Walk into most hospitals today and the paper file at the nurse's station has quietly disappeared. In its place: an Electronic Health Record system, a diagnostic imaging server, maybe a telemedicine portal logging every consultation. That shift has been good for patients in a lot of ways — faster access to reports, fewer lost files. But it's also created a new kind of responsibility that hospital boards are only just catching up to.

India's DPDP Act, now in active phased rollout, puts that responsibility in writing. Hospitals are legally classified as "Data Fiduciaries" — the entity that decides why and how your health data gets collected and used — and that comes with real accountability, not just a compliance checkbox. Even when a hospital hands its IT infrastructure to an outside vendor, the hospital itself remains on the hook if something goes wrong.

For patients, the practical upshot is a set of rights that didn't really exist in an enforceable way before: consent that has to be specific rather than buried in an admission form, the ability to withdraw that consent, and a legal deadline for hospitals to report it if your data gets breached. There's also a sensible carve-out for emergencies — a hospital doesn't need your signature before treating you if your life is at risk, though standard consent rules kick back in once you're stable.

None of this happens instantly. Full enforcement builds up in phases through 2026 and lands completely by May 2027, and hospital leadership teams are under real pressure right now to get ahead of it rather than scramble at the deadline. For a much more detailed look at what hospitals specifically need to have in place, this guide to DPDP Act compliance in hospitals breaks down the governance side of it well.