DPDP Insights › Questions › Townships, hospitals and schools run by the PSU: what applie

Question · Public sector undertakings and utilities

Townships, hospitals and schools run by the PSU: what applies?

Short answer: Yes, full duties for each service

These hold residents', patients' and students' data. Each needs a notice, access limits and retention. PSU hospital records follow medical record rules; school records may involve children, where Fourth Schedule exemptions for educational institutions and healthcare may apply to some purposes.

What the law says

Sections 5, 8(5), 8(7) and 9 apply to each service.

Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
Section 9 · Rules 10, 12: For anyone under 18, get verifiable consent from a parent or lawful guardian, and do not track, behaviourally monitor or target advertising at children. Rule 12 and the Fourth Schedule exempt some classes and purposes, for example clinical establishments and healthcare professionals to the extent needed to protect the child's health.
Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.

Steps

List township services that hold personal data.
Give each a notice.
Restrict medical records.
Check children's data rules for schools.
Set retention.

Evidence to keep

Service list
Notices
Access settings

Common mistakes

Township PCs with no security
Medical records visible to HR
School data with no parent notice

From each seat

CISO / Security head: Bring township systems under central control.
HR head: Separate medical from HR records.
Unit, plant or region head: These services are in your unit.
Administration department: Township offices are yours.

What a good answer from management sounds like

“Each township service has a notice, restricted access and a retention period.” Effort and time: Medium.