Knowing how to sell to hospitals in India now includes knowing what India’s Digital Personal Data Protection Act, 2023(the DPDP Act), the law governing how businesses use digital personal data, does to a vendor’s contract. Most of its duties apply from 13 May 2027. A software vendor that processes patient data on a hospital’s instructions is a data processor, and the Act places the duties for that data on the hospital, the data fiduciary, not on the vendor. A|P’s reading, not settled law; confirm with counsel.

That does not make the vendor’s life easier. From 13 May 2027, the hospital stays responsible for its processors’ work “irrespective of any agreement to the contrary” (s.8(1)). A hospital cannot contract its regulatory responsibility away, so it will contract the vendor’s behaviour in, and shift the cost of a failure to the vendor where it can. A|P’s reading, not settled law; confirm with counsel.

A seed-stage Bengaluru revenue-cycle software company bidding for a 150-bed hospital in Indore can expect the question in the hospital’s vendor questionnaire. Hospitals are already asking healthtech vendors to show DPDP readiness in procurement, a pattern A|P sees in its client work.

This is the second Builder piece in A|P’s DPDP series. The first, Data fiduciary vs data processor: how the DPDP Act reads your healthtech business model, covers how a vendor’s role is decided, and the series guide page, The DPDP Act and Rules for Indian healthcare businesses, holds the timeline and the notifications to watch. This one assumes you are a processor and asks what that means for the sale.

Why will a hospital write the DPDP Act into your contract?

Every duty the Act places around a processor is written as a duty of the fiduciary. From 13 May 2027, the hospital must:

• use a processor “only under a valid contract” (s.8(2)), and that contract must provide for reasonable security safeguards (DPDP Rules, 2025, Rule 6(1)(f));
• protect data “including in respect of any processing undertaken by it or on its behalf by a Data Processor” (s.8(5));
• make its processors stop processing when a patient withdraws consent (s.6(6)), and erase data it gave them (s.8(7)(b));
• make its processors keep data and logs for at least a year, as the Rules’ own illustration of a cloud host shows (Rule 8(3), Case 2);
• tell a patient who asks the identities of every processor her data was shared with (s.11(1)(b)).

From 13 May 2027, the penalties also land on the hospital, up to ₹250 crore for failing to take reasonable security safeguards (Schedule to the Act). A hospital carrying that exposure for work your product does will want each duty mirrored in your contract, with an indemnity behind it. A|P’s reading, not settled law; confirm with counsel.

What will a hospital ask a healthtech vendor to sign?

A|P’s go-to-market strategy for healthtech startups in India treats selling into Indian hospitals as “its own discipline”. The DPDP Act adds five clauses to that discipline. Each one maps to a provision the hospital has to meet. A|P’s reading, not settled law; confirm with counsel.

Security safeguards

From 13 May 2027, Rule 6(1)(a)–(e) sets technical minimums: encryption, masking or tokenisation; access control; logs of who accessed data, with monitoring and review; backups; and keeping those logs and the data for a year to investigate unauthorised access. Expect the hospital to ask you to meet each one in writing and to show how. A|P’s reading, not settled law; confirm with counsel.

Breach notice to the hospital

From 13 May 2027, the hospital must tell each affected patient and the Data Protection Board of India, the regulator, “without delay”, and give the Board a detailed report within 72 hours of becoming aware of a breach (s.8(6); Rule 7). If the breach happens in your systems, the hospital’s clock depends on how fast you tell it, and whether a hospital counts as aware when its vendor is aware is not settled. Expect a notice window much shorter than 72 hours. A|P’s reading, not settled law; confirm with counsel.

A separate clock already runs today. CERT-In’s directions of 28 April 2022, issued under IT Act s.70B(6), require any service provider, data centre or body corporate to report listed cyber incidents, including data breaches and data leaks, to CERT-In within 6 hours of noticing them. That duty sits on the vendor as well as the hospital. A|P’s reading, not settled law; confirm with counsel.

Retention and erasure

From 13 May 2027, the hospital must make sure its processors keep personal data and processing logs for at least a year (Rule 8(3), Case 2), must have them erase the data it gave them (s.8(7)(b)), and must make them stop processing a patient’s data when consent is withdrawn (s.6(6)). Expect each of these as a clause your product has to support. A|P’s reading, not settled law; confirm with counsel.

Support for patients’ rights

From 13 May 2027, patients can ask the hospital for a summary of their data, for correction and erasure, and for the identities of every processor their data has been shared with (ss.11(1)(b), 12). The hospital can only answer through your product. Expect a clause requiring you to export, correct or erase one patient’s records on request, within a time that fits the hospital’s published response period. A|P’s reading, not settled law; confirm with counsel.

Processing only on instructions

A processor processes data “on behalf of” the fiduciary (s.2(k)). Expect a clause limiting your use of the data to providing the service. Any reuse for your own analytics or AI training would make you a fiduciary for that use, which the first Builder piece in this series covers. Whether that reuse is worth it is a regulatory-market fit question in A|P’s product-market fit framework for healthtech startups in India. A|P’s reading, not settled law; confirm with counsel.

Does any of this apply before 13 May 2027?

Yes. Until 13 May 2027, health data held by a body corporate is governed by section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the SPDI Rules). Their retention, correction and security duties apply to a body corporate “or any person on its behalf” (rules 5(4), 5(6), 5(8)), so a vendor holding a hospital’s patient data is addressed directly today, not only through the contract. Two of the rules also shape the deal itself. A|P’s reading, not settled law; confirm with counsel.

First, a hospital may transfer patient data to another company only if that company “ensures the same level of data protection”, and only where the transfer is necessary for a lawful contract with the patient or the patient has consented (rule 7). Second, a documented security programme is the standard, and IS/ISO/IEC 27001 counts as compliance if it is independently audited (rules 5(8), 8). A hospital that asks for your ISO certificate today is applying the 2011 Rules. A|P’s reading, not settled law; confirm with counsel.

Is a DPDP procurement pack worth building now?

The B2 pillar’s own warning applies: “Most launches that lose momentum lost it before they launched”. A vendor that answers each hospital’s questionnaire from scratch spends sales time on paperwork, and a slow answer to a security question reads as a security gap. A pack built once and reused across deals turns compliance from a delay into evidence, which makes it part of a B2B healthcare sales strategy rather than a legal afterthought.

It also serves both regimes. The same security statement answers SPDI rule 8 today and DPDP Rule 6 from 13 May 2027. A|P’s reading, not settled law; confirm with counsel.

The DPDP procurement pack: six documents

Build these before the first hospital asks. None needs outside help to draft, though counsel should review the contract schedule.

1. A data-flow map. What patient data your product touches, where it is stored, and every sub-processor, such as your cloud host or messaging provider.
2. A security statement mapped to Rule 6. One line per minimum in Rule 6(1)(a)–(g), with your control and evidence, and your ISO/IEC 27001 certificate if you hold one.
3. A breach runbook. Who detects, who tells the hospital, through which channel and within how many hours.
4. A retention and erasure procedure. The one-year floor, erasure on instruction, and how a consent withdrawal reaches your systems.
5. A rights-support note. How the hospital can export, correct or erase one patient’s records, and how fast.
6. A draft data processing agreement. Your standard contract terms covering the five clauses above, so the hospital edits your draft instead of you editing theirs.

The choice for a founder

Most hospital deals from now on will include some version of these questions. The 13 May 2027 date only decides how hard they are asked. So the choice in how to sell to hospitals in India is between building the pack once, as a sales asset, and answering the same questions deal by deal while the hospital’s legal team sets the terms.

Next in the series: patient communication on WhatsApp, voice and apps under the DPDP Act.

Frequently asked questions on how to sell to hospitals under the DPDP Act

Does the DPDP Act apply directly to a data processor?

Not directly. The Act places its duties on the data fiduciary and reaches processors through the fiduciary. From 13 May 2027, the hospital is responsible for its processors’ processing “irrespective of any agreement to the contrary” (s.8(1)) and may use a processor only under a valid contract (s.8(2)). A|P’s reading, not settled law; confirm with counsel.

What should a data processing agreement with an Indian hospital cover?

Five things: Rule 6 security safeguards, breach notice to the hospital, retention and erasure, support for patients’ rights, and processing only on the hospital’s instructions. Each maps to a duty the hospital carries from 13 May 2027. A|P’s reading, not settled law; confirm with counsel.

How fast must a healthtech vendor report a data breach to a hospital?

The DPDP Act sets no deadline for the vendor to tell the hospital; the contract does. From 13 May 2027, the hospital must report to the Board without delay and in detail within 72 hours (Rule 7(2)), so the vendor’s window has to be shorter. Separately, CERT-In’s 2022 directions already require listed incidents to be reported to CERT-In within 6 hours. A|P’s reading, not settled law; confirm with counsel.