Hospitals, contract research organisations (CROs) and drug developers hold some of India’s most sensitive personal data with heightened harm potential from cyber criminals. This includes patient records, trial datasets, genomic results and what not. Now, a new law is set to govern how you collect, use and share it, and that is DPDPA.
DPDPA compliance for healthcare and life sciences now has a fixed date. The Digital Personal Data Protection Act, 2023 (DPDPA) and its Rules commence in phases. Most obligations apply from May 13, 2027, which leaves around seven months to prepare.
Seven months is enough only if the work runs in the right order. The blog examines the official text of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 points against the security needs, vendor contracts and consent. We believe much published guidance is getting this wrong and so the sections below follow the law.
Read our case study where we operationalised DPDPA across a healthcare data–processing environment: Securing Patient Trust Through Audit-Ready DPDPA Compliance.
What DPDPA compliance for healthcare and life sciences requires, and when
The DPDPA does not apply all at once. Its obligations arrive in three phases, and your role in each data flow decides which of them fall on you.
Fiduciary or processor
The Act places primary accountability on the Data Fiduciary, the entity that decides why and how personal data is processed. In this sector, that is usually the hospital, diagnostic chain or trial sponsor. CROs, central laboratories and cloud providers acting on instructions are Data Processors.
Why health data draws closer scrutiny
The Act has no separate category for sensitive data. When the Board sets a penalty, it must consider the type and nature of the personal data affected, and patient and genomic records sit at the serious end of that scale.
Start by recording your role for each major data flow. Many organisations act as a fiduciary for some flows and a processor for others.
The commencement timeline
The Rules were notified in Nov 2025, and the provisions setting up the Data Protection Board of India (the Board) took effect that day. Consent Manager registration opens on Nov 13, 2026.
Notice, consent, security safeguards, breach reporting, children’s data, cross-border transfers, exemptions and penalties all commence on May 13, 2027. Until then, the 2011 data protection rules under the Information Technology Act remain in force.
Priority one: security safeguards and breach readiness
Security failures carry the heaviest penalties under the Act. They are also the slowest gaps to close, because they depend on tested systems and trained teams.
The minimum safeguards under Rule 6
Rule 6 sets a floor for every fiduciary, and it extends to processing done by vendors. The minimum measures include:
- Encryption, obfuscation, masking or virtual tokens to protect personal data
- Access controls on the computer systems used by the fiduciary and its processors
- Logs, monitoring and review that can detect and investigate unauthorised access
- Backups and similar measures to keep processing running after an incident
- One-year retention of those logs, unless another law requires longer
- Security clauses in every contract with a Data Processor
How breach reporting works under Rule 7
Rule 7 runs on two tracks. Each affected patient or participant must be informed without delay, through their account or registered contact details. The Board must receive an initial description without delay, followed by a detailed report within 72 hours. Every personal data breach triggers these duties, whatever its scale.
The 72-hour window applies only to the detailed report to the Board.
Where the largest penalties sit
The Schedule to the Act ties its highest penalties to this area. Failing to take reasonable security safeguards can attract up to ₹250 crore. Failing to notify the Board or affected individuals can attract up to ₹200 crore. Breaches of provisions without their own entry, including most consent failures, are capped at ₹50 crore.
Test your safeguards against Rule 6 now, and rehearse both notification tracks before an incident does it for you.
Priority two: vendor, CRO and cross-border accountability
Most hospitals and sponsors rely on CROs, laboratories and cloud providers to handle patient and trial data. The DPDPA keeps the fiduciary accountable for all of them, wherever the data goes.
Why contracts do not move liability
Under Section 8(1), a fiduciary remains responsible for processing done on its behalf, irrespective of any agreement to the contrary. A sponsor whose CRO suffers a breach still answers to the Board for it.
What processor contracts should cover
The Act requires a valid contract before a processor is engaged, and Rule 6 requires security clauses in it. The fiduciary must also make processors erase data once the purpose ends. In practice, contracts should set security standards, breach cooperation timelines, audit rights and erasure on exit.
Cross-border trial data
Global trials send data to foreign sponsors, safety boards and laboratories. Section 16 allows these transfers by default. The government may restrict transfers to specific countries by notification, and it has not issued any such list. Significant Data Fiduciaries (SDFs) carry one added risk: Rule 13 lets the government require that specified personal data stays in India.
Re-paper the vendors that handle the largest volumes of patient or trial data first.
Priority three: consent, coded data and exemptions
Consent and research rules decide whether patient and trial data can be used at all. They also offer more room than many organisations assume, provided the conditions are met.
Coded clinical data is still personal data
The Act defines personal data as data about an individual who is identifiable by or in relation to that data. Trial datasets that swap names for codes usually meet that definition, because a sponsor or site keeps the key. The Act does not define anonymisation, so this is a reading of the law. It is still the safer assumption for any linkable dataset.
Purpose-specific consent and legacy consent
Consent must be free, specific, informed, unconditional and unambiguous, and limited to the data the stated purpose needs. The Act’s own example is a telemedicine app: a patient’s consent covers consultations but not her phone contacts, which the service does not need. Broad clauses covering unnamed future research or AI training sit poorly with this standard.
Existing data is not automatically lost. For consent given before commencement, the fiduciary must send a notice as soon as reasonably practicable and may keep processing until the person withdraws. Withdrawal must be as easy as giving consent.
Where the exemptions apply
Three exemptions matter most in this sector:
- Research, archiving and statistical processing is exempt if the data is not used for decisions about specific individuals and meets the standards in the Second Schedule of the Rules.
- Responding to a medical emergency, or treating people during an epidemic or outbreak, needs no consent.
- Clinical establishments and healthcare professionals can process a child’s data without parental consent, but only to provide health services needed to protect the child’s health.
None of these exemptions removes the duty to protect the data. Audit your consent forms now against how the data is used.
A DPDPA compliance roadmap for healthcare and life sciences
With about seven months left before enforcement, the order of work matters. A practical sequence looks like this:
- Nov 2026 to Jan 2027: map patient, clinical and research data flows. Record your role for each flow and test current safeguards against Rule 6.
- Feb to Apr 2027: re-paper high-volume vendors and CROs. Revise consent notices, send notices for legacy data and run breach drills covering both tracks.
- May 2027 onward: keep evidence of compliance, since the fiduciary must prove that valid notice and consent were given. Prepare for possible SDF designation, which brings an India-based Data Protection Officer, an independent data auditor and an annual impact assessment and audit.
Conclusion
DPDPA compliance for healthcare and life sciences comes down to sequence. Security safeguards and breach readiness carry the highest penalties and take longest to build, so they come first. Vendor and CRO contracts follow, since accountability stays with the fiduciary whatever a contract says. Consent and research governance come last, with more room than many assume.
CyberNX works alongside healthcare and life sciences teams on DPDPA readiness, from safeguard testing to breach response planning. Speak with our compliance team to understand our DPDPA Act Consulting Services and what your obligations mean in practice and where your organisation should start.
FAQs
When does DPDPA compliance become mandatory for hospitals and pharma companies?
Most obligations apply from May 13, 2027, when the core sections of the Act and most of the Rules commence. Consent Manager registration starts earlier, on Nov 13, 2026. Until May 2027, the 2011 rules under the Information Technology Act continue to apply.
Is coded clinical trial data personal data under the DPDPA?
For now, it does. The Act covers data about any individual who is identifiable from it. If a sponsor, site or vendor holds the key linking codes to participants, the data stays identifiable. Treat it as personal data unless re-identification is genuinely impractical.
Can hospitals process patient data without consent in an emergency?
Yes. The Act lists responding to a medical emergency that threatens life or health as a legitimate use, and the same applies to treatment during an epidemic. The hospital must still protect the data and report any breach.
Does the 72-hour deadline apply to notifying patients?
No. Affected individuals must be informed without delay. The 72-hour window applies to the detailed report to the Board, which follows an initial report made without delay.
