India’s healthcare ecosystem is living through its fastest digital transformation yet — the Ayushman Bharat Digital Mission, hospital-wide EMR adoption, AI-assisted diagnostics, and telemedicine have turned every patient interaction into a stream of digital data. In doing so, hospitals, diagnostic labs, pharmacies, insurance TPAs, and digitalThe Compliance Chasm in Healthcare
The Act’s penalty schedule is unambiguous: up to ₹250 crore for failing to implement reasonable security safeguards, and up to ₹200 crore for failing to notify the Data Protection Board and affected patients of a breach — penalties that can stack on a single incident. Despite this exposure, everyday clinical practice remains full of blind spots: a physician forwarding a diagnostic report over an unsecured messaging group, an administrator repurposing appointment contacts for promotional campaigns, or a hospital retaining records indefinitely with no defined destruction schedule. Each is a violation of purpose limitation or reasonable-safeguard obligations that most staff have never been trained to recognise.health start-ups have quietly become “Data Fiduciaries” under the Digital Personal Data Protection (DPDP) Act, 2023 — legally accountable for information that is arguably the most sensitive category any Indian institution handles. With the DPDP Rules notified on 14 November 2025 and enforcement now staggered through November 2026 and May 2027, data governance has moved from an IT checklist to a boardroom imperative. Yet a dangerous gap persists between clinical expertise and regulatory literacy.
𝗧𝗵𝗲 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗖𝗵𝗮𝘀𝗺 𝗶𝗻 𝗛𝗲𝗮𝗹𝘁𝗵𝗰𝗮𝗿𝗲
The Act’s penalty schedule is unambiguous: up to ₹250 crore for failing to implement reasonable security safeguards, and up to ₹200 crore for failing to notify the Data Protection Board and affected patients of a breach — penalties that can stack on a single incident. Despite this exposure, everyday clinical practice remains full of blind spots: a physician forwarding a diagnostic report over an unsecured messaging group, an administrator repurposing appointment contacts for promotional campaigns, or a hospital retaining records indefinitely with no defined destruction schedule. Each is a violation of purpose limitation or reasonable-safeguard obligations that most staff have never been trained to recognise.
𝗖𝗮𝘀𝗲 𝗦𝗰𝗲𝗻𝗮𝗿𝗶𝗼: 𝗧𝗵𝗲 “𝗣𝘀𝗲𝘂𝗱𝗼-𝗔𝗻𝗼𝗻𝘆𝗺𝗶𝘇𝗮𝘁𝗶𝗼𝗻” 𝗧𝗿𝗮𝗽
Consider a composite, illustrative case drawn from patterns now common across Indian hospital digitisation: a multi-speciality chain deploys a third-party AI triage tool, feeding it thousands of historical patient records stripped of names and assumed, therefore, to be “anonymised.” PIN codes, treatment dates, and rare-disease markers are left untouched — details specific enough to re-identify individuals. When the vendor suffers a leak, liability falls squarely on the hospital, because Data Fiduciaries remain responsible for their processors’ failures. No consent workflow existed for this secondary use, and no technical safeguard properly de-identified the data. The resulting penalty and reputational damage were entirely avoidable with basic DPDP training for the clinical and IT leadership who approved the project.
This is not hypothetical risk. India has ranked among the highest globally for healthcare-sector data breaches in recent years, with well over a hundred million medical records exposed in a single year through weak encryption and poor access controls. The 2022 ransomware attack on a major Delhi government hospital paralysed registration and diagnostics for weeks; in June 2025, two more Delhi hospitals suffered overnight ransomware intrusions. Regulators, patients, and litigators will now measure every one of these against DPDP obligations.
𝗪𝗵𝘆 𝗴𝗲𝗻𝗲𝗿𝗶𝗰 𝘁𝗿𝗮𝗶𝗻𝗶𝗻𝗴 𝗱𝗼𝗲𝘀𝗻’𝘁 𝘄𝗼𝗿𝗸
Healthcare data is categorically different from financial or e-commerce data — it touches medical history, genetics, mental health, and reproductive health, where a single unauthorised disclosure can affect employment, insurability, and personal dignity. Generic cybersecurity modules do not address this intersection of clinical ethics, workflow, and law. What’s required is role-specific certification:
• Hospital administrators and boards need a blueprint for governance structures, Institutional Ethics Committees aligned with DPDP research exemptions, and the heightened obligations of Significant Data Fiduciaries.
• Clinicians and nursing staff must move beyond verbal consent to documented, purpose-specific workflows, including verifiable parental consent for minors.
• IT and compliance teams need to integrate Consent Managers into hospital information systems, implement role-based access, and rehearse the 72-hour breach-notification clock until it is procedure, not panic.
• Digital health innovators building the next generation of apps and wearables need DPIA literacy built in at the design stage, not retrofitted after a regulator asks for one.
𝗕𝘂𝗶𝗹𝗱𝗶𝗻𝗴 𝗱𝗶𝗴𝗶𝘁𝗮𝗹 𝘁𝗿𝘂𝘀𝘁, 𝗻𝗼𝘁 𝗷𝘂𝘀𝘁 𝗱𝗶𝗴𝗶𝘁𝗮𝗹 𝗿𝗲𝗰𝗼𝗿𝗱𝘀: 𝗧𝗵𝗲 𝗦𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝗰 𝗜𝗺𝗽𝗲𝗿𝗮𝘁𝗶𝘃𝗲
The DPDP Act is not designed to slow medical innovation — it is designed to ensure innovation doesn’t outrun patient trust. Just as Indian healthcare invests in accreditation, infection control, and quality standards as a matter of course, data governance now deserves the same institutional priority. As Healthcare Leaders Collective Foundation (HLCF), American Accreditation Commission International (AACI) and India’s healthcare leadership ecosystem organise around this shift, a pioneering, sector-specific DPDP certification — built for administrators, clinicians, IT professionals, compliance officers, and innovators alike — is fast becoming a precondition for practising medicine safely in a digitised India. Institutions that invest in this capability now will not merely avoid a ₹250 crore blind spot; they will earn the one asset no regulation can mandate on its own — patient trust.
𝗧𝗵𝗲 𝗪𝗮𝘆 𝗙𝗼𝗿𝘄𝗮𝗿𝗱
India’s digital health ambitions require more than advanced technology—they require a workforce capable of governing it responsibly.
The DPDP Act should not be viewed as another compliance requirement but as a leadership imperative. Just as healthcare professionals undergo continuous training in clinical quality and patient safety, structured education in data privacy and governance must become a core professional competency.
The future of Indian healthcare will be digital. Whether it is also trusted will depend on how well today’s healthcare leaders, clinicians, administrators, and technology professionals are prepared to protect the data entrusted to them.
Enroll Now to Become DPDP Certified Professional
By Mr Dheeraj Khatore – Chief Executive Officer & Vice President, American Accreditation Commission International (AACI)
