A diagnostic centre builds a clean, by-the-book DPDP data retention policy: personal data gets erased once its purpose is served, exactly as Section 8(7) of the Digital Personal Data Protection Act expects. Then a thirty-year-old law quietly overrides part of it, and most compliance checklists never mention this.
The Pre-Conception and Pre-Natal Diagnostic Techniques Act, 1994 requires every genetic clinic, ultrasound clinic, and imaging centre to maintain Form F for each prenatal diagnostic procedure performed on a pregnant woman. That record has to be preserved for a minimum of two years, or until a case's final disposal if legal proceedings are filed, regardless of what a hospital's own data minimisation policy would otherwise prefer.
A Law Built to Prevent Something Specific
PCPNDT exists for a reason that has nothing to do with general data protection: preventing sex-selective abortion by making every prenatal diagnostic procedure traceable and auditable. Form F captures referral details, indications for the ultrasound, and the result of the procedure, specifically so an Appropriate Authority can investigate if something looks irregular. Courts have treated an incomplete or inaccurate Form F entry as an independent offence under the Act, not a minor administrative lapse, with penalties running up to three years imprisonment for a first offence.
That enforcement posture matters here because it tells you how seriously the retention requirement is meant to be taken. This isn't a soft best-practice recommendation sitting next to DPDP's erasure principle. It's a separate, criminally enforceable mandate.
Where the Two Laws Actually Meet
DPDP's Section 8(7) is explicit that erasure obligations apply "unless retention is necessary for compliance with any law for the time being in force." That clause is doing real work for any healthcare provider subject to PCPNDT. It means the Act itself anticipates exactly this kind of conflict and resolves it in favour of the sector-specific retention mandate, not in favour of a generic data minimisation instinct.
The operational risk isn't that providers will deliberately violate PCPNDT's retention rule. It's that a DPDP compliance programme built without an explicit, documented exception for it might configure an automated deletion policy, now a routine feature in most data governance platforms, that quietly purges Form F records before the two-year window closes, in the name of good DPDP hygiene.
This Pattern Isn't Unique to PCPNDT
It's worth treating this as an instance of a broader category rather than a one-off quirk. Indian healthcare operates under a genuine stack of sector-specific laws, the HIV Act's confidentiality provisions, the Mental Healthcare Act's separate confidentiality right, and others, each of which predates DPDP and continues operating alongside it. Any of them could, in principle, impose its own retention or disclosure requirement that a generically configured DPDP policy might not anticipate.
The fix isn't complicated, but it does require deliberate work: build an explicit retention registry naming every sector-specific law that overrides general DPDP timing, with the specific record type, the specific retention period, and the specific statutory citation, rather than a single vague "retain as required by applicable law" clause that doesn't actually tell an engineer configuring a deletion job what to exclude.
Why This Matters Beyond Compliance Theatre
Getting this wrong doesn't just create DPDP exposure. It potentially creates liability under an entirely separate, criminally enforced statute, for the unrelated reason of having been too diligent about data minimisation. That's a genuinely uncomfortable position for a compliance team to explain, and it's avoidable with a retention registry that most healthcare providers simply haven't built yet.
Nitin Ray is a Compliance Manager at RuleExpert, where he works with hospitals, diagnostic centres, and healthcare platforms on DPDP compliance that accounts for India's existing sector-specific health laws. For the full picture of how DPDP interacts with the HIV Act, the Mental Healthcare Act, and ABDM, see RuleExpert's complete guide to DPDP compliance across healthcare providers and use cases. This article reflects publicly available regulatory information at the time of writing and does not constitute legal advice.
Comments