Healthcare
DPDP Act compliance for applications and hospitals
Your lawyer decides what the DPDP Act requires of you. We make your software do it: notices, consent records, data requests, deletion, security safeguards and breach response, in the apps your patients, customers and staff already use.
What does DPDP Act compliance mean for an application?
India's Digital Personal Data Protection Act, 2023 governs how organisations collect and use digital personal data, and the DPDP Rules, 2025, notified on 13 November 2025, apply most obligations from 13 May 2027. For an application this means: a clear notice before collecting data, consent that is recorded and as easy to withdraw as to give, using data only for the stated purpose, letting people access, correct and erase their data and raise grievances, reasonable security safeguards, informing the Data Protection Board and affected people of a breach, and deleting data once its purpose is served. Infovion Technologies builds these into existing and new software; legal positions are set by the client's lawyer or Data Protection Officer.
Updated 5 November 2026 by Infovion Technologies, Pune.
Scope
What we deliver
Data mapping
What personal data each system holds, where, why, who can see it and how long it is kept.
Notices and consent
Notices in English and Indian languages, consent recorded with time and purpose, and withdrawal in one step.
Data rights requests
Access, correction, erasure and grievance requests, tracked from receipt to reply.
Retention and deletion
Rules per data type, automatic deletion or anonymisation when the purpose ends, with a record of it.
Security safeguards
Encryption, access control, two-step sign-in, logs and backups, to the level the Rules expect.
Breach response
Detection, a written playbook, and the notices to the Data Protection Board and to affected people.
What hospitals and healthcare apps should know
- The Act has no separate 'sensitive data' category, but health data is high-risk and usually held at scale
- Personal data may be used without consent to respond to a medical emergency (section 7 of the Act)
- The Rules allow clinical establishments and healthcare professionals to process a child's data, without verifiable parental consent, to the extent needed to provide health services
- Large hospital chains may be notified as Significant Data Fiduciaries, with a Data Protection Officer in India, impact assessments and audits
- Breaches must be reported to the Board, with a detailed report within 72 hours under the Rules
- ABDM consent for sharing health records works alongside, not instead of, DPDP obligations
The timeline
- 11 August 2023: DPDP Act receives assent
- 13 November 2025: DPDP Rules, 2025 notified; Data Protection Board provisions in force
- November 2026: consent manager provisions apply
- 13 May 2027: notice, consent, security, breach, retention and children's data obligations apply
Not legal advice
We are software engineers, not a law firm. We work with your lawyer or DPO, who decides the legal basis and policies, and we implement them in your systems with evidence you can show an auditor or the Board.
Sources: MeitY: Data protection framework (DPDP Act and Rules) · Mondaq (HSA): analysis of the notified DPDP Rules, 2025 · CERT-In directions under section 70B(6), 28 April 2022
Deliverables
- Data map of your applications
- Gap report against the Act and Rules, with costs to fix
- Notices, consent records and withdrawal built into your apps
- Data rights request workflow
- Retention and deletion jobs with logs
- Breach response playbook and notification templates
Typical clients
- Hospitals, clinics and diagnostic labs
- Schools and education apps
- Fintech, lending and insurance apps
- E-commerce and consumer apps
- HR and payroll systems
Technologies
Node.js, NestJS, React, React Native, PostgreSQL, Encryption at rest and in transit, Audit logging, Hosting in India
Cost and timeline
Cost of DPDP Act compliance in India
Indicative budget ranges for the Indian market in 2026, provided for planning. Each project receives its own fixed-price proposal after an initial consultation.
| Project type | Typical budget |
|---|---|
| Gap assessment of an application | ₹50,000 – 2 lakh |
| Implementation in existing software | ₹2 – 10 lakh |
| Ongoing compliance updates | Within a maintenance AMC |
Timeline. Assessment in two to four weeks; implementation in one to four months, well before 13 May 2027.
Factors that affect cost
- Number of applications and data stores
- Volume and type of personal data
- Children's or health data
- Legacy systems that are hard to change
Process
How the project is delivered
01Week 1
Discovery
An initial consultation, followed by a requirements workshop for larger projects, to understand processes, users and objectives.
02Within 2 business days
Proposal
A written scope, milestone plan and fixed-price proposal, so cost and timeline are agreed before work begins.
031–3 weeks
Design
Wireframes and a clickable prototype reviewed with your team before development starts.
042-week sprints
Development
Fortnightly releases to a staging environment, with a review at the end of each sprint.
051–2 weeks
Testing and launch
Functional and security testing, user acceptance testing, data migration, training and go-live.
06Ongoing
Support
Thirty days of post-launch support, followed by an optional maintenance contract.
FAQ
Frequently asked questions
When does the DPDP Act apply?
The Act was passed in 2023 and the DPDP Rules were notified on 13 November 2025. The Data Protection Board provisions apply now, consent manager provisions from November 2026, and the main obligations, including notice, consent, security, breach reporting and retention, from 13 May 2027.
What is the penalty under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, with other penalties for other breaches of the Act, imposed by the Data Protection Board.
Does the DPDP Act apply to hospitals?
Yes. Hospitals collect personal data of patients, relatives and staff, and are Data Fiduciaries under the Act. There are specific allowances, such as processing in a medical emergency and processing a child's data to provide health services.
How fast must a data breach be reported under the DPDP Rules?
The Board and affected people must be told without delay, and a detailed report must reach the Board within 72 hours. Separately, CERT-In's directions require specified cyber incidents to be reported within 6 hours.
Can you make our existing software DPDP compliant?
Yes. We assess the software, then add notices, consent records, data rights requests, retention and deletion, and security safeguards to it, usually without replacing it.
Related services
Services often combined with this one
Build DPDP compliance into your applications
Share a brief description of your project. We respond within one business day with questions, an approach and a fixed-price proposal where the scope allows.