DPDP Act 2023: Challenges in healthcare compliance

The Hindu · 26 October 2026 · GS 2: Governance · GS 3: Health · 10 min read

Why in the News?

The Digital Personal Data Protection (DPDP) Act, 2023, will enforce consent manager provisions from November 13, 2026. Aspirants should note its impact on health data compliance.

Key Highlights

• The DPDP Act, 2023 includes 44 sections across nine chapters and one Schedule.

• Consent manager provisions begin on November 13, 2026, with full obligations effective from May 13, 2027.

• Clinical consent differs from data consent: agreeing to treatment does not authorise all data uses.

• Hospitals face penalties up to ₹250 crore for failing to adopt reasonable safeguards.

• A 2023 India-Norway study found shared infrastructure reduces compliance costs for PHCs by 6%.

Know the Basics

• Data principal: The individual whose personal data is being processed under the DPDP Act.

• Data fiduciary: The entity that determines the purpose and means of data processing, such as hospitals.

• Unified Health Interface: A platform under the Ayushman Bharat Digital Mission for integrating health services and data.

Detailed Analysis

Consent rules under the DPDP Act

• Clinical consent does not automatically permit data processing beyond treatment purposes.

• Data can be processed during emergencies or for medico-legal and public-health reasons.

Compliance challenges for hospitals

• Hospitals must implement role-based access, encryption and breach-response protocols.

• Small hospitals face difficulty appointing statutory Data Protection Officers due to resource constraints.

Economic impact of compliance

• Out-of-pocket spending is 43.4% of total health expenditure, risking cost transfer to patients.

• Shared tools and infrastructure can reduce incremental costs for smaller institutions.

Training and capacity gaps

• Medical education lacks DPDP-specific curricula across healthcare disciplines.

• Software vendors need trained personnel to prevent breaches caused by human errors.

Significance for India & UPSC Exam

• Strengthens health data protection and privacy under the DPDP framework.

• Encourages healthcare institutions to adopt modern information systems and cybersecurity measures.

• UPSC could test this in GS 2 (Governance) or GS 3 (Health) with a focus on compliance challenges.

• Raises questions about balancing privacy with affordable and accessible healthcare.

Challenges and Way Forward

Challenges

• High compliance costs may burden smaller hospitals and diagnostic centres.

• Lack of trained personnel across healthcare and IT sectors slows implementation.

• Risk of privacy breaches due to inadequate safeguards or human errors.

Way Forward

• The government must provide shared privacy tools and affordable cybersecurity support.

• National Medical Commission should integrate DPDP-specific training into medical curricula.

• Ayushman Bharat Digital Mission should enable shared infrastructure for smaller institutions.

UPSC Prelims Practice Question

Consider the following statements regarding the DPDP Act, 2023: 1. It mandates clinical consent for all data processing. 2. Hospitals failing safeguards may face penalties up to ₹250 crore. 3. Consent manager provisions begin on May 13, 2027. How many of the above statements are correct?

1. Only one

2. Only two

3. All three

4. None

Answer: (b) Only two

Explanation: Statement 1 is incorrect: Clinical consent differs from data consent. Statement 2 is correct: Penalties can go up to ₹250 crore. Statement 3 is incorrect: Consent manager provisions begin on November 13, 2026.

UPSC Mains Practice Question

Critically analyse the DPDP Act, 2023's implications for healthcare compliance in India. (GS 2, 10 marks, 150 words)

Answer framework

• Begin with the DPDP Act's focus on health data protection and its phased implementation dates.

• Discuss consent rules and their distinction between clinical and data processing contexts.

• Highlight compliance challenges like high costs, training gaps and privacy risks.

• Explain the economic impact on smaller hospitals and patients, citing the India-Norway study.

• Conclude by recommending shared tools and training programs under Ayushman Bharat Digital Mission.

Question to Ponder

Should India legislate sector-specific DPDP provisions for healthcare compliance?

Previous Year Questions (PYQs)

Prelims

• With reference to Ayushman Bharat Digital Mission, consider the following statements: (2022)

• Consider the following statements: The Reserve Bank of India's recent directives relating to 'Storage of Payment System Data', popularly known as data diktat, command the payment system providers that: (2019)

• Under which of the following Articles of the Constitution of India, has the Supreme Court of India placed the Right to Privacy? (2024)

Mains

• Data security has assumed significant importance in the digital world due to rising cyber crimes. The Justice B.N. Srikrishna Committee Report addresses issues related to data security. What, in your view, are the strengths and weaknesses of the Report relating to protection of personal data in cyberspace? (250 words) (2018, Paper III)

• Examine the scope of Fundamental Rights in the light of the latest judgement of the Supreme Court on Right to Privacy. (250 words) (2017, Paper II)

• Public health system has limitations in providing universal health coverage. Do you think that the private sector could help in bridging the gap? What other viable alternatives would you suggest? (2015, Paper I)

Frequently Asked Questions (FAQs)

What is the DPDP Act, 2023?

The Digital Personal Data Protection Act, 2023 establishes rules for protecting digital personal data, including health records, with phased implementation starting November 13, 2026.

What are DPDP compliance requirements for hospitals?

Hospitals must adopt safeguards like encryption, role-based access, breach-response protocols and appoint Data Protection Officers or privacy leads.

How does the DPDP Act address health data consent?

The Act separates clinical consent from data consent and allows data processing during emergencies or for public-health purposes.