiling or sharing with partners, usually needs consent.

Treatment rests on the patient's purpose; research, offers and testimonials need consent.

Section 4 allows processing only with consent or for a legitimate use. Section 6 sets what valid consent looks like. Section 7 lists the uses that need no consent. Section 4 · Section 6 · Section 7

1. List each purpose for which you use personal data.
2. Against each purpose, write the basis: consent or the exact clause of Section 7.
3. Where the basis is consent, check that it was asked separately, with a clear action and no pre-ticked box.
4. Stop or re-paper any purpose with no basis.
5. Review the list whenever a new product, campaign or system starts.

• Purpose and basis register
• Consent records with date, version and channel
• Legal sign-off on each legitimate use relied on

• Treating account terms as consent for marketing
• Bundling several purposes in one tick-box
• Relying on 'legitimate interest', which the Indian Act does not have

Withdrawal must be as easy as giving consent. Once someone withdraws, you and every vendor working for you must stop that use within a reasonable time. What was done before withdrawal stays lawful, and data that a law requires you to keep is kept.

A patient who withdraws consent for offers keeps receiving care.

Section 6(4) to 6(6) give the right to withdraw at any time, with the same ease, and require processors to stop as well. Section 8(7) then asks for erasure unless a law requires retention. Section 6 · Section 8(7) · Rule 8 · Section 8(1)–(2)

1. Give one simple way to withdraw on every channel where consent is taken.
2. Record the withdrawal against the person and the purpose.
3. Push the change to every system and vendor that uses that purpose.
4. Confirm to the person, in writing, what has stopped and what is kept by law.
5. Check a sample every month to see that the change actually reached every list.

• Withdrawal log with time stamps
• Proof that downstream systems and vendors updated
• Confirmation sent to the person

• Withdrawal by email only, while consent was one tap in an app
• Stopping in the main system but not in vendor lists
• Deleting records a law requires you to keep

Sending personal data to the wrong chat or a personal account is one of the most common breaches. Banning messaging rarely works. Give staff an approved tool that is easy to use, set simple rules, and make it safe to report a wrong send at once.

Reports and images on WhatsApp groups are the most common hospital breach.

Section 8(5) asks for reasonable safeguards. A wrong send is a breach under Section 2(u), and Section 8(6) applies. Section 8(5) · Rule 6 · Section 8(6) · Rule 7

1. Ask teams how they actually share files and photos today.
2. Provide an approved tool for that job.
3. Set three simple rules: approved tool, no personal accounts, report wrong sends.
4. Teach the rules with real examples from your own work.
5. Treat a quick report as good behaviour, not a disciplinary case.

• Approved-tool policy
• Training record
• Incident reports of wrong sends

• A ban with no alternative
• Punishing people who report
• Ignoring group chats with vendors

Call recordings, chat transcripts and agent screens hold a lot of personal data. Tell callers that calls are recorded and why, keep recordings for a set period, limit who can listen, and mask card numbers and passwords on screen and in recordings.

Appointment and lab call centres record names and conditions.

Section 5 needs notice, Section 8(5) needs safeguards, and Section 8(7) needs erasure after the purpose. Section 5 · Rule 3 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8

1. Play a short recording notice at the start of calls.
2. Set a retention period by call type.
3. Pause recording when card or other sensitive details are given.
4. Limit replay rights to quality and complaint teams.
5. Lock agent screens and stop phones on the floor if data is sensitive.

• Recording notice script
• Retention settings
• Replay access list

• Recordings kept indefinitely
• Card numbers in recordings
• Open replay access for all supervisors

Send a summary of the personal data you hold about them and what you do with it, and the names of the other organisations you shared it with and what was shared. Check the person's identity first, log the request and keep a copy of your reply.

Under the 2002 regulations, patients and authorised attendants should get record copies within 72 hours of a request. The DPDP summary adds who the data was shared with.

Section 11 gives the right to a summary and the list of organisations it was shared with. Rule 14 asks you to publish how requests are made and to answer within the period you publish. Sections 11–14 · Rule 14 · Section 8(9)–(10) · Rules 9, 14

1. Log the request in one register the day it arrives.
2. Verify identity using details you already hold.
3. Search every system, including vendors' copies.
4. Write a plain summary: what data, why it is used, who received it.
5. Send it, and file the request, search notes and reply.

• Request register
• Search notes for each request
• Copy of each reply with date

• Sending raw database dumps
• Forgetting data held by vendors
• No identity check before sending