Strategy · outside-in view, September 2026

Hospitals will be asked to prove consent, not collect it

The product layer I would add to a hospital consent platform before DPDP enforcement: evidence that survives an audit, withdrawal that provably stops processing, and a breach response that meets its clocks.

01The answer

The problem

Capture is solved; proof is not

On 13 May 2027 a hospital must show which notice a patient saw, what she chose, that withdrawal reached every processor, and that a breach was reported on time. Most consent today is a signature on a form or a row in a table anyone with access can edit.

The product

Receipts, cascade, clocks

Every consent becomes a signed receipt anyone can verify with a public key. Withdrawal becomes a signed event that notifies each processor and times the acknowledgements. Breaches run four clocks from the moment of awareness.

The bet

Sell to the Group DPO, fund with the CFO

The DPO buys evidence. The CFO funds it because specific consent is also what keeps the right to remind, educate and cross-sell: the same registry measures consent yield.

Every one of these is working in the product, against a fictional hospital, with the simulated parts named on each screen.

02What changes on 13 May 2027

The dated trigger

194 days to 13 May 2027

11 Aug 2023
DPDP Act, 2023 receives assent
Framework law; most duties wait for the Rules.
13 Nov 2025
DPDP Rules, 2025 notified
Board provisions (Rules 1, 2, 17 to 21) in force at once.
13 Nov 2026
Consent Manager registration opens
Rule 4, twelve months after notification.
13 May 2027
Notice, security, breach and rights duties apply
Rules 3 and 5 to 16, eighteen months after notification.

The Rules were notified on 13 November 2025 and phase in over eighteen months. The duties that matter to a hospital's privacy office (notice, security safeguards, breach intimation, the rights of data principals) start on 13 May 2027. Each one becomes a question of evidence:

Sec 5 · Rule 3
Itemised notice for each purpose, with how to withdraw and how to complain
Evidence an auditor asks for
Which notice, which version, in which language the patient saw
In the product
Receipt stores notice id, version, language and the notice hash
Sec 6(1)
Consent that is free, specific, informed and unambiguous
Evidence an auditor asks for
Per-purpose decisions; proof the patient understood high-risk purposes
In the product
Itemised decisions; server-graded teach-back bound to the receipt
Sec 6(4) · 6(6) · 8(7)
Withdrawal as easy as consent; processing stops, processors included
Evidence an auditor asks for
When the patient withdrew, and that each processor was told and acted
In the product
Signed withdrawal event, a notice per processor, an acknowledgement clock
Sec 8(5) · Rule 6
Reasonable security safeguards, including logs
Evidence an auditor asks for
Records that cannot be quietly edited; an audit trail
In the product
Ed25519 receipts re-verified on demand; hash-chained audit trail
Sec 8(6) · Rule 7
Breach intimation to the Board and each affected person
Evidence an auditor asks for
Timestamps for Board, patients, the 72-hour report, and CERT-In
In the product
Four live clocks, rule-set severity, AI-drafted notices for review
Secs 11 to 14 · Rule 14
Rights to access, correct, erase, seek redress and nominate
Evidence an auditor asks for
A request log with response times
In the product
Patient view of all consents with withdrawal; request queue is on the roadmap

Duty	Citation	Evidence an auditor asks for	In the product
Itemised notice for each purpose, with how to withdraw and how to complain	Sec 5 · Rule 3	Which notice, which version, in which language the patient saw	Receipt stores notice id, version, language and the notice hash
Consent that is free, specific, informed and unambiguous	Sec 6(1)	Per-purpose decisions; proof the patient understood high-risk purposes	Itemised decisions; server-graded teach-back bound to the receipt
Withdrawal as easy as consent; processing stops, processors included	Sec 6(4) · 6(6) · 8(7)	When the patient withdrew, and that each processor was told and acted	Signed withdrawal event, a notice per processor, an acknowledgement clock
Reasonable security safeguards, including logs	Sec 8(5) · Rule 6	Records that cannot be quietly edited; an audit trail	Ed25519 receipts re-verified on demand; hash-chained audit trail
Breach intimation to the Board and each affected person	Sec 8(6) · Rule 7	Timestamps for Board, patients, the 72-hour report, and CERT-In	Four live clocks, rule-set severity, AI-drafted notices for review
Rights to access, correct, erase, seek redress and nominate	Secs 11 to 14 · Rule 14	A request log with response times	Patient view of all consents with withdrawal; request queue is on the roadmap

The stakes are set in the Schedule to the Act: up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach, and up to ₹200 crore for failing to notify the Board or affected people of one. CERT-In's separate 6-hour reporting direction for cyber incidents has applied since 2022.

03Where the gap is

Certinal already markets healthcare consent and a DPDP offering to hospitals, so the question is not whether to build consent capture. It is what a Group DPO will ask any vendor to demonstrate once enforcement starts, and whether the product answers it with evidence rather than a feature list. Three capabilities decide that, and from public material alone I cannot tell how far any vendor has built them:

Independently verifiable receipts. Verification with a published public key, bound to the notice version, so an insurer or the Board can check a consent without access to hospital systems.
Withdrawal that provably reaches processors. A signed event, a notice per processor, and acknowledgement times the DPO can show.
A breach command with the real clocks. Board and patients without delay, the 72-hour report, CERT-In in six hours, with drafts in the patient's language.

These sit on top of capture, so they extend an existing consent product rather than compete with it.

04Who buys, who evaluates

Buyer

Group DPO or Chief Risk Officer

Of a 300 to 1,500 bed chain. Needs a readiness number they can defend, an audit pack, and a breach runbook that works at 2 a.m. Sees it in the DPO console.

Evaluators

CIO and CISO

Care about HIS integration, key custody, append-only storage and data residency. See the architecture and the public key endpoint.

Sponsor

CFO and CMO

Fund it when consent yield is visible: opt-in by purpose, a copy test that can say “no difference”, and a chain value model. See consent yield.

05Landscape

Public positioning as of September 2026, from each company's own site.

Certinal (a Zycus company)
E-signature and healthcare consent, with a DPDP offering marketed to hospitals.
The natural owner of this layer: the capture surface and hospital relationships already exist.
Privy by IDfy
A DPDP platform: consent governance, data principal rights, incident management and PII discovery.
Horizontal DPDP coverage; this proposal goes deeper on clinical capture and patient comprehension.
OneTrust
Consent and preference management with consent receipts and propagation of consent signals to downstream systems.
The reference for propagation; this proposal adds hospital identity levels, teach-back and DPDP clocks.
Securiti
Privacy operations and data subject request automation.
Strong on rights operations; this proposal starts at the bedside receipt.
ABDM consent manager (NHA)
The national rail for consent to share health records between providers.
Not a competitor: a receipt format should interoperate with it for record-sharing purposes.

06Product decisions

A receipt per capture, a decision per purpose: One signature covers one notice and one identity check; each purpose inside it is decided separately, the way Rule 3 itemises them. Withdrawal is per purpose and never edits the receipt.
Asymmetric signatures and a published key: Ed25519 with a JWKS endpoint. A shared-secret HMAC cannot be verified by anyone outside the hospital, which defeats the point.
The server signs only what it established: Identity level and comprehension grade arrive as ten-minute, session-bound server tokens. A request that claims “L5, understood” changes nothing.
Friction matched to risk: A checkbox in the booking form for a teleconsult, one screen and an OTP at OPD, a ceremony with teach-back for admission. Same evidence format at every tier.
Rules decide, models assist: Legal duties, clocks and severity are deterministic. Models grade teach-backs and draft notices within a daily spend ceiling, outputs are schema-checked, and the rule result is always shown beside the model's.
Identity without Aadhaar by default: ABHA-linked or mobile OTP, staff witness for assisted patients, passport and liveness for international patients.

07Risks

Aadhaar as a default identity check
Why it matters
Private entities may use Aadhaar authentication only where a law or a central notification permits it (Aadhaar Act s.4(4), after the 2018 Puttaswamy judgment).
Mitigation
Default to ABHA-linked or mobile OTP and staff witness; Aadhaar only where counsel confirms a basis.
Machine-translated notices
Why it matters
A notice a patient cannot understand is not informed consent, and a mistranslation is evidence against the hospital.
Mitigation
Certified translation per notice version; the notice hash makes the approved wording provable. Kannada, Marathi and Bengali next.
A model grading comprehension unevenly across languages
Why it matters
Grading errors would be systematic, not random, and would fall on non-English speakers.
Mitigation
Model grades only; staff confirm; rubric fallback is labelled; per-language grade distributions monitored.
Signing key compromise
Why it matters
Whoever holds the key can mint receipts that verify.
Mitigation
Per-hospital keys in an HSM or KMS, rotation with a key history in the JWKS, and the hash-chained trail as a second witness.
Processors that never acknowledge
Why it matters
Sec 6(6) makes the hospital answerable for its processors stopping.
Mitigation
Contractual acknowledgement windows, escalation at the internal limit, and the readiness score naming the slow processor.
"Without delay" read differently by the Board
Why it matters
The Rules set no hour count for initial intimation to the Board or to patients.
Mitigation
Internal targets set with counsel and shown as policy, never as law; the 72-hour report and CERT-In 6 hours are hard clocks.

Risk	Why it matters	Mitigation
Aadhaar as a default identity check	Private entities may use Aadhaar authentication only where a law or a central notification permits it (Aadhaar Act s.4(4), after the 2018 Puttaswamy judgment).	Default to ABHA-linked or mobile OTP and staff witness; Aadhaar only where counsel confirms a basis.
Machine-translated notices	A notice a patient cannot understand is not informed consent, and a mistranslation is evidence against the hospital.	Certified translation per notice version; the notice hash makes the approved wording provable. Kannada, Marathi and Bengali next.
A model grading comprehension unevenly across languages	Grading errors would be systematic, not random, and would fall on non-English speakers.	Model grades only; staff confirm; rubric fallback is labelled; per-language grade distributions monitored.
Signing key compromise	Whoever holds the key can mint receipts that verify.	Per-hospital keys in an HSM or KMS, rotation with a key history in the JWKS, and the hash-chained trail as a second witness.
Processors that never acknowledge	Sec 6(6) makes the hospital answerable for its processors stopping.	Contractual acknowledgement windows, escalation at the internal limit, and the readiness score naming the slow processor.
"Without delay" read differently by the Board	The Rules set no hour count for initial intimation to the Board or to patients.	Internal targets set with counsel and shown as policy, never as law; the 72-hour report and CERT-In 6 hours are hard clocks.

08Roadmap to enforcement

Now to Dec 2026
- Evidence receipts and public key in production for OPD and teleconsult
- Withdrawal cascade live with two real processors: lab partner and messaging gateway
- FHIR Consent export to one HIS
Jan to Mar 2027
- Consent status write-back on the HIS encounter
- Rights request queue with response clocks (Secs 11 to 14)
- Certified translations for the next three languages
Before 13 May 2027
- Per-hospital keys in KMS, rotation drill
- Guardian consent for children and for adults with a lawful guardian (Sec 9, Rules 10 and 11)
- Breach drill run end to end with counsel, CISO and the Board template
After
- ABDM consent-manager interoperability for record sharing
- Research and trial consent on the same receipt format

Deliberately not in scope before enforcement: a generic privacy suite, cookie consent, and a clinician-facing record viewer.

09Sources and method

Digital Personal Data Protection Rules, 2025 (PIB): phasing, Rule 3 notice, Rule 6 safeguards, Rule 7 breach intimation, Rule 14 rights.
Digital Personal Data Protection Act, 2023: Secs 5, 6, 8, 9, 11 to 14 and the Schedule of penalties.
CERT-In Directions under s.70B(6) of the IT Act, 28 April 2022: 6-hour reporting of specified cyber incidents.
Aadhaar Act, 2016, s.4(4) as amended in 2019, on authentication by requesting entities.
Company positioning from certinal.com, idfy.com/privy and onetrust.com, September 2026.

Legal references are summarised for product design and are not legal advice. The hospital, its patients, processors and incidents in the product are fictional; its figures are synthetic and illustrate the method, not a measured outcome.

Open the product