Health Data Localisation: What the DPDP Rules Mean for Cloud-Based Clinic Software
On November 13, 2025, the Digital Personal Data Protection Rules were formally notified, bringing the DPDP Act, 2023 into full operational force and starting a phased compliance clock running through May 2027. For clinics and hospitals that have moved patient records, billing, and scheduling onto cloud-based practice management software, a critical and often overlooked detail of this framework is that the clinic itself, not the cloud vendor, carries primary legal accountability for how that data is handled.
Every Clinic Using Digital Patient Data Is a Data Fiduciary
Under the DPDP framework, every hospital, clinic, diagnostic lab, and telemedicine platform handling digital patient data is classified as a Data Fiduciary, the entity that determines the purpose and means of processing personal data and therefore bears primary legal accountability for compliance. Third parties such as cloud service providers, electronic health record vendors, billing processors, and laboratory information system partners typically function as Data Processors, operating on the Data Fiduciary’s instructions, but critically, liability for a compliance failure remains with the healthcare institution even when a processor’s system is where the actual breach or mishandling occurred.
This distinction matters immediately and practically: a clinic cannot treat DPDP compliance as the cloud vendor’s problem to solve. If a cloud-based clinic management platform mishandles patient data, the clinic that chose and contracted with that vendor is the party facing regulatory exposure, not solely the vendor itself.
What This Means for Existing Cloud Vendor Contracts
The DPDP Rules specifically require that a Data Fiduciary’s contracts with its Data Processors, including cloud providers, mandate equivalent security safeguards to those the Data Fiduciary itself must implement under Rule 6(f). For clinics already using cloud-based practice management, EHR, or billing software, this means existing vendor contracts need review, and in many cases renegotiation, to explicitly build in these security safeguard obligations rather than relying on generic vendor terms of service that predate the DPDP framework.
Clinics should specifically verify whether their cloud vendor contract addresses data breach notification timelines and responsibilities, since the Data Fiduciary remains the party legally required to report breaches, meaning a clinic needs contractual assurance that its cloud vendor will notify it promptly enough to meet the clinic’s own regulatory reporting obligations, rather than discovering a breach only after regulatory deadlines have already passed.
Consent, Notices, and Retention Rules That Touch Cloud Systems Directly
The DPDP framework requires clinics to display clear, multilingual, and accessible notices explaining data usage, integrated directly into digital systems and consent forms used for admission, procedures, and outpatient treatment, meaning cloud-based patient intake and scheduling software needs to support this notice functionality natively rather than as an afterthought. Consent itself must be specific, revocable, and processed through interoperable platforms maintained by board-registered consent managers, a requirement that directly affects how a clinic’s cloud software needs to be configured to capture, track, and honour patient consent withdrawal requests.
On data retention, the framework generally requires erasure of personal data once its medical purpose has been fulfilled, unless legal retention requirements apply, such as medico-legal necessity, insurance requirements, or regulator mandates, while separately requiring logs and certain traffic data to be maintained for a minimum of one year. Clinics need to confirm their cloud vendor’s system architecture actually supports selective, purpose-based erasure, since many practice management platforms were not originally built with this granular deletion capability in mind.
The Penalty Exposure Makes This a Board-Level Issue
Penalties under the DPDP framework can reach up to Rs 250 crore for serious contraventions, a figure substantial enough that cloud vendor selection and contract review is no longer purely an IT department decision but a genuine governance and financial risk matter for clinic and hospital leadership. Given the phased compliance timeline, with consent manager frameworks becoming mandatory around November 2026 and full compliance expected by May 2027, clinics still running on legacy cloud contracts predating DPDP have a defined window to renegotiate terms, but that window is not indefinite.
Practically, clinics evaluating a new cloud-based clinic management system, or renewing an existing vendor relationship, should request explicit written confirmation of the vendor’s DPDP-compliant security safeguards, data localisation practices where applicable, breach notification commitments, and support for consent management and selective data erasure, treating these as non-negotiable contract terms rather than optional add-ons.
Conclusion
DPDP Rules 2025 have made cloud vendor accountability a direct extension of a clinic’s own compliance obligation, not a separate concern the vendor manages independently. Clinics that treat their cloud software contracts as a compliance document requiring active review, rather than a settled IT purchasing decision from years past, are the ones genuinely prepared for the enforcement phase now underway.
Researched Resources
2. Healthcare Data Compliance in DPDP Act: Complete Guide 2026
3. Health Data and the DPDP Act: A Practical Guide
4. Data Privacy Compliance for Healthcare & Healthtech in India
Disclaimer: This article is for general informational and educational purposes and reflects the DPDP Rules 2025 as understood at the time of writing; the phased compliance timeline and enforcement practice continue to evolve. It is not legal advice, and clinics should consult a qualified data protection lawyer to review specific cloud vendor contracts and compliance obligations.
Vivek Chaudhary is a Technical Content Developer specializing in healthcare, health technology, and digital healthcare business solutions. He creates research-driven, SEO-focused content for doctors, clinics, hospitals, healthcare professionals, and patients, covering topics such as healthcare technology, patient engagement, clinic management, digital communication, and online visibility.
