Healthcare Website Compliance in India: DPDP Act Checklist for Clinics & Hospitals

Healthcare website compliance in India means meeting the data protection, security and medical-ethics rules that apply to every form, widget and tracker on a clinic or hospital website. As of 1 October 2026, four rule sets matter. Two are data protection rules: the Digital Personal Data Protection Act, 2023 (DPDP Act) with its 2025 Rules, and the SPDI Rules of 2011. The others are the CERT-In directions of 2022 and the National Medical Commission (NMC) code on medical records.

Most DPDP Act duties start on 13 May 2027. The other three rule sets apply today.

What does healthcare website compliance in India cover in 2026?

Healthcare website compliance in India covers four instruments in 2026: the Digital Personal Data Protection (DPDP) Act and Rules, the SPDI Rules 2011, the CERT-In Directions of 28 April 2022, and the NMC Code of Medical Ethics Regulations, 2002. Together they decide what a clinic site may collect, how it protects that data, and how fast it reports a breach.

A Data Fiduciary is the person or organisation that decides why and how personal data is processed. For a clinic website, that is the clinic, not the agency that built the site. The DPDP Act applies to digital personal data processed in India (opens in a new tab) (PDF), including paper records digitised later, and Section 3 sets no minimum clinic size.

The DPDP Act has no separate "sensitive" category; Section 10 treats sensitivity as one factor when the government designates a Significant Data Fiduciary. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, known as the SPDI Rules, list medical records and history as sensitive personal data (opens in a new tab) (PDF).

If you are commissioning or rebuilding a site, ask your healthcare website development partner to show where each rule set is handled in the build.

When do the DPDP Act rules start applying to clinics and hospitals?

The DPDP Rules were notified on 13 November 2025 and take effect in three steps. Board provisions started on 13 November 2025, Consent Manager rules start on 13 November 2026, and the main duties for clinics and hospitals start on 13 May 2027. A Press Information Bureau release of 5 August 2026 still describes an 18-month phased implementation period (opens in a new tab).

The older rules do not switch off early. Section 43A of the Information Technology Act, 2000, sits behind the SPDI Rules, and the DPDP Act removes it through Section 44(2). The commencement notification, G.S.R. 843(E), brings Section 44(2) into force eighteen months after publication (opens in a new tab) (PDF), on 13 May 2027.

Clinics and hospitals therefore work under two rulebooks until 13 May 2027.

The SPDI Rules bind a "body corporate", so ask your lawyer whether your practice's structure falls inside that term. Trade press reported in early 2026 that the Ministry of Electronics and Information Technology (MeitY) consulted on a shorter window, but as of 1 October 2026 the notified dates stand.

Where does patient data enter a healthcare website?

Patient data enters a healthcare website through enquiry and booking forms, chat buttons, report downloads, patient portals, job forms, and the analytics tags that watch all of them. Each entry point needs its own notice, and a safeguard sized to the data it collects.

A Data Processor processes personal data on the Data Fiduciary's behalf, such as a booking vendor or hosting company. Section 8(2) of the DPDP Act allows this only under a valid contract, so every third-party tool above needs one.

One patient journey can cross several rows. On a telemedicine platform with integrated booking that Raqbash built for a multi-specialty clinic network, patient data entered at five separate points: booking, reminders, payments, video consultations and record downloads.

If the journey also runs through a patient app, check what compliance adds to mobile app development cost before you budget it.

What must a medical website privacy policy and consent notice say?

From 13 May 2027, a medical website privacy policy must sit alongside a consent notice at each form. That notice lists the data collected, the purpose, and how the patient can withdraw consent, exercise rights and complain to the Data Protection Board. SPDI Rule 4 already requires a privacy policy on the website today.

Rule 3 of the DPDP Rules sets the notice contents:

• An itemised list of the personal data the form collects
• The specified purpose and the service it supports
• Links to withdraw consent, exercise rights and complain to the Board
• Wording that makes sense on its own

Rule 9 adds one line: publish the contact details of a Data Protection Officer or another person who can answer patient data questions. Only a Significant Data Fiduciary must appoint a Data Protection Officer based in India, under Section 10.

Section 6(1) of the DPDP Act requires consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. On a website, that means an unticked checkbox beside the notice. Section 6(4) adds that withdrawing consent must be as easy as giving it.

Response windows differ between the two regimes. The Press Information Bureau's November 2025 summary says the DPDP Rules allow a maximum of 90 days to respond (opens in a new tab) to a patient's rights request. SPDI Rule 5(9) requires grievances to be redressed within one month. Until May 2027, work to the one-month limit.

Your agency and hosting vendors are Data Processors, so check who owns the cloud account. Raqbash's security, NDA and IP ownership terms show one way to write that down.

Which trackers and ad tools put patient data at risk?

In our experience, analytics and advertising tags are the most common way patient data leaves a healthcare website unnoticed. They record page URLs, page titles and form events, so a thank-you page called "appointment-confirmed-dermatology-priya" sends a condition and a first name to a third party.

The HTTP Archive Web Almanac 2025 found at least one third-party tracker on 75% of web pages (opens in a new tab) in its global crawl. The real question is what your tags can see.

The failures we see most often:

• Personal data in URLs and page titles. Google's policy says sites must not pass personally identifiable information to Google Analytics (opens in a new tab), and names URLs, page titles and campaign tags as risk areas. Use neutral URLs such as /booking/confirmed.
• Retention left on the default. As of October 2026, Google Analytics 4 standard properties let you keep user-level data for 2 months or 14 months (opens in a new tab). Choose the shorter period where you can.
• Free-text fields copied into events. A "reason for visit" box sent as an event parameter puts patient data in an analytics account.
• Tracking on paediatric pages. Section 9(3) of the DPDP Act bars tracking and targeted advertising directed at children, and the healthcare exemption covers only what health services need.

Ad audiences on health sites need the same care as analytics tags. Google treats health as a sensitive interest category, so health advertisers cannot use advertiser-curated audiences such as Customer Match (opens in a new tab), which are lists built from your own customer data.

A good clinic website development brief settles this before the tags go in: list the events you will track and keep everything else out.

What patient data security controls does the DPDP Act expect?

Patient data security under Rule 6 of the DPDP Rules means seven controls. They are encryption or tokens in place of raw data, access control, logs with monitoring, backups, at least one year of log retention, contracts with processors, and staff measures. They start on 13 May 2027 and take months to build.

Two rules from the Indian Computer Emergency Response Team (CERT-In) already apply. Its Directions of 28 April 2022 cover organisations including any body corporate, and require information and communications technology (ICT) logs to be kept for a rolling 180 days within Indian jurisdiction (opens in a new tab) (PDF). Clocks must sync to Network Time Protocol (NTP) servers of the National Informatics Centre or the National Physical Laboratory. NTP keeps computer clocks in step, which matters when you rebuild an incident from logs.

Keep logs for one year inside India and one setting meets both the CERT-In and DPDP rules. AWS, for example, runs two Indian regions: Mumbai and Hyderabad.

On the application side, the OWASP Top 10:2025 ranks Broken Access Control as the top web application risk (opens in a new tab). Broken access control means a user can reach data they should not, for example by changing a report number in a URL and opening another patient's results.

On an electronic health records system for a regional hospital group, Raqbash built granular audit logging and role-based permissions into the patient record from the start. Adding them later means revisiting every screen.

If your portal keeps its own patient database, scope this work with backend development services that cover encryption, access control and logging.

The weak point is often a person. Tedros Adhanom Ghebreyesus, Director-General of the World Health Organization (opens in a new tab), told the UN Security Council in November 2024: "Humans are both the weakest and strongest links in cybersecurity." Staff training belongs on the same list as encryption.

What happens if a clinic or hospital website is breached?

A breach starts three clocks. The Indian Computer Emergency Response Team (CERT-In) expects a report within 6 hours of noticing a listed incident. From 13 May 2027, affected patients must also be told without undue delay, and the Data Protection Board must receive a detailed report within 72 hours.

Rule 7(2) of the DPDP Rules, 2025 requires the detailed report to the Board within seventy-two hours (opens in a new tab) (PDF) of becoming aware of the breach. Run both reports from one incident log with one owner.

CERT-In handled 29.44 lakh (2,944,000) cyber incidents in 2025 (opens in a new tab) across all sectors in India, according to a Press Information Bureau backgrounder (PDF) of 23 January 2026.

Penalties under the DPDP Act are ceilings, not fixed fines. The DPDP Act, 2023 allows penalties of up to ₹250 crore (opens in a new tab) (₹2,500,000,000, about US$26.1 million) for failing to take reasonable security safeguards. It allows up to ₹200 crore (₹2,000,000,000, about US$20.9 million) for failing to notify a breach or breaking the children's data rules. Other breaches carry up to ₹50 crore (₹500,000,000, about US$5.2 million).

Conversions use ₹95.75 per US dollar, the Financial Benchmarks India (FBIL) reference rate for the week ended 21 August 2026, published by the Reserve Bank of India.

How long can a clinic keep patient data from its website?

Keep website data only as long as its purpose lasts, unless another law requires longer. The DPDP Act requires erasure once the purpose is no longer served. The National Medical Commission (NMC) Code of Medical Ethics Regulations, 2002, require physicians to keep indoor patient records for 3 years from the start of treatment (opens in a new tab).

The DPDP erasure duty and the NMC retention rule cover different data. An enquiry that never became a patient should not sit in a mailbox for three years. The NMC code also expects requested records to be issued within 72 hours, a fair test of whether your portal can find them.

Do ABDM and children's data change the rules?

Yes, in two narrow ways. The Ayushman Bharat Digital Mission (ABDM) shares records only with the patient's revocable, time-bound consent. Children's data needs verifiable parental consent under Section 9 of the DPDP Act, with a limited exemption for health services.

A Press Information Bureau release of 6 July 2026 reported over 93 crore (930,000,000) Ayushman Bharat Health Account (ABHA) accounts (opens in a new tab), with over 104 crore (1,040,000,000) health records linked to them. ABDM consent governs sharing inside the network; in our reading, the website still needs its own notice for what it collects.

A child is anyone under 18, under Section 2(f). The Fourth Schedule of the DPDP Rules exempts clinical establishments and healthcare professionals from parts of Section 9, but only as far as health services to the child require. Section 7(f) allows processing without consent in a medical emergency, not for routine bookings.

The DPDP Act healthcare checklist: what to fix and by when

Fix what already applies first, then build towards 13 May 2027. Start now on the SPDI, CERT-In and NMC items:

• Publish a privacy policy and name a grievance contact who replies within one month
• Add a 6-hour CERT-In reporting step to your incident plan
• Keep logs for 180 days inside India, with clocks synced to NIC or NPL time servers
• Remove names, phone numbers and conditions from URLs, page titles and analytics events

Before 13 November 2026, list every vendor that touches patient data, check each contract, and ask consent vendors whether they plan to register as Consent Managers.

Before 13 May 2027, build the DPDP layer:

• Add a Rule 3 notice and an unticked consent box to every form
• Make withdrawal as easy as consent
• Set up a process that answers rights requests and complaints within 90 days
• Extend log retention to at least one year
• Add verifiable parental consent to paediatric forms
• Rehearse the 72-hour Board report alongside the CERT-In report

Illustrative example. Assume a three-doctor clinic site with a symptoms field on its enquiry form, a third-party booking widget, Google Analytics 4 and hosting outside India. This checklist flags four issues: the symptoms field, a thank-you URL carrying the doctor's speciality, no booking-vendor contract, and logs stored outside India. The first two are configuration fixes and the contract is paperwork, but moving the hosting is the expensive one.

Hosting region, booking vendor and log storage are cheap to choose well at build time and costly to change later. If the fixes need a rebuild, a website development team can scope them as one project rather than a string of plugin patches.

For budgeting, see how website development cost breaks down; any figure you get should be an indicative range tied to a written scope.

Raqbash builds and maintains healthcare websites from Ahmedabad for clinics, diagnostic labs and hospital groups in India and abroad. On a compliance-sensitive build, we start by mapping every form, widget and tracker that touches patient data, then scope the fixes and estimate them before you commit. Work runs in two-week sprints with a working demo each cycle and a named point of contact, and production stays in cloud accounts you own. We work alongside your legal adviser rather than replacing one. To have your site reviewed against this checklist, start a project brief.