DPDP Act for hospitals: what changes for OPD calls, WhatsApp and patient records

Every OPD collects personal data all day, from a phone number at booking to a prescription at the pharmacy. The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 decide how it may be handled. This guide quotes them where the wording matters and ends with a checklist for each counter.

What the DPDP Act means for a hospital

Four words in the Act do most of the work:

• Data fiduciary: “any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data” (section 2(i)). For patient data, that is your hospital.
• Data principal: the patient, including a child’s parents or lawful guardian (section 2(j)).
• Data processor: anyone who processes personal data on your behalf (section 2(k)), such as your HIS vendor, cloud host or AI receptionist.
• Personal data: “any data about an individual who is identifiable by or in relation to such data” (section 2(t)).

The Act covers data collected digitally, or on paper and digitised later (section 3). It has no separate category for health data, but when the Data Protection Board fixes a penalty it must weigh “the type and nature of the personal data affected” (section 33(2)(b)).

When the duties start, and what applies until then

The Act comes into force in three steps, set by notification G.S.R. 843(E). The Rules follow the same dates, and both appear in the Gazette of India dated 13 November 2025.

The notifications say “eighteen months” after publication rather than naming a date. Counted from the Gazette’s date, that is 13 May 2027. The government’s own summary says the Rules were notified on 14 November, so plan for mid-May 2027 rather than to the day.

Until then, the 2011 rules apply

Until section 44(2) deletes it in May 2027, section 43A of the IT Act, 2000 and the 2011 rules made under it still bind any “body corporate”, meaning “any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities”. Whether a hospital run by a trust or society counts is less clear. The rules treat “medical records and history” as sensitive personal data and require a privacy policy on your website (rule 4), consent “in writing through letter or Fax or email” before collecting it (rule 5(1)), a grievance officer who resolves complaints within one month (rule 5(9)) and a documented security programme (rule 8).

What your notice must say, in Hindi too

Whenever you ask for consent, a notice must come first or with the request (section 5(1)). Under Rule 3 it must stand on its own, list “in clear and plain language”, item by item, the data you collect and why, and give a link to your website or app, and any other way, by which the patient can withdraw consent about as easily as she gave it, use her rights and complain to the Board.

She must have the option of reading it “in English or any language specified in the Eighth Schedule to the Constitution” (sections 5(3) and 6(3)). In practice, write it in plain English and plain Hindi, plus any other scheduled language your patients read, and be ready to give it in another if a patient asks. A short counter version can point to the full notice:

सूचना: [अस्पताल] आपका नाम, नंबर, तकलीफ़ और इलाज की जानकारी आपके अपॉइंटमेंट, इलाज, रिपोर्ट और पर्ची के लिए लेता है। सहमति वापस लेने, जानकारी देखने या सुधरवाने, या शिकायत के लिए [लिंक] देखें या [नाम, ईमेल] से संपर्क करें। आप डेटा प्रोटेक्शन बोर्ड में भी शिकायत कर सकते हैं।

Notice: [Hospital] collects your name, number, complaint and treatment details for your appointment, treatment, reports and prescription. To withdraw consent, see or correct your data, or complain, visit [link] or contact [name, email]. You can also complain to the Data Protection Board.

The Rules don’t say how to give notice on a phone call. One option is a short spoken notice at the start, with the full notice on your website and in your first message. Rule 3 asks for a notice that stands on its own, so have your lawyer check the wording.

Consent on calls and WhatsApp, and when you don’t need it

You need one of two grounds: consent, or one of the “certain legitimate uses” in section 7 (section 4).

Consent must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action”, and limited to the data the purpose needs (section 6(1)). In the Act’s own example, consent given to a telemedicine app covers the telemedicine service, not the phone contacts it also asked for. Withdrawing must be about as easy as consenting, after which you and your processors must stop within a reasonable time (sections 6(4) and 6(6)). If consent is questioned in a proceeding, you must prove it (section 6(10)), so log every yes: who, when, which channel, for what.

Legitimate uses for hospitals include data a patient gives voluntarily for a purpose, unless she objects (section 7(a); the Act’s example is a pharmacy texting a receipt the customer asked for), and “responding to a medical emergency involving a threat to the life or immediate threat to the health” of anyone (section 7(f)).

So a caller who gives her number to book has given it for that booking. WhatsApp messages deserve their own clear yes, which Meta requires anyway (see our WhatsApp guide), and promotions another. An example, written for this guide:

The yes is specific, it comes after she knows what she will get, and stopping is as easy as starting.

Children and patients with a guardian

For anyone under 18 (section 2(f)) you need a parent’s verifiable consent (section 9(1)), checked under Rule 10, and “targeted advertising directed at children” and tracking them are banned (section 9(3)). The Fourth Schedule lifts both for “a clinical establishment, mental health establishment or healthcare professional”, on one condition: “Processing is restricted to provision of health services to the child by such establishment or professional, to the extent necessary for the protection of her health.” That covers treatment, not marketing to the family. For a patient with a lawful guardian because of a disability, Rule 11 asks you to check the guardian was appointed by a court or another authority it names.

How long to keep patient data

The Act sets the end point: erase personal data when consent is withdrawn, or “as soon as it is reasonable to assume that the specified purpose is no longer being served”, unless a law requires you to keep it, and make your processors erase it too (section 8(7)). Hospitals have such laws. Under the 2002 Code of Medical Ethics Regulations, doctors must keep indoor patients’ records for 3 years from the start of treatment, and issue copies within 72 hours of a request (regulations 1.3.1 and 1.3.2).

The Rules set a floor. From 13 May 2027, Rule 8(3) says a data fiduciary “shall retain, in respect of any processing of personal data undertaken by it or on its behalf by a Data Processor, such personal data, associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing”, for purposes such as government requests for information, and then erase them unless another law needs them. Read literally, that covers everything you and your vendors process, including call and message records.

So your retention schedule needs two numbers for each kind of data: the minimum you keep it, and when you delete it.

Security, breaches and penalties

Rule 6 sets the minimum safeguards: encryption, masking or tokens; access control; logs and monitoring; backups; a year of logs; and a security clause in every processor contract.

A breach is “any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data” that compromises it (section 2(u)). A report sent to the wrong WhatsApp number can be one, and so can ransomware that locks your HIS. Under Rule 7:

1. Each affected patient is told “without delay”, plainly, what happened, what it may mean for her, what you are doing and whom to contact.
2. The Board is told “without delay”, then, “within seventy-two hours of becoming aware of the breach”, given the full facts, causes, mitigation and what patients were told.

The penalties are in the Schedule to the Act:

The Board weighs gravity, the type of data, repetition and how fast you acted (section 33(2)).

Your vendors and your patients’ rights

You answer for your processors “irrespective of any agreement to the contrary” (section 8(1)), and may use one “only under a valid contract” (section 8(2)). Each contract should cover safeguards, stopping and erasing on your instruction, a year of data and logs, and help with a 72-hour breach report. The Act itself doesn’t require data to stay in India: the government may restrict transfers to countries it notifies, and stricter laws still apply (section 16).

Patients can ask for a summary of their data and the identities of every fiduciary and processor you shared it with (section 11), have it corrected or erased (section 12), raise a grievance before going to the Board (section 13), and nominate someone to use these rights if they die or become incapacitated (section 14). Rule 14 caps your response to grievances at ninety days, and the government’s summary applies the same limit to access, correction and erasure. Publish a contact for questions about patients’ data, and give it in every reply to a patient using these rights (Rule 9).

A DPDP checklist for your OPD

• Phone line: a short spoken notice; a logged yes before any WhatsApp message; an announcement before any recording (see our guide to call recording); emergencies first.
• Front desk: the notice in Hindi and English; only the data the visit needs; a parent’s or guardian’s yes; a login for each staff member.
• WhatsApp: a separate yes, STOP honoured at once, no promotions without their own yes.
• Doctor’s room: a clear yes before an AI scribe listens; records kept as the law requires.
• Pharmacy: receipts by message when asked; prescription data for dispensing, not offers.
• Back office: a contract with every vendor; a 72-hour breach plan; a retention schedule; a published contact.

Where DrMate fits

With DrMate, your hospital stays the data fiduciary and DrMate processes patient data only for your hospital. Its AI receptionist records no call audio, DrMate is hosted in Microsoft Azure, Central India, and patient data is never sold or used for advertising. Front desk WhatsApp messages go only to patients who said yes. Our safety and privacy page has the details, and our guide to what an AI receptionist should and shouldn’t do covers the phone line.