Two dates every hospital should put in the diary
The data protection law stopped being talk when the rules were notified in November 2025. It comes in stages, the stages have dates, and one of them lands on hospitals in May 2027. Here is what you will actually have to do, and one thing you will not.
The dates
The Digital Personal Data Protection Act was passed in 2023, and the rules under it were notified on 14 November 2025. The law does not start all at once. It comes in three stages.
- Immediately. The Data Protection Board and the machinery for reporting breaches.
- From 14 November 2026. Consent managers have to register.
- From 14 May 2027. The main duties: giving notice, taking consent, limits on how long you keep data, deleting it when it is no longer needed, and the rights of the person whose data it is.
May 2027 sounds far away. It is not, for a hospital that has to change a form, train the front office again, and get an agreement signed with every software company it uses.
Which one are you?
These two words matter, because the duties follow them. The hospital collects the patient's data and decides what happens to it, so the hospital is the Data Fiduciary. The software company only stores it, on the hospital's instructions, so it is the Data Processor. Most of the duties, and most of the penalty, sit with the fiduciary. That is you, not your software company.
Large chains may also be named Significant Data Fiduciaries, which adds more duties, including appointing a data protection officer.
Two practical points, for a hospital of any size. First, the notice you give the patient has to be a separate page that lists things clearly: what you collect, why you collect it, and what the patient can do about it. Not one line hidden inside the admission form. Second, if you record conversations, the notice has to say so in plain words.
The bit that is specific to us
An audio recording of a family being told about a critically ill patient is not one person's data. The patient is in it, and so are the wife, the son and the brother who came from out of town. It is health information about several people at the same time, and each of them is a person whose data you are handling.
That is not an argument against recording. A recording remains the strongest answer to "nobody told us" that a hospital can hold. It is an argument for telling people plainly that it is being recorded, in the language they speak, and writing down that you told them.
And one rule that is not in force
You may remember the alarm about doctors having to move all records to digital within three years, and keep them for three years after the last visit. That came from the Registered Medical Practitioner (Professional Conduct) Regulations, notified by the National Medical Commission on 2 August 2023.
Three weeks later, on 23 August 2023, they were put on hold. The 2002 code is what is in force today, and the 2023 rules stay on hold until there is a further notification.
So if a salesman tells you digital records are compulsory today, he is wrong. They are not. The direction is clear enough, and the rules that are on hold show you where it is heading, but that is a reason to plan, not a reason to panic.
What would make the difference
- Write the notice now, in both languages. One page, point by point, and say clearly that conversations are recorded. This is the thing most hospitals will be missing in May 2027.
- Get a written agreement from every software company that touches patient data. Your hospital software, your billing, your lab system, your consent app. Ask each of them where the data is kept and who else can see it.
- Decide how long you keep records, and write it down. The law will ask you to delete data once it is no longer needed. You cannot do that if nobody has ever decided how long you keep things.
Tell them, in words they understand, before you start. Then write down that you told them. That is the standard I would keep whatever the enforcement date says, and it is what the notice rule will ask for anyway.
In practice it is one sentence at the start: we record these explanations and keep them in the patient's file. In my experience families are reassured rather than upset, because it shows the hospital is willing to be held to what it said.
Sources
- Enforcement of the DPDP Act and notification of the DPDP Rules. Shardul Amarchand Mangaldas. amsshardul.com
- DPDP Rules 2025, compliance timeline. India Briefing. india-briefing.com
- DPDP and healthcare: fiduciary and processor roles. Lexwin. lexwin.co.in
- NMC puts the Registered Medical Practitioner (Professional Conduct) Regulations 2023 on hold. Medical Dialogues. medicaldialogues.in
- What the 2023 regulations contain. Mondaq. mondaq.com
Case Notes is written by Dr Ranadheer Raju C S, laparoscopic surgeon at Sri Sara Hospital, Tirupati. It is one doctor reading published judgments and standards, and writing them up for other doctors. It is not legal advice. If you have a case going on, talk to your own lawyer. If I have got something wrong, tell me and I will correct it here.
MedSaakshi makes consent and explanation records that are signed, timed, recorded and sealed. If that sounds useful, there is a demo at medsaakshi.com. If not, the note above is still yours to use.