For a private hospital, the medical records retention period in India is about to become the hospital’s own decision. From 13 May 2027, India’s Digital Personal Data Protection Act, 2023 (the DPDP Act), the law governing how businesses use digital personal data, requires a hospital to erase personal data once its purpose is no longer served, unless another law requires it to be kept. The Rules set no deemed period for hospitals, so each one must write its own. A|P’s reading, not settled law; confirm with counsel.

Take an 80-bed multi-specialty hospital in Lucknow. It holds nine years of digitised records from its outpatient and inpatient departments (OPD and IPD), and its patient relations desk calls a list of diabetic patients every quarter. That list is its strongest patient retention asset. From 13 May 2027, the hospital must be able to say, for each record, why it still holds it and what it may use it for. A|P’s reading, not settled law; confirm with counsel.

This is the third Provider piece in A|P’s DPDP series. The first two, Where patient data actually lives in an Indian private hospital and Consent or “voluntarily provided”? Designing patient intake under the DPDP Act, cover mapping the data and collecting it. The series guide page, The DPDP Act and Rules for Indian healthcare businesses, holds the timeline.

Does every existing patient record need a fresh notice?

Not every record, but every record held on consent. From 13 May 2027, where a patient consented before that date, when s.5 comes into force (s.1(2)), the hospital must give her a notice “as soon as it is reasonably practicable”, describing the data, its purpose, how to withdraw consent or raise a grievance (s.6(4), s.13), and how to complain to the Data Protection Board of India (s.5(2)(a)). It may keep processing that data until she withdraws (s.5(2)(b)). A|P’s reading, not settled law; confirm with counsel.

Records collected only for treatment, with no consent on file, have no such shortcut. From 13 May 2027, they can stay with the hospital for the treatment purpose (s.7(a)), but using them for anything new needs fresh consent with its own notice (s.5(1), s.6(1)). A|P’s reading, not settled law; confirm with counsel.

How long can a hospital keep patient records under the DPDP Act?

From 13 May 2027, the hospital must erase personal data when the patient withdraws consent or “as soon as it is reasonable to assume that the specified purpose is no longer being served”, whichever is earlier, unless another law requires it to be kept, and it must make its processors erase their copies too (s.8(7)).

The Act lets the Rules fix a period after which a purpose is deemed to be over (s.8(8)), but the DPDP Rules, 2025 fix one only for large e-commerce, online gaming and social media platforms (Rule 8(1); Third Schedule). Hospitals are not on that list, so the period is the hospital’s own judgement, and it should be written down. A|P’s reading, not settled law; confirm with counsel.

Two floors apply. From 13 May 2027, every data fiduciary must keep personal data and processing logs for at least one year from the date of processing, for the government purposes listed in the Seventh Schedule, and then erase them unless another law requires more (Rule 8(3)). That year serves those purposes, not the hospital’s own follow-ups, and how it sits with erasure on withdrawal (s.8(7)) or on request (s.12(3)) is not settled. A|P’s reading, not settled law; confirm with counsel.

Every physician must already keep indoor-patient records for three years from the start of treatment under the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 (reg. 1.3.1). The duty sits with the doctor rather than the hospital, the regulation says nothing about OPD records, and other laws may set longer periods. A|P’s reading, not settled law; confirm with counsel.

Record type	Minimum to keep	When to erase
IPD records	3 years from start of treatment, a doctor’s duty (NMC reg. 1.3.1)	When the hospital’s own period ends, unless another law requires more
OPD records	1 year from processing (Rule 8(3))	When treatment continuity no longer needs them, by the hospital’s written period
Processing logs	1 year from processing (Rule 8(3))	After the year, unless another law requires more
Follow-up and camp lists	1 year from processing (Rule 8(3))	On withdrawal of consent (s.8(7)(a)); any copy kept for the Rule 8(3) year is not for further use

The schedule is illustrative. A|P’s reading, not settled law; confirm with counsel.

Can the hospital still use the list for follow-ups and camps?

Holding a record and using it are different questions. From 13 May 2027, a chronic-care follow-up call may sit within the treatment purpose the patient gave her data for (s.7(a)), but a health camp invitation or a package offer is a new purpose and needs consent for it (s.6(1)). Whether routine follow-up counts as treatment is not settled; the series’ intake piece treats reminders as a consent purpose, which is the safer course. A|P’s reading, not settled law; confirm with counsel.

From the same date, a patient who withdraws consent must be able to do so as easily as she gave it, and the hospital must stop its processors too (s.6(4), (6)). She can also ask for erasure, which the hospital must carry out unless the data is still needed for the purpose or another law requires it to be kept (s.12(3)). A|P’s reading, not settled law; confirm with counsel.

A|P’s explainer on NABH’s IMS chapter on data governance covers the same request mechanism from the accreditation side. NABH is the National Accreditation Board for Hospitals & Healthcare Providers.

What applies before 13 May 2027?

Until then, health data held by a body corporate is governed by section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the SPDI Rules).

They already say that sensitive personal data, which includes medical records (rule 3), must not be kept longer than its lawful purpose or another law requires (rule 5(4)), and must be used only for the purpose it was collected for (rule 5(5)). They also require written consent before collection (rule 5(1)), so a record with no consent on file may already be a gap. An OPD register reused for a camp invitation may already fall outside rule 5(5). A|P’s reading, not settled law; confirm with counsel.

How to clean up the patient database in four steps

A|P treats the database as an operating asset, in line with its work on operational excellence for private clinics and hospitals in India. Four steps, done before 13 May 2027, also put any plan for how to recover inactive patients on a basis the hospital can show. A|P’s reading, not settled law; confirm with counsel.

1. Sort records by basis. Consent on file, treatment only, or no clear basis.
2. Plan the s.5(2) notices. One Rule 3 notice for each consent-based list, in the patient’s language, ready to send from 13 May 2027.
3. Write the retention schedule. IPD, OPD, logs and lists, each with a minimum, a maximum and the law behind it.
4. Build erasure into the systems. From 13 May 2027, withdrawal and erasure must reach the CRM, the messaging vendor and every other processor (s.6(6), s.8(7)(b)).

List or liability?

Back to the Lucknow hospital: the diabetic follow-up list is the clearest answer to how to improve hospital patient retention in India, and it is also the list most likely to be used beyond its purpose. The decision for its owner is whether to re-permission that list and set its retention period before 13 May 2027, or to keep using it on permissions it may not be able to show. A|P’s reading, not settled law; confirm with counsel.

This is the last piece in the series. The guide page tracks what changes next.

Frequently asked questions about the medical records retention period in India

How long must a private hospital keep patient records in India?

Doctors must keep indoor-patient records for three years from the start of treatment (NMC reg. 1.3.1). From 13 May 2027, the DPDP Rules add a one-year minimum from the date of processing for personal data and logs, kept for the government purposes in the Seventh Schedule (Rule 8(3)). Other laws may require longer. A|P’s reading, not settled law; confirm with counsel.

Do old patient consents still count under the DPDP Act?

Yes, for the purposes they covered. From 13 May 2027, the hospital may keep processing data consented to before 13 May 2027 until the patient withdraws, but it must send her a fresh notice as soon as reasonably practicable (s.5(2)). A|P’s reading, not settled law; confirm with counsel.

Can a patient ask a hospital to delete her records?

From 13 May 2027, yes, and the hospital must erase them unless it still needs them for the purpose or another law requires them to be kept (s.12(3)), such as the rule that doctors keep inpatient records for three years (NMC reg. 1.3.1). A|P’s reading, not settled law; confirm with counsel.