Clinics and hospitals under the DPDP Act: what about emergencies?

A clinic or hospital holds patient data, and the DPDP Act treats it as personal data like any other. The Act and the Rules do not set up a separate category for health data, and they have no separate rules for medical records. What they do give you are a few uses that need no consent, a limited exemption for children’s data, and the same duties on vendors, retention and breaches that other Data Fiduciaries carry from 13 May 2027.

What the Act covers in a clinic

Personal data is any data about an individual who can be identified by or in relation to that data. The Act applies to digital personal data, which includes data collected on paper and digitised afterwards. A register that is written by hand and never entered into a computer is outside it. Appointment systems, billing software, scanned reports, WhatsApp messages and cloud storage are inside it.

The Act’s list of exemptions names no clinic or hospital, and its definitions set no size threshold. A single-doctor practice and a hospital company can each be a Data Fiduciary, because the Act’s word person covers individuals, firms and companies, and a Data Fiduciary is any person who decides why and how personal data is processed.

What the video shows

• How Sample Hospital fills in its DPDPA documents.
• Patient records, vendors, retention and a breach. Made-up names and data.
• RoPA tracker
• Each way Sample Hospital uses patient data gets one row.
• Pick the legal basis from the Act's own list.
• Responding to a medical emergency that threatens life, or is an immediate threat to health, is one of the uses the Act lists.
• sheet rows: Send appointment reminders by SMS / Consent (S.6) / Name, phone number, appointment date; Send the receipt the patient asked for / Legitimate Use - S.7(a) voluntary purpose / Name, phone number, bill amount; Admit a patient in a life-threatening emergency / Legitimate Use - S.7(f) medical emergency / Name, vitals, allergies
• Vendor risk assessment
• The lab and the pharmacy supplier both handle patient data. List each one.
• Mark how sensitive the data is.
• A processor serving your patients needs a valid contract. You stay responsible.
• Data retention schedule
• Keep data and processing logs at least a year, for uses by the State that the Rules list. Then erase, unless another law requires longer.
• If another law requires longer, the Act lets you keep the data for that long.
• Breach register
• A lab report is emailed to the wrong patient. Log it when you become aware.
• Each affected patient and the Board are told without delay.
• The detailed report to the Board is due within 72 hours of becoming aware.

Which ground fits which activity

A Data Fiduciary may process personal data only with the person’s consent or for one of the certain legitimate uses the Act lists. The table sets the uses that matter most in healthcare beside what the text says.

The emergency use covers responding to a medical emergency that threatens life or immediately threatens health. The list has no separate entry for routine treatment, so ask counsel which ground your own front-desk and consulting-room activities rest on. A consent request must be limited to the data that is necessary for its purpose. The Act’s telemedicine example makes the point: an app may ask for the person’s data to provide the service, but her phone contact list is not necessary for it, so her consent is limited to the data needed for the service.

A use that needs no consent still sits inside the Act. Security safeguards and breach reporting apply to this data too.

Lab, pharmacy and other vendors

A Data Processor is a person who processes personal data on behalf of a Data Fiduciary. Whether an outside lab, pharmacy, billing company or software supplier is your processor depends on who decides why and how the data is used. In the Act’s own example, a company that emails a telecom provider’s bills to its customers is the Data Processor, and the telecom provider is the Data Fiduciary.

• You stay responsible for processing done on your behalf, whatever the contract says.
• You may engage a processor for offering goods or services only under a valid contract.
• Your security safeguards must include an appropriate contract provision with the processor, wherever applicable.
• A patient who gave you her data, with consent or voluntarily for a purpose, can ask for the identities of the other Data Fiduciaries and Data Processors you shared it with, and a description of what was shared. Sharing with another Data Fiduciary authorised by law to obtain the data, on its written request to prevent, detect or investigate offences or cyber incidents, or to prosecute or punish offences, is excluded. Keep a list of who receives patient data.

See processors and vendors for what goes into the contract.

Children as patients

A child is anyone under eighteen, and the Act asks for a parent’s verifiable consent before any processing of a child’s personal data. The Rules lift that duty, and the ban on tracking children, for clinical establishments, mental health establishments and healthcare professionals, but only where processing is restricted to providing health services to the child, to the extent necessary for the protection of her health. Allied healthcare professionals have the same relief where processing is restricted to supporting implementation of a healthcare treatment and referral plan recommended by that professional for the child, to the extent necessary for the protection of her health.

The duty not to process a child’s data in a way likely to harm her well-being is not lifted by these exemptions. Read the children’s data article for the full list of exemptions.

Keeping and erasing records

You must erase personal data when the patient withdraws consent, or when it is reasonable to assume the purpose is no longer served, whichever is earlier, unless retention is necessary for compliance with a law. Neither the Act nor the Rules names a retention period for medical records, so check whether another law that applies to you requires you to keep them.

Separately, the Rules require you to keep personal data, associated traffic data and logs of the processing for at least one year from the date of the processing, for the purposes the Rules list, then erase them unless another law requires longer. The three-year inactivity limit applies only to large e-commerce, online gaming and social media platforms. See how long you can keep data.

If patient data leaks

The Rules set minimum safeguards for a Data Fiduciary: encryption, masking or tokens; access controls; logs and monitoring; backups; and, wherever applicable, a contract provision with each processor. After a breach you must tell each affected person without delay, and tell the Board without delay, with a detailed report to the Board within 72 hours of becoming aware of the breach. The Act sets ceilings of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify. See the breach article.

Before 13 May 2027

• List every system that holds patient data and every vendor that receives it.
• Decide the ground for each activity, and write a consent notice for the others. What a notice must contain.
• Publish a contact for questions and a grievance period of no more than 90 days.
• Put a contract in place with each processor, and prepare the breach notices in advance.