#dpdp act

If your medical device collects, stores or transmits patient data, India's data protection framework now places clear obligations on organizations that collect or process personal data, including many medical device and digital health companies. The government notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025, providing the operational framework for implementing the DPDP Act, 2023. For MedTech and health-tech companies, this is the moment to treat data privacy as a core compliance task, not an afterthought. 

What actually changed in November 2025

The DPDP Act passed in 2023, but it needed rules to become operational. Those rules arrived through gazette notification G.S.R. 846(E). They set out how personal data must be collected, secured, retained and deleted and they establish phased implementation timelines for different provisions. Some provisions, such as those covering the Data Protection Board of India, applied immediately. Others, including consent manager obligations, follow over the next year. The practical message is simple: the clock has started. 

The roles you need to understand

The law works around two terms. A Data Principal is the individual the data belongs to, such as a patient. A Data Fiduciary is the organization that decides how and why that data is processed. In healthcare, the hospital, clinic, device maker or software provider is usually the Data Fiduciary. If you build a connected device, a diagnostic app or a remote monitoring platform, you are likely a Data Fiduciary and you carry the duties that come with it.

Core obligations for medical device and SaMD companies

Consent and notice: you must give a clear, itemized notice explaining what data you collect and why and obtain valid consent for the specified purposes unless another lawful ground under the Act applies. 

Breach reporting: Personal data breaches must be reported to the Data Protection Board and affected individuals in accordance with the timelines and procedures specified in the Rules. 

Retention and erasure: keep personal health data only as long as the purpose requires, then delete it. 

Children's data: processing a child's data needs verifiable parental consent, though the Fourth Schedule exempts certain healthcare activities needed to provide health services.

If you are a Significant Data Fiduciary

Companies that handle large volumes of sensitive data can be classified as Significant Data Fiduciaries. They face stricter duties: appointing a Data Protection Officer, running annual Data Protection Impact Assessments, completing audits and carrying out tighter due diligence.  Organizations processing large volumes of personal data or meeting other criteria notified by the Government may be designated as Significant Data Fiduciaries. So plan for it early. Non-compliance is expensive, with penalties reaching up to Rs 250 crore for failing to maintain reasonable security safeguards.

How DPDP compares to GDPR

If you already sell in Europe, some of this will feel familiar. Under the EU GDPR, health data is special-category data under Article 9 and needs explicit consent. The DPDP Act does not create a separate sensitive-data class, but it does not separately classify sensitive personal data in the way GDPR does, although organizations processing health information should generally apply enhanced governance and security controls because of the potential impact on individuals through breach duties and SDF classification. The big difference is that DPDP leans heavily on consent as the basis for processing. Building consent-first systems now helps you satisfy both regimes.

How DPDP Fits into Medical Device Compliance

The DPDP Act 2023 doesn't replace existing medtech regulations, it adds a parallel compliance layer. Connected devices and digital health platforms in India now sit under two regimes at once: product/safety regulation via the Medical Device Rules, 2017 (enforced by CDSCO), and data protection via the DPDP Act and Rules, 2025. A device can be fully CDSCO approved and still fall short on DPDP if consent, breach notification, or retention practices aren't in order, so compliance teams need to manage both tracks together. 

In practice, this means: 

Data fiduciary status: Companies that determine the purpose and means of processing personal data through wearables, remote monitoring solutions, or diagnostic applications may qualify as Data Fiduciaries under the DPDP Act. Depending on the deployment model, hospitals, clinics, and other stakeholders may also have independent obligations. 

Privacy by Design: Privacy and security controls, including data minimization, appropriate encryption, access controls and where feasible, on-device processing, should be incorporated throughout the product life-cycle rather than added after deployment. 

Consent and breach workflows: Consent capture, withdrawal, and breach-notification timelines must be engineered into the device/app itself, alongside CDSCO documentation. 

Standards convergence: While not mandatory under the DPDP Act, organizations are increasingly adopting standards such as ISO/IEC 27701 (Privacy Information Management) and ISO/IEC 42001 (AI Management Systems), alongside ISO 13485, to strengthen governance for AI-enabled and connected medical devices.

With the DPDP framework now in force and phased compliance timelines extending to May 2027, MedTech companies should integrate DPDP obligations into their existing CDSCO and Medical Device Rules compliance activities rather than treating them as separate programs. 

What to do next 

Start with a comprehensive data inventory to understand what personal data is collected, where it is stored, how it flows across your systems, who can access it, how long it is retained, and how it is securely deleted. Then align your consent, retention, breach response, and deletion processes with the applicable regulations. 

NexorTest helps medical device and SaMD teams connect these privacy requirements to their wider regulatory and cybersecurity strategy, so compliance is built into the product rather than bolted on later.

not a legal blog i promise but this keeps coming up so. the data protection bill 2023 (aka DPDP act) isn't theoretical anymore — the rules got notified in nov 2025 and there's an actual regulator (data protection board) up and running.

myth: "it doesn't apply yet so we have time" — partially true, partially not. some stuff is live NOW. full compliance is due may 2027 but that's closer than it sounds once you factor in actually building the systems.

myth: "it's basically GDPR" — kind of, but indian specifics matter a lot here (whatsapp as an official request channel, rupee-denominated penalties up to 250 crore, a whole consent manager registration system opening nov 2026)

myth: "small companies are exempt" — nope. if you process digital personal data connected to india, you're in scope, size doesn't automatically get you out of it

"When you hand off data, you are handing off your accountability."

In the digital economy, no business operates alone. We all use cloud storage, CRM platforms, and external agencies. But under India's Digital Personal Data Protection Act (DPDP Act), outsourcing your data processing does not mean outsourcing your legal liability.

If you are a Data Fiduciary, knowing how to assess third-party data processors is non-negotiable. If your vendor gets hacked, the regulator holds you responsible.

Here is what you need to do today:

Sign a DPA: A standard service agreement is useless. You need a Data Processing Agreement that legally binds them to Indian privacy standards.

Demand Proof of Security: Don't just trust them. Ask for SOC2 reports and verify their encryption and access controls.

Set strict breach timelines: You have 72 hours to report a breach. Make sure your vendors are contracted to tell you within 24 hours if something goes wrong.

Managing this manually is dangerous. Forward-thinking companies use automation platforms like RuleExpert to score vendor risk, track contracts, and maintain a centralized audit trail.

Let’s talk about the illusion of safety in the modern tech ecosystem.

You build an app, a business, or a platform. You use third-party APIs for everything: cloud hosting, email delivery, data analytics, and payment processing. It feels efficient. It feels like you're distributing the workload.

But under India’s DPDP Act 2023, you are actually consolidating your legal risk.

The Core Rule: You can outsource your data processing, but you can never outsource your legal accountability.

The law views your company as the Data Fiduciary—the mastermind behind the data lifecycle. The third-party tools you use are just Data Processors. If one of those processors experiences a catastrophic data breach, the legal fallout lands directly on your desk.

The Data Protection Board of India doesn't care if the leak happened on an external server; they care that it was your users’ data. This reality turns vendor risk management into an essential operational defense strategy.

What Active Governance Looks Like:

No More Handshake Deals: Every single third-party relationship requires a highly specific, legally binding contract that dictates exactly when data must be securely erased.

Total Transparency: If your vendor passes your data to a sub-processor, they need your explicit permission first. No exceptions.

Continuous Auditing: You can’t just trust a vendor's marketing copy. You have to actively inspect their security protocols (Rule 6 safeguards) to ensure encryption and access controls are up to standard.

Work Smarter, Not Harder

Trying to organize this massive data ecosystem using manual spreadsheets is an operational dead end. Platforms like RuleExpert can step in here, automating vendor questionnaires, centralizing data processing agreements, and giving you an instant, visual map of your entire data footprint.

The clock is ticking on compliance timelines. Don't let a third-party partner's weak security ruin your business reputation and balance sheet.

Remember when cloud storage got so cheap that companies just... stopped deleting things? The collective corporate data retention policy basically became: Keep everything forever.

Welcome to 2026. That exact mindset is now a massive legal liability in India.

Following the formal notification of the DPDP Rules, the countdown to the strict May 2027 enforcement deadline has begun. Keeping personal data indefinitely is now a direct violation of Indian law.

⚡ The New Rules of Survival:

Delete on Completion: Once the purpose of collecting data is done, it must be purged. No digital clutter allowed.

The 3-Year Rule: Inactive for 36 months on an e-commerce, gaming, or social media platform? The data must be deleted.

The 48-Hour Notice: You must warn users 48 hours before your system automatically deletes their accounts.

The 1-Year Vault: While personal files get wiped, processing logs must be kept for 12 months for regulatory audits.

🏛️ The Compliance Puzzle

The trickiest part? Your data retention policy has to balance overlapping laws. The Income Tax Act says keep financial invoices for 8 years, but the DPDP Act wants fast deletion. You have to segment your data—behavioral data goes to the digital shredder; financial data stays locked in a vault.

🤖 Stop Using Spreadsheets

You can’t manage this manually. If an intern leaves a CSV file of customer emails on a local hard drive, you face multi-crore fines.

This is why automation platforms like RuleExpert exist. It handles the tracking, triggers the 48-hour alerts, deletes the data across your entire system, and creates a clear audit trail for regulators.

Stop hoarding. Start deleting. Protect your brand.

Let's talk about India’s privacy shift. With the final timeline officially counting down to May 2027 under the notified DPDP Rules, companies are suddenly realizing their backend databases are a complete mess.

Enter the data inventory.

It’s not just a boring file directory or a static list of databases. A true data inventory is a living, breathing map of your entire digital footprint. It tracks:

Data Principals: The real humans behind the data points.

Data Fiduciaries: Your company (and your absolute accountability).

Data Processors: Every single cloud host or SaaS vendor handling your info.

[User Consent Granted] ➡️ [Lawful Purpose Mapped] ➡️ [Real-time Inventory Tracking] ➡️ [Automated Purge at Retention Limit]

Why are manual spreadsheets a massive mistake? Because under the new rules, you have a strict 72-hour window to report data breaches. If your data mapping isn't automated, you'll spend that critical window just trying to locate the breach source.

Smart automation software like RuleExpert takes the chaos out of compliance by mapping data flows in real-time, helping you clean out toxic legacy files and build an architecture based on privacy by design.

The deadline is closer than it looks. Stop hoarding unclassified data. Start mapping.