DPDP for the Director in Healthcare

HIV results, mental health records, MTP registers and PCPNDT records each have their own law. HIV status needs informed consent before disclosure. Mental health records are confidential and cannot go to the media without consent. The MTP admission register is a secret document. PCPNDT records are kept for two years. Give these the tightest access in the hospital.

Section 8(5) asks for safeguards suited to the risk; the special laws set their own rules. Section 8(5) · Rule 6 · Section 8(7) · Rule 8

1. List where these records sit.
2. Restrict access to the treating team.
3. Keep the MTP register with the head of the hospital.
4. Set retention as each law says.
5. Log every access.

• Access settings
• Retention entries
• Access logs

• HIV results visible to all clinicians
• MTP details in general billing
• PCPNDT records deleted early

• Who should be able to see personal data in our systems?
• How long can we keep personal data?
• How do we stop staff looking at records they do not need?

Yes, for a claim the patient has asked for, because that is part of the purpose. Share only what the claim needs, through the TPA portal or a secure channel, and keep a record of what was sent. Sharing for anything else, such as an insurer's own marketing, needs consent.

Section 7(a) covers the claim purpose; Section 8(1) and 8(5) apply to how data is sent. Section 7 · Section 8(5) · Rule 6 · Sections 11–14 · Rule 14

1. Use TPA portals, not email.
2. Send only claim documents.
3. Log what was sent, to whom, when.
4. Answer patient questions about sharing.
5. Check TPA agreements.

• Sharing log
• TPA agreement

• Full case files by email
• No record of what was sent
• Insurer representatives reading records on wards

• Someone asks what data we hold about them. What do we send?
• What must a vendor contract say about personal data?
• Do we need DPDP consent to treat a patient?

Snooping on VIP, celebrity, colleague or neighbour records is a common problem. Give access by role, mark sensitive records, ask for a reason before opening them, allow break-glass access in emergencies, and review those logs every week.

Rule 6 requires access control and monitoring. Section 8(5) · Rule 6 · Section 8(6) · Rule 7

1. Flag VIP, staff and sensitive records.
2. Ask for a reason to open them.
3. Allow break-glass with review.
4. Review logs weekly.
5. Act on misuse consistently.

• Flag settings
• Review records
• Action records

• Everyone can see everything
• Break-glass never reviewed
• No action on misuse

• Who should be able to see personal data in our systems?
• Which logs must we keep, for how long, and where?
• Which records need extra protection under other health laws?

Directors do not need technical detail. They need to know who is accountable, how the organisation would handle a breach, which outside parties hold data, and whether the plan to May 2027 is on track with evidence.

Ask about downtime, wrong sends and vendor lists.

The Act places duties on the Data Fiduciary, the organisation itself. Directors oversee whether management has put those duties into practice. Section 8(1)–(2) · Section 8(6) · Rule 7 · Section 10 · Rule 13

1. Ask who is accountable for personal data, by name.
2. Ask when the breach plan was last rehearsed and what was learnt.
3. Ask for the list of vendors holding the most personal data.
4. Ask how many requests and complaints came in, and how fast they were answered.
5. Ask for the plan to May 2027 with evidence, not colours.

• Quarterly note to the board
• Minutes showing the questions asked
• Management responses

• Discussing DPDP once and then never again
• Accepting 'IT is handling it'
• No date for the breach rehearsal

• Do we need a DPO?
• Something has gone wrong. What happens in the first 72 hours?
• How much effort and time will it take to be ready by 13 May 2027?

Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.

Hospital chains and large labs should name a privacy lead.

Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

1. Name one accountable person, with a deputy.
2. Publish the contact on your website, app and notices.
3. Give the role time, a budget line and a route to management.
4. Set a short monthly report: requests, complaints, incidents, actions.
5. Review the role if you are notified as an SDF.

• Appointment letter
• Published contact
• Monthly report

• Giving the job to IT as a side task
• A contact email nobody reads
• No authority to make changes

• Could we be a Significant Data Fiduciary?
• How do we handle a privacy complaint within 90 days?
• Something has gone wrong. What happens in the first 72 hours?

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

A ransomware attack on the HIS needs a CERT-In report in six hours and the DPDP messages.

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

1. Name one incident lead and a back-up, with phone numbers that work at night.
2. Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
3. Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
4. Decide in advance who signs off each message.
5. Rehearse once a year with the people who would actually be called.

• Incident plan with clocks
• Rehearsal record
• Incident log with times of each step

• Waiting to finish the investigation before telling anyone
• Treating a wrong email or a lost laptop as 'not a breach'
• Only IT knowing the plan

• Which logs must we keep, for how long, and where?
• What must a vendor contract say about personal data?
• Does deletion have to reach backups and test copies?

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

Labs, teleradiology, HIS vendors, TPAs and ambulance services.

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

1. List vendors who receive or can see personal data.
2. Rank them by how much and how sensitive.
3. Add a data-protection schedule to each contract, starting with the top ten.
4. Ask for evidence: certificates, test results, deletion confirmations.
5. Review the top vendors every year.

• Vendor register
• Signed data-protection schedules
• Annual review notes

• Relying on the vendor's standard terms
• No incident-notice time
• No exit and deletion clause

• Something has gone wrong. What happens in the first 72 hours?
• Can personal data be stored or accessed outside India?
• Does deletion have to reach backups and test copies?

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

Large hospital chains and health platforms hold sensitive data at scale; plan as a possible candidate.

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

1. Estimate how many people's data you hold and how sensitive it is.
2. Note any public or security role your data plays.
3. If you are a likely candidate, run a trial impact assessment this year.
4. Identify an auditor you could appoint.
5. Watch MeitY notifications.

• Volume and sensitivity note
• Trial impact assessment
• Board note

• Assuming 'not notified' means 'never'
• Waiting for notification to start
• Thinking only tech companies will be notified

• Do we need a DPO?
• Can personal data be stored or accessed outside India?
• What should the board of directors ask management about DPDP?

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

Access control and vendor contracts take the longest.

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

1. Month 1: name the owner, set a budget line, start the inventory.
2. Months 2 to 3: notices, consent records, contact person, request register.
3. Months 3 to 6: vendor contracts, access control, logs, retention schedule.
4. Months 6 to 8: breach rehearsal, training, internal review.
5. Month 9: management review with evidence.

• Programme plan with owners
• Monthly status with evidence
• Management minutes

• Leaving it to the last quarter
• Buying a tool before knowing the gaps
• Status colours with no evidence behind them

• Do we need a DPO?
• Where does personal data live in our organisation?
• What must a vendor contract say about personal data?