DPDP Act, 2023

The Digital Personal Data Protection (DPDP) Act, 2023 is India's law governing how organisations — called data fiduciaries — collect, use, store and share individuals' personal data. It gives people rights over their own data and places obligations on the organisations that process it, such as purpose limitation, reasonable security safeguards, and notifying affected people and the authorities of a data breach when one occurs.

Why it matters in a hospital

A hospital that registers patients, stores sensitive identifiers and contact details, and shares records with labs, referring doctors or a patient's own family is handling exactly the kind of sensitive personal data the Act is concerned with, day in and day out. Being able to show what data is held, on what basis a patient consented to sharing it, and who can access it is fast becoming a real operational expectation for a hospital, not just a legal formality to file away. Because obligations under the Act apply regardless of hospital size, a smaller facility handling patient data manually or through disconnected spreadsheets faces the same underlying expectations as a large hospital chain, even without the same in-house compliance resources.

How Trisvio handles it

Trisvio encrypts sensitive identifiers with AES-256-GCM, controls access through configurable role-based permissions per hospital, and keeps an audit log of who changed a record, and who opened key records such as the patient profile, a visit or a report, and when. Default roles are broad; a data-protection-conscious hospital should narrow them at onboarding. Trisvio does not yet offer a dedicated data-subject-request or grievance-handling workflow for formal DPDP requests.