Introduction
The hospital's administration knew the DPDP Act applied to it and knew the 13 May 2027 deadline. It did not know what data it held, which vendors processed it, or what the front desk was telling patients when it collected their Aadhaar copies.
The engagement was scoped to produce working documents, not a report.
The Approach
Week one was a data-mapping workshop with department heads. From that we produced a two-page roadmap and then drafted in order of exposure: the patient notice in Hindi and English, a consent mechanism for the app, data-processing agreements with the laboratory information system vendor and the insurance TPA, a breach-response procedure with the intimation timelines, and a retention schedule.
A two-hour training session for registration and billing staff closed the engagement.
Testimonial
“We were sent a two-page roadmap, not a policy manual. The notice went live in a week.”
Results
Documents live
Notices, consent flow, DPAs and breach procedure in force
Staff trained
Front-line staff trained on collection and consent
DPDP compliance for a hospital is mostly discipline at the point of collection. The documents follow from the map.
Illustrative matters. Facts, names and identifying details have been changed or combined to protect client confidentiality. No outcome in any past matter is a promise about any future matter.
When To Call Sarvā Nyāy
If you are facing something like this, the first conversation is about what to preserve and where to file. It is without charge and without obligation.
