Estimated reading time: 4 minutes
A companion to Selling AI to Indian Hospitals, written for the hospital side.
Most writing about India’s data law speaks to software vendors. This one is for the hospital. Under the Digital Personal Data Protection Act, your hospital is almost always the data fiduciary: you decide why and how patient data is processed, and the legal responsibility sits with you. You cannot sign that liability away by handing the data to a vendor. If a tool you bought mishandles patient data, you are still answerable to the patient and to the regulator.
That is the whole point of getting this right. The questions your IT and compliance teams ask a vendor are really questions about your own exposure.
The short version:
- Your hospital is the data fiduciary, so the liability stays with you even when a vendor holds the data.
- The 2025 DPDP Rules put you on an eighteen-month clock, with the heavier duties landing around May 2027.
- Run the six-point checklist below on yourself, and ask every AI vendor the five data questions.
What changed in 2025
The runway is now a real clock. The government notified the Digital Personal Data Protection Rules in November 2025, which starts an eighteen-month phased timeline. The Data Protection Board and breach-notification duties come first. The heavier compliance obligations, with penalties of up to 250 crore rupees for weak security safeguards, land around May 2027. The practical message for a hospital is simple: the questions move earlier in every buying conversation, and “we will sort it later” stops being an option well before the deadline.
Your hospital’s DPDP checklist
You do not need a legal team on day one. You need to know where you stand on six things:
- Name who owns data decisions. One person, usually in IT or administration, who can say what patient data you hold, why, and who touches it.
- Know where patient data lives. Which systems, which vendors, on-premise or hosted, and in which country. Health data is sensitive, and the law lets the government restrict transfers abroad.
- Sign a Data Processing Agreement with every vendor that touches patient data, setting out what they may process, for what purpose, for how long, and what happens when the contract ends.
- Capture consent and honour erasure. Be able to show how patients agreed to the processing and how their data is deleted on request or at contract end.
- Keep access logs and a breach plan. Role-based access, a record of who saw what and when, encryption in transit and at rest, and a clear path for reporting a breach to the Board.
- Map your timeline to the clock. The Rules were notified in November 2025 and the heavier duties land around May 2027. Start with the vendors who hold the most sensitive data.
How to vet an AI vendor in one call
When an AI vendor pitches you, the fastest way to judge their seriousness is to ask the five data questions a compliant deployment has to answer: who is the data fiduciary, where the data lives, whether they bring a ready Data Processing Agreement, who can access the data and whether it is logged, and what their deletion and consent story is. A vendor who leads with “we are HIPAA compliant” has not done the homework, because HIPAA is an American law with no force here. We walk through each of those questions, from the vendor’s side, in the five data questions Indian hospitals ask AI vendors.
None of this is legal advice. Talk to a DPDP practitioner before you sign or change anything. But a hospital that can answer these six questions about itself, and ask the five of every vendor, is already ahead of most and a long way clear of the May 2027 deadline.
More in the field guide: the full Selling AI to Indian Hospitals playbook, and the vendor-side view of the DPDP data questions. Compliance is half the picture: the other half is why healthcare AI has a trust problem, and what earns it.
Get the monthly letter
Building BeyondChats in public: the numbers, the decisions, and what broke. One email a month. No spam, unsubscribe anytime.