DPDP for the Internal audit head in Healthcare

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Code of Medical Ethics, 2002 · MoHFW · Tamil Nadu health department FAQ · MTP Regulations

In a hospital, internal audit can test what really happens to patient data: on the ward, in the records room and in the hospital information system.

Written for: Internal audit head, Healthcare and hospitals. Open this seat in the interactive tool

What is different here

Hospitals already go through accreditation and clinical audits, so a lot of paper exists. Your question is whether the controls actually run: whether flagged records need a reason, whether TPAs get only claim documents, and whether PCPNDT and MTP records are kept as their laws say.

The first four things to sort out

Sample ten patient records and trace who opened them in the hospital information system.
Check that break-glass and VIP record openings were reviewed.
Read three contracts: a partner lab, the teleradiology provider and the HIS vendor.
Test whether retention follows the legal minimum for each record type.

A worked example

Internal audit head

Testing whether break-glass access is reviewed

Week 1Audit picks twenty break-glass openings from last quarter in the hospital information system.
Week 2Some have a review note from the clinical head; the rest have none.
Week 3The finding goes to DPO / Management with an owner and a date.
AfterA weekly review starts, and audit retests in six months.

Evidence kept

Sample list
Access log extract
Review notes
Management response

A break-glass rule is only as good as its review.

What others in the sector usually do. Some hospitals add a few DPDP tests to their existing accreditation or clinical audit cycle, so the same evidence serves both.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Multi-specialty hospital chain	Shared logins on ward computers; Reports forwarded on messaging apps; VIP or staff records viewed out of curiosity
Standalone hospital or nursing home	Paper case sheets at nursing stations; Vendor remote access to the hospital software; Records room with no access log
Diagnostic labs and imaging	Report links sent to the wrong number; Franchisees keeping patient lists; PCPNDT records and images
Health-tech and telemedicine	Analytics and ad SDKs in health apps; Chat transcripts kept with no period; Sharing user data with partner pharmacies for offers
Pharmacy chain and e-pharmacy	Prescription images in the app and with stores; Refill reminders used for marketing; Delivery partners with addresses and order details

Control map: DPDP to NIST CSF 2.0 and ISO/IEC 27001:2022

DPDP duty	Law	NIST CSF 2.0	ISO/IEC 27001 Annex A	Evidence
Know where personal data is	Section 8(5) · Rule 6	ID.AM-02, ID.AM-07	5.9, 5.12	Inventory of systems and data types, with owner and hosting location
Only the right people get in	Section 8(5) · Rule 6	PR.AA-01, PR.AA-05	5.15, 5.16, 5.18, 8.2	Role matrix, quarterly access review sign-off, leaver removal report
Strong sign-in for admins and remote users	Section 8(5) · Rule 6	PR.AA-03	5.17, 8.5	MFA enforcement report for admin, VPN and email accounts
Encrypt or mask data	Section 8(5) · Rule 6	PR.DS-01, PR.DS-02	8.11, 8.24	Encryption settings for databases, laptops, backups and transfers; masking in test copies
Keep and watch logs	Section 8(5) · Rule 6	PR.PS-04, DE.CM-01, DE.CM-03	8.15, 8.16, 8.17	Log retention settings (one year; 180 days in India for CERT-In), alert rules, NTP source
Backups that restore	Section 8(5) · Rule 6	PR.DS-11, RC.RP-03	8.13, 5.30	Backup schedule, offline copy, last restore test with date and result
Separate networks	Section 8(5) · Rule 6	PR.IR-01	8.20, 8.22	Network diagram showing segments, firewall rule review
Patch and fix weaknesses	Section 8(5) · Rule 6	ID.RA-01	8.8	Vulnerability scan results and closure tracker
Handle incidents and tell people	Section 8(6) · Rule 7	RS.MA-01, RS.CO-02, RS.CO-03	5.24, 5.25, 5.26, 6.8	Incident plan with the 6-hour and 72-hour steps, drill record, contact list
Learn from incidents	Section 8(6) · Rule 7	DE.AE-02, ID.IM-01	5.27, 5.28	Post-incident review and actions closed
Vendors protect data too	Section 8(1)–(2)	GV.SC-05, GV.SC-07	5.19, 5.20, 5.22	Contracts with data terms, vendor review record
Data comes back or is deleted at contract end	Section 8(7) · Rule 8	GV.SC-10	5.20, 8.10	Exit clause and deletion certificate from the vendor
Cloud is set up safely	Section 16 · Rule 15	GV.SC-05, PR.DS-01	5.23	Cloud region list, shared-responsibility note, configuration review
Delete when the purpose is over	Section 8(7) · Rule 8	PR.DS-01	8.10, 7.14	Retention schedule, deletion log, disposal certificates for disks and paper
People know the rules	Section 8(5) · Rule 6	PR.AT-01	6.3	Training attendance and short test results by department
Legal duties are tracked	Section 8(5) · Rule 6	GV.OC-03	5.31, 5.34	Register of laws and rules that apply, reviewed yearly
Roles are named	Section 8(9)–(10) · Rules 9, 14	GV.RR-02	5.2, 5.4	Named owners for each system and each duty, approved by management

Logs, backups and access checklist

Logs. Access and activity logs for systems holding personal data are kept for at least one year (DPDP Rule 6 and Rule 8(3)).
Logs. ICT system logs are kept for 180 days, within India, as the CERT-In Directions of 28 April 2022 require.
Logs. System clocks are synced to the NTP servers of NIC or NPL, or to servers traceable to them, as CERT-In asks.
Clocks. Reportable cyber incidents can be reported to CERT-In within six hours of being noticed.
Clocks. Affected people and the Data Protection Board are told without delay, and the Board gets a detailed report within 72 hours.
Backups. At least one backup copy is offline or immutable, and a full restore was tested in the last six months.
Backups. Backup retention matches the retention schedule, so deleted records do not live on for years in old copies.
Access. Privileged and remote accounts use multi-factor sign-in.
Access. Access rights are reviewed every quarter, and leavers are removed on their last working day.
Access. Shared or generic logins are replaced with named accounts, or are tied to a named person in a register.
Vendors. Vendor remote access is named, time-bound and logged.
Test data. Test and training systems use masked data, not live copies.
Devices. Imaging and lab devices are on a separate network, with vendor access through a controlled gateway.
Downtime. Written downtime procedures exist for wards, labs and pharmacy, and were rehearsed this year.

10 questions the Internal audit head asks, answered in full

Can we share patient records with insurers and TPAs?

Short answer: Yes for the patient's claim; only what it needs

Yes, for a claim the patient has asked for, because that is part of the purpose. Share only what the claim needs, through the TPA portal or a secure channel, and keep a record of what was sent. Sharing for anything else, such as an insurer's own marketing, needs consent.

What the law says

Section 7(a) covers the claim purpose; Section 8(1) and 8(5) apply to how data is sent. Section 7 · Section 8(5) · Rule 6 · Sections 11–14 · Rule 14

Steps

Use TPA portals, not email.
Send only claim documents.
Log what was sent, to whom, when.
Answer patient questions about sharing.
Check TPA agreements.

Evidence to keep

Sharing log
TPA agreement

Common mistakes

Full case files by email
No record of what was sent
Insurer representatives reading records on wards

Imaging machines and lab analysers hold patient data. What do we do?

Short answer: Separate network, controlled vendor access, wipe before disposal

Imaging and lab devices store names, ages and results, often on old operating systems. Put them on a separate network, control vendor remote access, change default passwords, and wipe disks before a device is returned or scrapped.

What the law says

Rule 6 safeguards apply to devices that store personal data. Section 8(5) · Rule 6 · Section 8(7) · Rule 8

Steps

List devices that store patient data.
Segment them.
Control vendor remote access.
Change default passwords.
Wipe before disposal.

Evidence to keep

Device list
Network diagram
Wipe certificates

Common mistakes

Devices on the general network
Vendor modems always on
Disks leaving with old machines

Can a policy show that a control actually works?

Short answer: No; operation needs records

No. A policy shows what an organisation intends. It does not show that the control runs. To show operation you need records: a deletion log, an access review sign-off, a drill report, a sample of requests answered on time. Auditors and regulators look for these.

From your seat: Internal audit head. Test operation, not existence. Pick five records and trace each one end to end.

What the law says

Section 8(4) asks for appropriate technical and organisational measures to ensure compliance. Being able to show those measures work is part of meeting that duty. Section 8(5) · Rule 6 · Section 8(1)–(2)

Steps

For each policy, write the record that would show it working.
Check whether that record exists for the last quarter.
Where it does not, start producing it.
Sample a few records every quarter.
Keep the samples with the policy.

Evidence to keep

Policy-to-record map
Quarterly samples
Gaps and actions

Common mistakes

Approving policies with no record behind them
Showing a policy when asked for evidence
Records that exist only before an audit

What evidence should exist before management accepts that we are ready?

Short answer: Evidence for each duty, not status colours

Before accepting a readiness statement, management should see evidence for each duty: dated notices, consent records, a request register with replies, signed vendor terms, access review sign-offs, log settings, a breach drill report and a deletion log. A status colour without these is a statement, not evidence.

From your seat: Internal audit head. Ask for the evidence list before you accept any readiness statement.

What the law says

The Act places duties on the Data Fiduciary as an organisation. Management is accountable for whether they are actually met. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(9)–(10) · Rules 9, 14

Steps

List the duties that apply.
For each, name the piece of evidence that would satisfy an auditor.
Ask owners to attach it.
Mark duties without evidence as open, not ready.
Review the list before each management sign-off.

Evidence to keep

Duty-to-evidence list
Attached evidence
Sign-off record

Common mistakes

Accepting 'done' without seeing anything
Counting policies as evidence
One sign-off and no review after

Can management trust the DPDP position it is shown?

Short answer: Only as far as the evidence behind it

Only as far as the evidence behind it. Ask three things: what was actually tested, what rests only on someone's statement, and what was not looked at. A position built from answers alone may describe what people believe, not what happens with the data.

From your seat: Internal audit head. Your report is one of the few independent views management gets. Say what was tested and what was not.

What the law says

Accountability under the Act sits with the organisation; management oversight is how that accountability becomes real. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 10 · Rule 13

Steps

Ask for the position split into tested, stated and not looked at.
Ask for two or three samples you can see.
Ask who reviewed the evidence.
Ask what changed since the last review.
Record the answers in minutes.

Evidence to keep

Position with tested and stated parts
Samples seen
Minutes

Common mistakes

Trusting a single summary slide
No difference between stated and tested
No record of what management saw

How do we put DPDP into the risk register?

Short answer: One line per duty, with owner and evidence

Turn each duty into a risk line with an owner, a control, evidence and a review date. Map controls you already run for your regulator, auditors or certifications, so the same evidence serves several purposes. Track vendor risk separately.

From your seat: Internal audit head. Check that each DPDP line has a control you can actually test.

Example in Healthcare

Add downtime and wrong-send lines.

What the law says

The Act sets duties in Sections 5 to 12. A risk register shows management where each duty stands. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 10 · Rule 13

Steps

List the duties that apply to you.
For each, write the risk in plain words, the control and the owner.
Link existing controls and audits as evidence.
Rate likelihood and impact in your usual way.
Review every quarter with management.

Evidence to keep

Risk register extract
Linked evidence
Quarterly review minutes

Common mistakes

One line saying 'DPDP compliance'
No owners
Evidence that is only a policy document

Which logs must we keep, for how long, and where?

Short answer: At least one year; 180 days of ICT logs in India

Keep logs that show who accessed personal data and what they did, for at least one year under the DPDP Rules. CERT-In separately asks for ICT system logs to be kept for 180 days within India. Logs must be protected so nobody can quietly change them.

From your seat: Internal audit head. Sample whether logs exist for the period, not just whether logging is switched on.

Example in Healthcare

HIS and PACS access logs show who opened which record; keep them a year.

What the law says

Rule 6 lists logs and monitoring as a minimum safeguard. Rule 8(3) asks for logs to be kept for at least one year. The CERT-In Directions of 2022 ask for 180 days of ICT logs kept within India. Section 8(5) · Rule 6 · Section 8(7) · Rule 8

Steps

List systems holding personal data and what each logs today.
Turn on access logging where it is missing.
Send logs to one protected store, with at least one year of retention.
Keep a copy of ICT logs in India for at least 180 days.
Sync clocks and review alerts every day.

Evidence to keep

Log source list
Retention settings
Alert review records

Common mistakes

Logging only failures, not who viewed a record
Logs stored on the same server they describe
Clocks out of sync, so timelines cannot be built

What must a vendor contract say about personal data?

Short answer: Yes, every vendor that touches personal data

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

From your seat: Internal audit head. Pick the three largest vendors and read their contracts against the six things.

Example in Healthcare

Labs, teleradiology, HIS vendors, TPAs and ambulance services.

What the law says

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

Steps

List vendors who receive or can see personal data.
Rank them by how much and how sensitive.
Add a data-protection schedule to each contract, starting with the top ten.
Ask for evidence: certificates, test results, deletion confirmations.
Review the top vendors every year.

Evidence to keep

Vendor register
Signed data-protection schedules
Annual review notes

Common mistakes

Relying on the vendor's standard terms
No incident-notice time
No exit and deletion clause

Who should be able to see personal data in our systems?

Short answer: Only those who need it, reviewed every quarter

Only people who need it for their job, and only the part they need. Use named accounts, give access by role, review it every quarter and remove it on the day someone leaves. Watch privileged accounts closely.

From your seat: Internal audit head. Compare the access list with the HR leavers list.

Example in Healthcare

End shared ward logins; flag VIP and staff records.

What the law says

Rule 6 names access control as a minimum safeguard, along with logs and monitoring that can detect misuse. Section 8(5) · Rule 6

Steps

Write a role matrix for each key system.
Replace shared logins with named accounts.
Use multi-factor sign-in for admin and remote access.
Review access every quarter with each manager.
Remove access on the last working day.

Evidence to keep

Role matrix
Quarterly review sign-offs
Leaver removal report

Common mistakes

Generic logins on shared machines
Access that only grows
No review of vendor accounts

Something has gone wrong. What happens in the first 72 hours?

Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

From your seat: Internal audit head. Ask for the last drill record and its findings.

Example in Healthcare

A ransomware attack on the HIS needs a CERT-In report in six hours and the DPDP messages.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

Steps

Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.

Evidence to keep

Incident plan with clocks
Rehearsal record
Incident log with times of each step

Common mistakes

Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan

The sections you will use most

Section 8(5) · Rule 6: Security safeguards. HIS, PACS, lab systems and shared workstations need access control and logs.
Section 8(1)–(2): Responsibility for vendors. Labs, billing vendors, teleradiology providers and hospital software vendors process data for you.
Section 8(6) · Rule 7: Telling people about a breach.
Section 8(7) · Rule 8: Erasure and retention.
Section 8(9)–(10) · Rules 9, 14: Contact person and complaints.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002	Regulation 1.3.1: keep indoor patients' medical records for 3 years from the start of treatment. Regulation 1.3.2: issue records to patients, authorised attendants or legal authorities within 72 hours of a request. Regulation 2.2: keep patient confidences.	Set retention at or above these minimums. Use the 72-hour record copy rule as the base for patient access requests.	Code of Medical Ethics, 2002
Telemedicine Practice Guidelines, 2020 (Appendix 5 to the 2002 Regulations)	Consent is implied when the patient starts a teleconsultation and must be explicit when a health worker or caregiver starts it. The doctor records consent and keeps logs, records and prescriptions as for in-person care.	Telemedicine apps must add DPDP notices and protect chat, video and prescription data.	MoHFW
Pre-Conception and Pre-Natal Diagnostic Techniques (PCPNDT) Act, 1994	Records of tests and procedures, including Form F, must be preserved for 2 years, or until a legal proceeding ends.	These records cannot be erased early on request; protect them carefully.	Tamil Nadu health department FAQ
Medical Termination of Pregnancy Regulations, 2003	The admission register is a secret document, kept by the head of the hospital, not open to inspection except under law, and kept for five years.	MTP records need the tightest access in the hospital.	MTP Regulations
Mental Healthcare Act, 2017	Section 23: right to confidentiality. Section 24: no photos or information to media without consent. Section 25: right to access basic medical records.	Psychiatry and counselling records need separate access and a careful request process.	NHSRC copy of the Act
HIV and AIDS (Prevention and Control) Act, 2017	HIV status may be disclosed only with informed consent, except in narrow cases. Establishments keeping HIV-related records must adopt data protection measures.	Restrict HIV results and counselling notes to the treating team.	Act
New Drugs and Clinical Trials Rules, 2019	Informed consent of trial participants; ethics committees keep records for five years after the trial ends (Rule 13).	Trial data needs both informed consent and DPDP safeguards.	NDCT Rules
Drugs Rules: Schedule H1 register	Pharmacies record prescriber's name and address, patient's name, drug and quantity, kept for three years.	Keep the register for three years, then dispose of it.	NHSRC
ABDM Health Data Management Policy	For entities in the Ayushman Bharat Digital Mission, health records are shared through a consent manager, with consent artefacts for each request.	If you are ABDM-linked, the ABDM consent flow and your DPDP notices must agree.	ABDM / NHA
Clinical Establishments Act, 2010 and Rules, 2012 (states that adopted it)	Registered establishments maintain medical records, and electronic records as the government specifies.	Check whether your state follows this Act or its own nursing home law.	MoHFW
IRDAI health insurance master circular, 2024	Insurers decide cashless requests within one hour and final discharge within three hours.	Fast TPA sharing is needed, but only the records the claim needs, through secure channels.	IRDAI
CERT-In Directions, 2022	Report specified cyber incidents within six hours; keep ICT logs 180 days in India.	A ransomware attack needs a CERT-In report and the DPDP messages.	CERT-In