DPDP for Healthcare

What changed: the end of "sensitive personal data"

The SPDI Rules under the Information Technology Act singled out medical records and history, and physical, physiological and mental health condition for heightened protection as sensitive personal data.

The DPDP Act removes that tiering entirely. There is no sensitive category. A patient's diagnosis, a name and an email address all attract the same statutory baseline.

This is not a relaxation, and reading it as one is the mistake to avoid. Three reasons:

• The baseline itself is considerably higher than the SPDI regime — purpose limitation, valid consent, notice, rights, breach intimation and erasure now apply to all personal data.
• Section 33(2) requires the Board to have regard to the type and nature of the personal data affected when setting a penalty. Health data does not attract a special obligation, but it will attract a larger number.
• Sectoral obligations continue independently. Clinical establishment regulation, medical council ethics requirements on confidentiality, and the various digital health mission standards are unaffected by DPDP and impose their own retention and confidentiality duties.

So the correct summary is: the category is gone, the risk is not, and the obligations went up.

The Fourth Schedule carve-out, and why it exists

Section 9 requires verifiable parental consent before processing a child's personal data, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. A child is an individual who has not completed eighteen years.

Applied literally to a hospital, that would mean a treating clinician could not process a sixteen-year-old's data without first verifying parental identity — including in circumstances where doing so would delay care.

Section 9(4) permits sub-sections (1) and (3) to be disapplied for prescribed classes, purposes and conditions, and Rule 12 with the Fourth Schedule does exactly that. Part A begins with:

Note how tightly the conditions are drawn. The carve-out is purpose-bound, not entity-bound. A hospital does not step outside section 9 generally — it steps outside it for the provision of health services to that child, to the extent necessary for the protection of her health.

Which means the carve-out does not cover:

• marketing to a paediatric patient or their family
• analytics, research or product development using children's data outside the treatment purpose
• appointment reminders and engagement messaging beyond what the treatment requires
• anything a hospital does in its commercial rather than clinical capacity

A hospital running a patient-engagement app is inside the carve-out for clinical functions and outside it for the rest, in the same system.

Medical emergencies and the legitimate uses

Section 7 permits processing without consent in several situations directly relevant to care delivery, including where processing is necessary:

• for responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or another individual
• for taking measures to provide medical treatment or health services during an epidemic, outbreak of disease or other threat to public health
• for taking measures to ensure safety of, or provide assistance or services to, individuals during a disaster or breakdown of public order

These are situational rather than blanket. An emergency admission is covered; the subsequent twelve months of routine outpatient processing is not covered by the emergency limb and rests on other bases.

Where healthcare's real difficulty sits

Not in the carve-out — in the estate.

Hospital data landscapes are typically the most fragmented of any sector: a hospital information system, an electronic medical record, radiology and laboratory information systems, pharmacy, billing, insurance and third-party administrator interfaces, appointment platforms, teleconsultation tools, and a long tail of departmental spreadsheets and legacy systems that nobody owns.

Three obligations become hard specifically because of that fragmentation:

Section 11 access requests. The individual is entitled to a summary of processing and the identities of all other Data Fiduciaries and Processors with whom the data was shared. In a hospital that chain runs to insurers, TPAs, referral labs, and sometimes research collaborations. Answering accurately requires a sharing register that most hospitals do not have.

Section 12 erasure. You cannot erase across systems you have not inventoried, and clinical records are subject to retention requirements that vary by record type.

Section 8(5) safeguards. The highest-penalty obligation, applied across an estate with legacy systems, shared workstations and clinical urgency working against access control.

What to build, in order

1. Inventory the estate. Every system holding patient personal data, including the departmental long tail. Nothing downstream is possible without this.
2. Build the sharing register — insurers, TPAs, labs, referral partners, research. Required to answer section 11.
3. Map the carve-out boundary in your systems. Which processing is clinical treatment of a child, and which is commercial. They will share infrastructure.
4. Separate clinical from commercial consent. Treatment processing and marketing or engagement processing need different bases and different records.
5. Retention rules per record type, sourced from the applicable clinical and statutory instruments.
6. Rights intake with identity verification appropriate to a clinical setting, including proxy access for family members and the section 14 nomination right.
7. Breach process covering DPDP intimation and CERT-In, from one detection event.

Where Consiva fits

Consiva provides the data inventory and sharing register, purpose-level consent separating clinical from commercial processing, rights intake with verification, and the retention register per record type. The clinical determinations — what is necessary for the protection of a child's health, what a record type requires — are medical and legal judgements that stay with your clinicians and counsel.

Data Discovery, ROPA auto-generation and the SDF module are on Enterprise, with on-premise deployment available for estates that cannot use a hosted platform. The clinical determinations — what is necessary for the protection of a child's health, what a record type requires — stay with your clinicians and counsel. → Pricing

Frequently asked questions

Verified against the Gazette of India on 17 August 2026. Sources: Digital Personal Data Protection Act, 2023, ss. 7, 9, 11, 12, 33(2); DPDP Rules, 2025, Rule 12 and Fourth Schedule Part A. Clinical record retention requirements must be confirmed from the applicable instrument. Reference material about the law, not legal advice — see /disclaimer.