The DPDP Act and your radiology data

Most imaging centres hold more personal data than they realise: front-desk details, clinical history, DICOM headers carrying the patient's name, reports, and copies on CDs, email and WhatsApp. Until now the main legal rules were the IT Act's 2011 rules on sensitive personal data, which already cover medical records, and NABH standards for accredited centres; in day-to-day practice, protection often came down to good habits. The Digital Personal Data Protection Act, 2023 changes that, because it applies to all of this data when it is held in digital form, and it puts the responsibility squarely on the centre rather than on its software vendors.

The questions we hear from centre owners are practical ones. Who is responsible when the PACS vendor has a breach? Can we still send images on WhatsApp? Do the new Rules apply yet? So, let's go over where things stand, what the Act and Rules actually say for a radiology centre, and what to do now.

Where things stand (August 2026)

MeitY notified the Digital Personal Data Protection Rules, 2025 as G.S.R. 846(E) on 13 November 2025. The PIB summary describes an eighteen-month phased rollout. Rule 1 sets the phases:

In August 2026 the government told Parliament again that the Act and Rules provide for phased implementation over an eighteen-month transition period. Earlier in 2026, MeitY had consulted industry on shortening the window to twelve months. Check with your counsel whether any amendment has been notified since this was written.

So most of the obligations below are not yet enforceable. But changing consent forms, vendor contracts and staff habits across several centres takes longer than people expect, which is why we suggest starting now rather than in the spring of 2027.

Who is responsible, and on what basis

First, a few words about the two roles the Act defines. A Data Fiduciary is whoever decides the purpose and means of processing (section 2(i)); for patient data, that is usually your centre or hospital. A Data Processor processes data on the fiduciary's behalf (section 2(k)). Your cloud PACS vendor, RIS provider, SMS gateway and backup provider are typically processors.

The important line is section 8(1): the fiduciary stays responsible for compliance "irrespective of any agreement to the contrary", including for processing done by its processor. Section 8(2) says you may engage a processor only under a valid contract. In practice, if your PACS vendor has a breach, the responsibility under the Act still sits with you. Your contract with the vendor is where you protect yourself.

Processing also needs a legal basis: either the patient's consent or one of the "certain legitimate uses" in section 7 (section 4). Under the Act, consent must be "free, specific, informed, unconditional and unambiguous" (section 6(1)) and must come with a notice (section 5). Rule 3 says the notice must stand on its own, in clear and plain language, with an itemised list of the data collected, the specific purpose, and an easy way to withdraw consent and to complain to the Board.

Section 7 includes processing where the person has voluntarily provided data for a specified purpose and has not objected (7(a)), and processing to respond to a medical emergency (7(f)). How far your routine work can rest on these, and where you need explicit consent, is a question for your counsel. What is clear is that purposes beyond the scan itself, such as using images to build an AI dataset, teaching files or marketing messages, need to be thought through separately. For a research archive, section 17(2)(b) gives a limited exemption for research and statistical processing that is not used to take decisions about the individual, subject to standards the government prescribes. If you do build a dataset, remember that patient identity sits in the DICOM header as well as on the report; our post on DICOM headers and AI routing shows how much is in there.

What the Rules expect day to day

Four parts of the Act and Rules touch daily operations in a radiology centre.

Security safeguards. Section 8(5) requires reasonable security safeguards to prevent a breach. Rule 6 lists the minimum, and it reads like a PACS checklist:

• encryption, masking or tokenisation of personal data;
• access control on systems that hold it;
• logs and monitoring of who accessed what;
• backups and measures to keep processing going after an incident;
• detecting and investigating unauthorised access, and keeping logs for one year unless another law needs longer;
• security clauses in your contract with each processor.

Shared logins, a PACS port left open to the internet without access controls, and studies on a personal pen drive all fail this test.

Breach notification. If there is a personal data breach, section 8(6) requires you to tell both the Board and every affected patient. Under Rule 7, you inform affected individuals without delay, in plain language, with what happened, the likely consequences, what you are doing and whom to contact. You also inform the Board without delay, and within 72 hours give it a fuller report on causes, mitigation and the people notified, unless the Board allows longer. Decide now who makes the call, who talks to the vendor and who drafts the patient message.

Retention and erasure. Section 8(7) says personal data must be erased once the purpose is served or consent is withdrawn, unless another law requires you to keep it. Rule 8 adds a 48-hour notice to the person before erasure in the cases it covers, and requires the personal data, the associated traffic data and the processing logs to be retained for at least one year for the purposes it lists, even where the purpose has otherwise been served. Radiology has its own retention rules that sit alongside this. For example, the PC-PNDT Act requires the records it prescribes, such as Form F for prenatal ultrasound, to be preserved for two years, or until any related legal proceedings are finally disposed of. Most centres also keep images longer for priors and medico-legal reasons. Write a retention schedule by data type, agree it with your counsel, and make sure your PACS can actually apply it.

Children's data. Under the Act, anyone under 18 is a child (section 2(f)). Section 9 requires verifiable parental consent and bans tracking and targeted advertising aimed at children. Rule 12 and the Fourth Schedule exempt clinical establishments and healthcare professionals from the consent and tracking provisions to the extent processing is necessary to protect the child's health. That covers the scan, not obviously a research dataset.

WhatsApp, teleradiology and cross-border transfer

WhatsApp. Sending JPEGs of a CT to a referring doctor's personal WhatsApp leaves copies on phones you do not control, often backed up to personal cloud accounts. That is hard to square with access control, logging and erasure under Rule 6 and section 8(7). A secure, time-limited link to a viewer that logs access is a much easier position to defend (see what a zero-footprint viewer is for what such a viewer should and should not leave on the device).

Teleradiology. When an outside teleradiology provider reads your studies, it processes your patients' data. Your contract should cover what they receive, how it is secured and stored, and how fast they will report a breach so you can meet your own 72-hour duty. Whether a reporting radiologist is your processor or a fiduciary in their own right can depend on the arrangement; ask your counsel. Dr. Vishwanath's post on why teleradiology in India is structurally broken makes the wider case for knowing exactly who reads your studies and from where.

Cross-border. The Act does not ban transfers abroad. Section 16 lets the government restrict transfers to countries it notifies, and Rule 15 lets it set conditions on transfers. If any reads or storage happen outside India, name the countries and the provider in the contract, and keep an eye on any notification. Our guide to cloud PACS or on-premise covers storage regions from the infrastructure side.

Penalties, and a checklist for your centre

The Schedule to the Act sets maximum penalties, decided by the Data Protection Board:

These are ceilings. The Act asks the Board to consider factors such as the nature and duration of the breach and the steps taken to mitigate it (section 33(2)).

With that in mind, here is the list we would work through at a centre, roughly in this order:

1. Map your data: where it is collected, stored, sent and copied, including CDs, email and WhatsApp.

2. List every purpose, and update registration forms and notices to match.

3. Sign a data processing agreement with each processor: PACS, RIS, cloud, SMS, backup and teleradiology.

4. End shared logins. Give every user their own account and keep access logs for at least a year.

5. Encrypt data in storage and in transit, and close any PACS port that is open to the internet without a VPN or equivalent access control.

6. Replace image forwarding over WhatsApp with secure links.

7. Write and rehearse a breach plan with every clock in it: the six-hour CERT-In report for the incidents its directions cover, the DPDP notice to the Board and affected patients without delay, and the detailed report to the Board within 72 hours.

8. Agree a retention schedule with counsel and configure your systems to follow it.

9. Name a person patients can contact about their data, and publish the contact.

10. Train front-desk and technologist staff.

The practical upshot is that the months before May 2027 are best spent on the first four items of the list, because they take the longest and everything else depends on them.

Related reading

• Cloud PACS or on-premise — storage regions, backups and what to put in the vendor contract.
• What is a zero-footprint DICOM viewer — keeping patient data off the device.
• Running a diagnostic chain on one system — one set of logins and logs across centres.

FAQ

Does the DPDP Act apply to imaging centres and hospitals?

Yes. It applies to digital personal data processed in India, and patient data held by centres and hospitals is personal data. Most of the substantive obligations under the DPDP Rules apply from around May 2027, eighteen months after the Rules were notified in November 2025.

Is my PACS vendor responsible if it has a data breach?

Under section 8(1) the centre, as Data Fiduciary, remains responsible even when a processor handles the data. Your vendor contract should set out its security duties and how fast it must report a breach to you.

What are the penalties under the DPDP Act?

The Schedule sets maximums of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for failing to notify a breach or for breaching children's data obligations, up to ₹150 crore for a Significant Data Fiduciary's additional obligations, and up to ₹50 crore for other violations.

Can we store radiology images on a cloud server outside India?

The Act does not prohibit it in general. The government may restrict transfers to notified countries and set conditions under Rule 15. Check current notifications and take advice from your counsel before storing data abroad.