As of October 2026, the DPDP Rules 2025 are notified but most of their duties for health apps are not yet in force. Registration of consent managers opens on 13 November 2026, and the core obligations (notice, security safeguards, breach reporting to the Data Protection Board within 72 hours, children’s data, retention and data-principal rights) apply from 13 May 2027. The rules were published in the Gazette as G.S.R. 846(E), dated 13 November 2025, and phase in over eighteen months. This guide sets out what each rule asks of a health app, which dates are confirmed by primary sources, where health providers get a specific exemption, and a checklist you can work through before May 2027.
1. The Deadlines, With Sources
The Gazette text of the Digital Personal Data Protection Rules, 2025 is dated 13 November 2025. Rule 1 sets three commencement dates, each counted from publication in the Gazette:
| Date | What comes into force | What it means for a health app | Source |
|---|---|---|---|
| 13 Nov 2025 | Rules 1, 2 and 17–21: definitions, and the appointment, procedure and staffing of the Data Protection Board | Nothing to build yet. The Board is being set up | Rule 1(2) |
| 13 Nov 2026 | Rule 4 and the First Schedule: registration and obligations of consent managers | Companies can apply to the Board to become consent managers. It does not require you to use one | Rule 1(3): “one year after the date of publication” |
| 13 May 2027 | Rules 3 and 5–16, 22 and 23: notice, security safeguards, breach intimation, retention, contact details, children, Significant Data Fiduciaries, rights, cross-border transfer, research exemption, appeals, information requests | Almost every operational duty applies from this date | Rule 1(4): “eighteen months after the date of publication” |
- 13 or 14 November. The Gazette and MeitY’s 12 August 2026 answer in the Lok Sabha both give 13 November 2025. The PIB backgrounder says 14 November. Plan to the earlier date.
- The Act follows the same timetable. MeitY’s answer describes the eighteen-month phase as “compliance obligations for Data Fiduciaries including data principal rights, security safeguards and breach notification.”
- The shorter timeline was only a proposal. MeitY consulted in early 2026 on cutting eighteen months to twelve. We found no notified amendment, and the August 2026 answer still describes eighteen months.
2. Notice and Consent
Under the Act, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as it was to give. Rule 3 sets out what the notice that asks for consent must contain. It must:
- be understandable on its own, “independently of any other information” (so a link to a long privacy policy is not enough);
- give an itemised description of the personal data you collect;
- state the specified purpose and describe the goods, services or uses the processing enables;
- give a link to your website or app and describe how the person can withdraw consent, exercise their rights and complain to the Board.
For a health app, “itemised” means the categories you actually hold: contact details, date of birth, ABHA number, symptoms, diagnoses, prescriptions, lab reports, device readings. Users must be able to read the notice in English or any Eighth Schedule language. Existing users are not grandfathered: section 5(2) requires you to send them a notice “as soon as practicable”.
Section 7 of the DPDP Act lists “certain legitimate uses” that need no consent, including responding to a medical emergency and providing treatment during an epidemic. They are narrow. Routine app-based care, analytics and marketing should rely on consent unless counsel says otherwise.
3. Consent Managers: What 13 November 2026 Actually Changes
The Act defines a consent manager as “a person registered with the Board” who acts as a single point of contact through which a person can give, manage, review and withdraw consent on an interoperable platform. Rule 4, in force from 13 November 2026, lets a company apply to the Board for registration. The First Schedule sets the conditions. Among them, the applicant must:
- be a company incorporated in India;
- have a net worth of at least two crore rupees;
- be independently certified as meeting the data protection standards the Board publishes;
- keep consent records for at least seven years, avoid conflicts of interest with Data Fiduciaries, and not read the personal data that flows through it.
Two misreadings are common. First, 13 November 2026 is not a deadline for health apps to appoint a consent manager. Nothing in the rules makes using one mandatory. Second, the ABDM consent manager is a different thing: ABDM’s Health Data Management Policy defines it as “an electronic system”, not a registered company. Whether ABDM’s infrastructure will register under Rule 4 has not been published, and ABDM integration does not replace your own DPDP notice and consent. Our ABDM integration guide covers the ABDM consent flow in detail.
4. Breach Intimation: “Without Delay” and 72 Hours
Rule 7 has two tracks, triggered when you become aware of a breach. There is no harm threshold.
| To whom | When | What |
|---|---|---|
| Each affected person | Without delay, through their user account or a registered contact channel | What happened, likely consequences, your mitigation, steps they can take, and a contact person |
| Data Protection Board, first notice | Without delay | Description of the breach: nature, extent, timing, location and likely impact |
| Data Protection Board, detailed report | Within 72 hours of becoming aware, or longer if the Board allows it on a written request | Updated details, causes, mitigation, findings on who caused it, steps to prevent recurrence, and a report on the notices sent |
A faster clock already applies. The CERT-In Directions of 28 April 2022 require listed cyber incidents to be reported within 6 hours, and logs kept for a rolling 180 days. Build one incident process that produces the CERT-In report first and the Board report second. Our CERT-In reference summarises those directions.
5. Children’s Data and the Healthcare Exemption
Under the Act, a child is anyone under eighteen. Section 9 imposes three duties: get verifiable consent from a parent before processing a child’s data (9(1)); do not process data in a way likely to harm the child’s well-being (9(2)); and do not track, behaviourally monitor or target advertising at children (9(3)).
Rule 10: check that the claimed parent is an identifiable adult, using reliable identity and age details you hold, or details or a virtual token from an authorised entity such as a DigiLocker provider.
Rule 12 and the Fourth Schedule carve out exemptions from 9(1) and 9(3). The first two matter most for healthcare:
- a clinical establishment, mental health establishment or healthcare professional, where processing is “restricted to provision of health services to the child” and only “to the extent necessary for the protection of her health”;
- an allied healthcare professional, where processing supports a treatment and referral plan recommended by such a professional, again only as far as needed to protect the child’s health.
If you sell software to clinics, the exemption belongs to the clinic. Build the parental-consent flow anyway and let it be switched off only for treatment workflows.
6. Security Safeguards, Logs, Retention and Erasure
Rule 6 sets minimum safeguards: encryption, masking or tokenisation; access control; logging and monitoring to detect unauthorised access; backups; and processor contracts that require safeguards. Rule 6(1)(e) requires you to keep those logs and related personal data for one year, unless another law says otherwise.
Rule 8(3) adds a general rule: keep personal data, traffic data and processing logs for at least one year from the date of processing, then erase them unless another law requires longer. The official illustration says this applies even if the user deletes their account.
Section 8(7) of the Act requires erasure, by you and your processors, when consent is withdrawn or the purpose is no longer served, unless a law requires retention. The three-year inactivity rule with a 48-hour warning in Rule 8(1)–(2) applies only to large e-commerce, gaming and social media platforms, not to health apps.
Clinical records are often covered by other retention laws, which the Act respects. Record which law sets each category’s retention period and erase the rest on schedule. Our guides on health-data encryption and audit logging are written for HIPAA but map well onto Rule 6.
7. Data-Principal Rights and the 90-Day Clock
Individuals can seek information, correction, updating and erasure, grievance redressal, and nominate someone to act for them. Rule 14 requires you to publish how to make a request, what identifier you need, and your grievance response period, which may not exceed ninety days. Rule 9 requires published contact details for a DPO or someone who can answer processing questions, included in every rights response.
Nomination matters in healthcare, where patients may be too ill to act. Build a way to record a nominee and verify their requests.
8. Significant Data Fiduciaries
The government can notify any Data Fiduciary as a Significant Data Fiduciary (SDF), based on factors that include “the volume and sensitivity of personal data processed” and risk to individuals’ rights. Large hospital chains, diagnostics networks and health platforms are plausible candidates. We found no notification designating any SDF as of this review.
If you are notified, section 10 of the Act and Rule 13 require you to:
- appoint a Data Protection Officer based in India who reports to the board, and an independent data auditor;
- carry out a Data Protection Impact Assessment and an audit every twelve months, and have the person who conducts them send the Board a report of significant observations;
- check that your technical measures, “including algorithmic software”, are not likely to pose a risk to individuals’ rights, which covers AI triage and risk-scoring models;
- keep inside India any personal data the government specifies on a committee’s recommendation, together with the traffic data about its flow.
9. Cross-Border Transfer
Section 16 lets the government restrict transfers to countries it notifies, and preserves stricter sector laws. Rule 15 adds any requirements the government sets by order on making data available to a foreign state or its agencies. We found no notified list of restricted countries as of this review. If you host Indian patient data abroad, record where it goes and keep a way to move it.
10. Penalties
Penalties are set in the Schedule to the Act and imposed by the Board after an inquiry. The maximum amounts are:
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach (s. 8(5)) | ₹250 crore |
| Failure to notify the Board or affected individuals of a breach (s. 8(6)) | ₹200 crore |
| Breach of the additional obligations for children (s. 9) | ₹200 crore |
| Breach of the additional obligations of a Significant Data Fiduciary (s. 10) | ₹150 crore |
| Breach of a data principal’s duties (s. 15) | ₹10,000 |
| Breach of a voluntary undertaking accepted by the Board (s. 32) | Up to the amount applicable to the original breach |
| Any other breach of the Act or the rules | ₹50 crore |
Source: the Schedule to the Digital Personal Data Protection Act, 2023; the first three figures are also given in the PIB backgrounder.
11. Health-App Implementation Checklist
Work through this before 13 May 2027.
| # | Build or document | Rule / section |
|---|---|---|
| 1 | A data map: each data category, its purpose, legal basis, processors and retention law | Rule 3; s. 7; s. 8(7) |
| 2 | A standalone, itemised, versioned notice in English or any Eighth Schedule language | Rule 3; s. 5 |
| 3 | Consent records linked to notice versions; withdrawal as easy as consent | Rule 3(c); s. 6 |
| 4 | Age capture, verified parental consent, no tracking or targeted ads for under-18s | Rules 10–12; s. 9 |
| 5 | Encryption at rest and in transit, role-based access control and monitored access logs | Rule 6(1)(a)–(c) |
| 6 | Log and processing-record retention of at least one year, then scheduled erasure | Rules 6(1)(e), 8(3) |
| 7 | Processor contracts that require security safeguards and erasure on instruction | Rule 6(1)(f); s. 8(7)(b) |
| 8 | A breach runbook: users and Board without delay, Board report within 72 hours, CERT-In within 6 hours | Rule 7; CERT-In Directions |
| 9 | A rights portal (access, correction, erasure, grievance, nomination) with 90-day tracking | Rule 14 |
| 10 | Published DPO or privacy contact details, included in every rights response | Rule 9 |
| 11 | A list of where data is hosted and transferred, ready for any transfer restriction | Rule 15; s. 16 |
| 12 | If you could be an SDF: an annual DPIA and audit plan, and a review of algorithmic risk | Rule 13 |
VertiComply generates full-stack healthcare apps (web and native iOS/Android) with safeguards for HIPAA, GDPR, DPDPA and ABDM, such as consent capture, access control, encryption and audit logs, plus FHIR building blocks. That covers the engineering rows above, not the legal analysis. Plans are priced in rupees too (Pro ₹8,999/month, Business ₹24,900/month; see pricing). See also our DPDPA reference page and, for European patients, the GDPR guide.
This is general information, not legal advice. Get advice from Indian counsel on how the DPDP Act applies to your product.
Frequently Asked Questions
When do the DPDP Rules 2025 apply to health apps?
Most obligations apply from 13 May 2027, eighteen months after the rules were published on 13 November 2025: notice, security, breach intimation, retention, children’s data, rights and cross-border transfer. Consent-manager registration starts on 13 November 2026. A proposal to shorten the timeline had not been notified as of October 2026.
Do health apps have to use a consent manager from November 2026?
No. Rule 4, in force from 13 November 2026, lets qualifying companies register with the Data Protection Board as consent managers. Nothing requires a hospital or health app to use one. You can manage consent yourself if your notice and withdrawal flow meet Rule 3 and the Act.
How fast must a health app report a data breach under the DPDP Rules?
Rule 7 requires you to inform affected people and the Data Protection Board without delay, and to send the Board a detailed report within 72 hours of becoming aware, unless it allows more time on written request. Separately, CERT-In requires listed cyber incidents to be reported within 6 hours.
Are hospitals exempt from parental consent for children’s data?
Partly. Clinical establishments, mental health establishments and healthcare professionals are exempt from parental consent and the tracking ban only for providing health services to the child, as far as needed to protect the child’s health. Other uses of the data, and consumer health apps, are not exempt.
What are the penalties under the DPDP Act for health data breaches?
The Board can impose up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a breach, up to ₹200 crore for breaching the children’s data obligations, up to ₹150 crore for breaching Significant Data Fiduciary obligations, and up to ₹50 crore for any other breach of the Act or rules.
How long must health apps keep logs under the DPDP Rules?
At least one year. Rules 6(1)(e) and 8(3) require security logs, processing logs and the related personal data to be kept for a year from processing, unless another law sets a different period. CERT-In separately requires a rolling 180 days of system logs.
Last reviewed 12 October 2026. Dates and figures are taken from the Gazette text of the DPDP Rules, 2025 (G.S.R. 846(E)), the DPDP Act, 2023 and MeitY statements. Check MeitY and the Data Protection Board for later notifications or amendments.