DPDP Act Compliance Checklist for Hospitals
The checklist
- Separate consent for non-clinical contact. Consent to treatment isn't the same as consent to be messaged for feedback, reminders, or marketing. Get and record consent for each purpose separately.
- A documented consent record, not a verbal understanding. Be able to show when and how a patient consented to being contacted, not just that they probably did.
- An honoured opt-out, immediately. A patient withdrawing consent should be excluded from further contact right away, with the withdrawal itself logged.
- A real process for access and correction requests. A patient asking what data you hold, or asking to correct it, needs an actual process and a reasonable response time — not an ad hoc one built the first time someone asks.
- Retention that accounts for conflicting rules. Medical record retention law may require keeping certain records for a minimum period even if a patient requests erasure — know which category a given record falls into before promising deletion.
- A named contact for data complaints. The DPDP Rules require every data fiduciary to display contact details for personal-data questions, a designated officer or a Data Protection Officer, so this is now a named requirement — see our grievance officer explainer for how this differs from general patient grievance handling.
- A documented breach process. Know what counts as a reportable incident for your hospital and who's responsible for detecting and escalating it, before an incident forces you to figure it out live.
- Vendor accountability. Any vendor handling patient data on your behalf — including a feedback or messaging tool — should be contractually bound to the same consent and security expectations you're bound to.
Where a feedback tool fits, and where it doesn't
A tool like CareLoop can enforce the operational parts of this checklist that touch messaging directly — no message without recorded consent, immediate and permanent opt-out honouring, an append-only log of what was sent and when. CareLoop says this plainly: "We do not make you DPDP-compliant. We only message patients who said yes, and we keep the record. The responsibility stays with you." The rest of the checklist — retention policy, breach process, vendor contracts — is a hospital-wide responsibility no single vendor covers.
Frequently asked questions
Does the DPDP Act apply to hospitals in India?
Yes. Hospitals collect and process personal data — including health data — and are treated as data fiduciaries under the Digital Personal Data Protection Act, 2023, with obligations around consent, purpose limitation, and patient rights.
Does a hospital need separate consent for WhatsApp messages versus treatment?
Consent to treatment and consent to be contacted for non-clinical purposes like feedback or reminders are different things under DPDP's consent principles. Don't assume treatment consent covers feedback-style messaging.
Can a patient ask a hospital to delete their data under DPDP?
Patients have a right to request erasure, though hospitals may have separate legal obligations to retain medical records for a minimum period under health regulations, which can override an erasure request for that specific record category.
What counts as a data breach a hospital must report?
Any unauthorised access, disclosure, or loss of personal data the hospital holds can trigger breach notification obligations under the DPDP Act. Not notifying the Data Protection Board or affected people of a breach can attract a penalty of up to Rs 200 crore. Hospitals should have a documented detection and reporting process, not an ad hoc one.
Sources
- PRS Legislative Research, Digital Personal Data Protection Bill, 2023 summary — reviewed 14 September 2026.
- CareLoop pricing page — this site.