.png)
DPDP Rules 2025 for Hospitals — What Front Office, MRD and Admin Teams Must Change Before May 2027
India's Digital Personal Data Protection Act, 2023 now has its operating rules: the DPDP Rules, 2025 were notified in November 2025 and phase in over 18 months. Hospitals hold some of the most sensitive personal data there is — and most of it passes through the front office, medical records and billing.
Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (notified in November 2025), a hospital is a data fiduciary for its patients' personal data. It must give patients a clear notice and take explicit consent for each purpose, use data only for that purpose, protect it with reasonable security safeguards, let patients access and correct their data, and report personal-data breaches. The rules phase in over 18 months, so most obligations apply from around May 2027, and penalties under the Act go up to ₹250 crore.
Last reviewed: 23 October 2026 · Treneywann Institute of Hospital Administration, Vyttila, Kochi
The Timeline
- August 2023 — the DPDP Act is enacted.
- November 2025 — the DPDP Rules, 2025 are notified, with an 18-month phased timeline.
- About 12 months after notification (≈ November 2026) — consent-manager provisions start.
- About 18 months after notification (≈ May 2027) — the main obligations on data fiduciaries, including hospitals, and patients' rights apply.
Hospitals have this window to change forms, software access and processes — not to wait for May 2027.
What Changes for Hospitals
- Notice and consent: patients must be told clearly what data is collected and why, and give explicit consent. Blanket or implied consent is not valid.
- Purpose limitation: data collected for treatment cannot be reused for unrelated purposes (marketing, for example) without fresh consent.
- Patients' rights: patients can ask to access, correct or erase their personal data. Erasure is limited where other laws require medical records to be kept.
- Security safeguards: reasonable measures such as access control, encryption and access logs across hospital systems.
- Breach reporting: personal-data breaches must be reported to the Data Protection Board and to affected patients.
- Children: processing a child's personal data needs verifiable consent from a parent or lawful guardian.
- Large hospital groups designated as significant data fiduciaries carry extra duties, such as a Data Protection Officer, impact assessments and audits.
Where It Lands Inside the Hospital
DPDP work overlaps with ABDM consent-based record sharing and the information-management chapter of NABH accreditation — and it is run largely by administration, not clinical staff.
How Treneywann Teaches This
Treneywann updates its hospital administration curriculum as rules change. The DPDP Rules 2025 are taught as practical desk work — consent forms, patient data-access requests, HMS access control and breach-response procedure — within the front office, medical records (MRD) and hospital information-management training, with hands-on practice in India's only live Hinall HMS lab at Vyttila, Kochi.
See the hospital administration course and syllabus.
FAQs — DPDP Rules 2025 for Hospitals
Does the DPDP Act apply to hospitals?
Yes. Hospitals collect and process patients' digital personal data, so they act as data fiduciaries under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
When were the DPDP Rules 2025 notified?
The DPDP Rules, 2025 were notified in November 2025 (the government's release is dated 14 November 2025), with an 18-month phased timeline.
When do hospitals have to comply with the DPDP Rules?
The main obligations on data fiduciaries and patients' rights apply about 18 months after notification — around May 2027. Consent-manager provisions start earlier, about 12 months after notification.
Can a patient ask a hospital to delete their records?
Patients can request access, correction and erasure of personal data, but erasure is limited where other laws require medical records to be retained. Hospitals need a clear process for handling these requests.
What consent does a hospital need under DPDP?
Clear notice and explicit consent for each specific purpose. Blanket or implied consent is not valid, and data collected for treatment cannot be reused for unrelated purposes without fresh consent.
What happens if a hospital has a data breach?
Personal-data breaches must be reported to the Data Protection Board and to the affected patients. Failure to take reasonable security safeguards can attract penalties of up to ₹250 crore under the Act.
Who handles DPDP compliance in a hospital?
Mostly the administration side — front office, medical records, HMS/IT, billing and quality teams — with a Data Protection Officer in larger groups designated as significant data fiduciaries.
Does Treneywann teach the DPDP Rules 2025?
Yes. Treneywann updates its hospital administration curriculum as rules change, and the DPDP Rules 2025 are taught as practical work — consent forms, patient data-access requests, HMS access control and breach-response procedure — within the front office, medical records (MRD) and hospital information-management training, with practice in the live Hinall HMS lab at Vyttila, Kochi.
Sources and further reading
Summarised from the Government of India's notification of the DPDP Rules, 2025 and published healthcare analyses. This page is a guide for hospital staff and students, not legal advice — check the official Rules for exact obligations.
- PIB — Government notifies DPDP Rules to empower citizens and protect privacy
- PIB — DPDP Rules, 2025 notified (document)
- KPMG — Impact of the DPDP Act and Rules on healthcare and life sciences
- Journal of Dr. NTR University of Health Sciences — DPDP Act and Rules: operational considerations for hospitals
Want to Work in Hospital Administration?
Hospitals need administrators who understand insurance, records, compliance and patient services. The 1-Year Hospital Administration Course is ₹64,000; the 6 Months Hospital Administration Course (for healthcare professionals) is ₹42,000 — next batch 9 November 2026 at Vyttila, Kochi, with 100% Placement Assurance.
