DPDP for the Legal & compliance in Healthcare

Usually not for the treatment itself. A patient who comes for care gives data voluntarily for that purpose, and a medical emergency involving a threat to life is a listed use. Clinical consent for procedures is a separate medical and legal requirement and stays. Extra uses such as research, marketing, testimonials and sharing beyond what care and billing need do require DPDP consent.

Section 7(a) covers data given voluntarily for a specified purpose; Section 7(f) and 7(g) cover emergencies and epidemics. Section 7 · Section 6 · Section 5 · Rule 3

1. Keep clinical consent forms as they are.
2. Add a short notice at registration.
3. Add separate boxes for research, offers and stories.
4. Record which box each patient ticked.
5. Train front desk to explain the difference.

• Registration notice
• Consent records for extra uses

• One form that bundles treatment and marketing
• Calling clinical consent 'DPDP consent'
• No notice at registration

• What should our privacy notice say, and where must people see it?
• Can we use patient data for research, audits or case studies?
• Can we share patient records with insurers and TPAs?

Research with identifiable patients needs informed consent under research rules and DPDP consent for that use. Clinical audit to improve care within the hospital usually fits the treatment purpose. Case studies and teaching material should be de-identified so patients cannot be recognised. Clinical trials follow the NDCT Rules, 2019.

Section 6 sets consent; Section 17(2)(b) covers research only where no decision is taken about the person and prescribed standards are followed. Section 6 · Section 7 · Section 8(5) · Rule 6

1. Route research through the ethics committee.
2. Take research consent separately.
3. De-identify teaching cases and photos.
4. Limit researcher access.
5. Delete or anonymise at the end.

• Ethics approvals
• Research consents
• De-identification checks

• Photos with faces or tattoos in slides
• Using records for studies without approval
• Keeping research data with names after the study

• Do we need DPDP consent to treat a patient?
• When do we need consent, and when can we rely on a legitimate use?
• How long can we keep personal data?

HIV results, mental health records, MTP registers and PCPNDT records each have their own law. HIV status needs informed consent before disclosure. Mental health records are confidential and cannot go to the media without consent. The MTP admission register is a secret document. PCPNDT records are kept for two years. Give these the tightest access in the hospital.

Section 8(5) asks for safeguards suited to the risk; the special laws set their own rules. Section 8(5) · Rule 6 · Section 8(7) · Rule 8

1. List where these records sit.
2. Restrict access to the treating team.
3. Keep the MTP register with the head of the hospital.
4. Set retention as each law says.
5. Log every access.

• Access settings
• Retention entries
• Access logs

• HIV results visible to all clinicians
• MTP details in general billing
• PCPNDT records deleted early

• Who should be able to see personal data in our systems?
• How long can we keep personal data?
• How do we stop staff looking at records they do not need?

For every use of personal data you need one basis: consent, or one of the legitimate uses in Section 7, such as a legal duty, employment, a medical emergency, or data a person gave voluntarily for a specific purpose. Anything beyond what the person expects, such as marketing, profiling or sharing with partners, usually needs consent.

Treatment rests on the patient's purpose; research, offers and testimonials need consent.

Section 4 allows processing only with consent or for a legitimate use. Section 6 sets what valid consent looks like. Section 7 lists the uses that need no consent. Section 4 · Section 6 · Section 7

1. List each purpose for which you use personal data.
2. Against each purpose, write the basis: consent or the exact clause of Section 7.
3. Where the basis is consent, check that it was asked separately, with a clear action and no pre-ticked box.
4. Stop or re-paper any purpose with no basis.
5. Review the list whenever a new product, campaign or system starts.

• Purpose and basis register
• Consent records with date, version and channel
• Legal sign-off on each legitimate use relied on

• Treating account terms as consent for marketing
• Bundling several purposes in one tick-box
• Relying on 'legitimate interest', which the Indian Act does not have

• What should our privacy notice say, and where must people see it?
• Someone withdraws consent. What has to stop, and how fast?
• Can we send offers to past customers and leads?

A notice must tell people, in plain words, what data you collect, why, how they can withdraw consent, how they can use their rights and how they can complain to the Data Protection Board. It has to stand on its own, separate from long terms and conditions, and be shown at the point where data is collected.

Registration desks, appointment apps, lab forms and health-camp sign-ups need short notices in the languages patients speak.

Section 5 and Rule 3 ask for a notice that can be understood on its own, with an itemised list of the data and the purpose for each item. Data you already hold from before the Act also needs a notice, as soon as reasonably practicable. Section 5 · Rule 3 · Section 6 · Sections 11–14 · Rule 14

1. List every point where personal data comes in: forms, apps, counters, calls, emails, partner feeds.
2. Write one short notice per collection point, with the data items and purpose side by side.
3. Add how to withdraw consent, how to make a request and the DPO or contact person's details.
4. Offer the notice in English and in the languages your patients actually use.
5. Keep each version with the date it went live.

• Screenshots or copies of the notice at each collection point, with dates
• Notice version history
• Translations, where used

• Hiding the notice inside terms and conditions
• One notice for everything, with no link between data items and purposes
• Forgetting old data collected before the Act

• When do we need consent, and when can we rely on a legitimate use?
• Someone withdraws consent. What has to stop, and how fast?
• Someone asks what data we hold about them. What do we send?

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

Labs, teleradiology, HIS vendors, TPAs and ambulance services.

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

1. List vendors who receive or can see personal data.
2. Rank them by how much and how sensitive.
3. Add a data-protection schedule to each contract, starting with the top ten.
4. Ask for evidence: certificates, test results, deletion confirmations.
5. Review the top vendors every year.

• Vendor register
• Signed data-protection schedules
• Annual review notes

• Relying on the vendor's standard terms
• No incident-notice time
• No exit and deletion clause

• Something has gone wrong. What happens in the first 72 hours?
• Can personal data be stored or accessed outside India?
• Does deletion have to reach backups and test copies?

You are a Data Fiduciary when you decide why and how personal data is used, as you do for your own staff and customers. You are a Data Processor when you handle data only on another organisation's instructions. Many organisations are both, for different data sets.

Partner labs and teleradiology providers usually act for you.

Section 2(i) and 2(k) define the two roles. Section 8(1) puts the duties on the Data Fiduciary, which must use processors only under a valid contract. Section 8(1)–(2) · Section 17(1)(d)

1. List each data set you handle.
2. For each, ask: who decides the purpose?
3. Mark yourself as fiduciary or processor, and name the other party.
4. Check that contracts match the role.
5. Route requests about processor data to the fiduciary.

• Role register by data set
• Contracts matching the role

• Calling yourself a processor for data you use for your own purposes
• No contract when you act as processor
• Answering requests that belong to your client

• What must a vendor contract say about personal data?
• Someone asks what data we hold about them. What do we send?
• Can personal data be stored or accessed outside India?

Anyone under 18 is a child under the Act. For a child's data you need verifiable consent from a parent or lawful guardian, and you must not track, behaviourally monitor or show targeted ads to children. Some classes and purposes are exempt under Rule 12 and the Fourth Schedule, for example healthcare to the extent needed to protect the child's health, and educational institutions for their educational work.

Paediatric care is exempt from parent-consent limits only to the extent needed to protect the child's health; marketing to parents of children is not.

Section 9 sets the duties. Rule 10 explains how to verify the parent. Rule 12 and the Fourth Schedule list the exemptions. Section 9 · Rules 10, 12 · Section 6

1. Find where children's data enters: customers, dependants, interns, visitors, scholarships, app sign-ups.
2. Decide whether an exemption in the Fourth Schedule applies to that purpose.
3. Where none applies, add an age question and a parent-consent step.
4. Switch off tracking and targeted ads for under-18 users.
5. Record the decision for each channel.

• Channel-by-channel note on children's data
• Parent-consent records
• Ad and tracking settings

• Assuming 'we are B2B, so no children'
• Using the age 13 or 16 from foreign laws
• Treating a tick-box from the child as parental consent

• When do we need consent, and when can we rely on a legitimate use?
• What should our privacy notice say, and where must people see it?
• Can we send offers to past customers and leads?

Check that the request is in writing, comes from the right authority and cites the legal power. Share only what is asked for, record what you sent and to whom, and keep the request on file. The Act allows processing to meet a legal duty, but it does not mean sharing everything on a phone call.

Police requests for MLC records and court summons are common.

Section 7(d) and 7(e) allow processing to meet a legal duty to disclose to the State, or to comply with a judgment or order. Section 17(1)(c) exempts processing for preventing, detecting or investigating offences. Section 7 · Section 8(5) · Rule 6

1. Route every such request to Legal.
2. Check the authority, the legal power and the scope.
3. Share only what is asked, by a secure method.
4. Log the request, what was sent, by whom and when.
5. Tell the person, unless the law or the authority says you must not.

• Authority request log
• Copies of requests
• Record of what was sent

• Sharing on a phone call
• Sending whole files when a few lines were asked
• No log

• Someone asks what data we hold about them. What do we send?
• How long can we keep personal data?
• Something has gone wrong. What happens in the first 72 hours?

You must erase data that you no longer need for the purpose it was collected for, unless a law requires you to keep it. Where a law does require it, keep the data, stop using it for anything else, and tell the person why it is being kept and until when.

Medical records have legal minimums; a patient's erasure request cannot cut those short.

Section 12 gives the right to correction and erasure. Section 8(7) allows retention only where a law requires it. Rule 8(3) asks every organisation to keep personal data and logs for at least one year first. Sections 11–14 · Rule 14 · Section 8(7) · Rule 8

1. Log the request and verify identity.
2. Check the retention schedule for each record type involved.
3. Delete what has no legal reason to stay, including copies with vendors and in test systems.
4. Mark what must stay, with the law and the end date.
5. Reply in plain words: what was deleted, what is kept, why and until when.

• Erasure log
• Vendor deletion confirmations
• Reply to the person

• Refusing every erasure request 'because of backups'
• Deleting records a law requires
• Not telling vendors

• How long can we keep personal data?
• Does deletion have to reach backups and test copies?
• Someone asks what data we hold about them. What do we send?