DPDP Enforcement deadline is approaching - get consent-ready before May 13, 2027
Healthcare Consent & Compliance Platform

Consent & compliance platform built for DPDP Act

Certinal is the consent management platform that makes DPDP compliance an operating standard for healthcare, not a project. Every patient consent captured, signed, purpose-tagged, and audit-ready for the Data Protection Board, NABH surveys, and ABDM.

Book a Demo Explore the platform
Compliant & certified ✓DPDP Act 2023 ✓HIPAA ✓IT Act 2000 ✓NABH ✓ABDM ✓ISO 27001 ✓SOC 2 Type II
Trusted by
Healthcare Organizations
Book your demo
Our customers

Trusted by Healthcare Organizations

Hospital networks, clinics, diagnostics labs, and digital-health providers rely on Certinal to make patient consent digital, purpose-tagged, and audit-ready.

One of Asia’s largest healthcare networks, operating 70+ hospitals and 10,000+ beds.

  • 80% reduction in patient check-in wait times
  • 100% automated, audit-ready consent logs

North Carolina’s largest independent primary care network, with 30+ locations.

  • 7,000+ weekly documents signed directly in Epic
  • $210K+ in annual administrative cost eliminated

One of Southeast Asia’s largest private hospitals, serving 1.1M+ global patients annually.

  • 93% of patients sign consent forms digitally
  • 4 hours of staff effort saved daily
Telekom Malaysia Broadridge Nissan UEM Millicom NESR AAMC Selecta JEA ChainUp Graphic Packaging
Henrik Andersson, Chief Technology Officer at Bumrungrad International Hospital
★★★★★
Certinal’s Consent & Compliance Platform has transformed how we capture and manage consent, so every record is now digital, purpose-tagged, and audit-ready. It’s been a vital step in our commitment to secure, transparent, and compliant operations.
Henrik Andersson Chief Technology Officer, Bumrungrad International Hospital
1.1M+ patients / yr 93% digital consent
10M+Consent records under management
60%Faster rights-request fulfilment
40+Pre-built connectors & SDKs
24/7Immutable audit logging
The cost of getting it wrong

One mishandled patient record can cost up to ₹250 crore

Under the DPDP Act, health data is sensitive personal data, and penalties are not symbolic. A single leaked record, an unlogged consent, or a missed breach notice can put a hospital in front of the Data Protection Board of India, with some of the steepest fines the country has seen, assessed per instance.

  • ✓ Every patient record and consent form is in scope
  • ✓ Levied on the hospital as Data Fiduciary, decided by the Board
  • ✓ Stacked on top of NABH scrutiny and reputational fallout
DPDP Act · Penalty schedule for health data
₹250 CrFailure to safeguard patient records, leading to a health-data breach
₹200 CrFailure to notify a breach to the Board and affected patients
₹200 CrBreach of additional obligations around children’s and minors’ data
₹150 CrNon-fulfilment of Significant Data Fiduciary duties, common for large hospitals
₹50 CrBreach of any other provision of the Act or its Rules
The countdown

The compliance window is already closing

The law is not theoretical anymore. With enforcement expected around May 2027, the runway to operationalise consent and rights is measured in months, not years. And the work runs in sequence: map the data, serve fresh notices, then stand up consent and rights.

Enforcement · May 13, 2027
Done August 11, 2023

DPDP Act enacted by Parliament.

Done November 13, 2025

DPDP Rules notified · transition begins. Months, not years, to build consent, rights & breach workflows.

Deadline May 13, 2027

Enforcement · penalties active, audits & scrutiny begin.

Book a Demo
Accountability

Before the Board asks: who owns DPDP at your hospital?

Your hospital is the Data Fiduciary for every patient record, lab report, and consent form it holds, so when the board asks who owns readiness, “IT, probably” won’t cut it. The Act pushes responsibility up the org chart, with named roles, mandatory audits, and evidence leadership has to stand behind.

1 Ownership

Name an accountable owner

The Act names who answers for compliance, all the way up. Large hospital networks qualifying as Significant Data Fiduciaries must appoint a Data Protection Officer, based in India, reporting directly to the hospital Board.

  • ✓Hospital Board. Ultimately accountable for compliance across every facility and department.
  • ✓Data Protection Officer. Appointed by Significant Data Fiduciaries, answers to the Board.
  • ✓Clinical & admin teams. Execute, evidence, and audit every patient consent, with Certinal as the system of record.
1named, accountable owner
Boardlevel accountability
Hospital Board Ultimately accountable for compliance Data Protection Officer Appointed by SDFs · answers to the Board Clinical & admin teams Execute, evidence, and audit patient consent
2 Rights

Answer every patient rights request in 90 days

Access, correction, and erasure of patient data, across the EHR, LIS, billing, and every vendor holding that patient’s records. Done manually, one request can burn weeks of staff time.

  • ✓One intake for every right. Patient access, correction, and erasure requests captured in a single place.
  • ✓Automated routing. Requests fan out across the EHR, HIS, labs, and vendors that hold the data.
  • ✓SLA tracking. Every request actioned and evidenced within the timelines the Act expects.
90days, tracked automatically
1place to run it all
90d Access request Fulfilled · evidence attached Correction request Synced to 4 systems Erasure request In progress · day 6 of 90
3 Evidence

Show your working

When the Board, a NABH surveyor, or the Data Protection Board asks, leadership needs proof on hand, not a project to assemble it. Certinal keeps the evidence ready as a by-product of everyday care.

  • ✓Independent data audits. Patient-consent records structured so external auditors can verify without archaeology.
  • ✓DPIAs for high-risk processing. Impact assessments for health-data flows, captured and versioned where the processing happens.
  • ✓Purpose-tagged consent, on demand. Every patient consent timestamped, versioned, and exportable as proof.
Auditready, every day
Proofon demand, not on request
Audit-ready
Talk to Sales
Regulatory Readiness

Consent Management starts
with compliance

Enforceable agreements and protected health data, mapped to the Indian laws,
healthcare standards, and security certifications regulated enterprises are held to.

DPDP Act 2023

Consent Management built for DPDP Section 6 and sensitive health data: purpose-based capture, granular notice, and Data Principal rights.

IT Act 2000

Section 5 compliant electronic signatures for medical records, prescriptions, and consent forms. Admissible in Indian courts.

NABH Standards

Consent documentation aligned with NABH patient-rights, AAC, and FMR standards. Audit-ready for accreditation surveys.

ABDM Framework

Patient consent for ABHA-linked records, Health Information Exchange, and ABDM-compliant data sharing.

ISO 27001

Certified information security controls for health data capture, storage, and exchange. Annual surveillance audits.

SOC 2 Type II

Independently audited controls over how Certinal stores, processes, and transmits patient personal data.

✓DPDP Act 2023 ✓IT Act 2000 ✓NABH ✓ABDM ✓ISO 27001 ✓SOC 2 Type II ✓HIPAA
Across healthcare

Built for every corner of care

From large hospital networks to diagnostics and telehealth, Certinal captures compliant patient consent wherever care happens.

Hospitals & health systems

Patient intake, admission, and procedure consent captured digitally, with the audit trails regulated care demands.

Diagnostics & labs

Test authorizations, sample-collection consent, and report release, signed on any device.

Telemedicine & digital health

Remote consent for teleconsults and app-based care, ABHA-linked and DPDP-ready from day one.

Pharma & clinical trials

21 CFR Part 11-aligned informed consent and investigator sign-off, with audit trails and identity binding.

Health insurance & TPAs

Policy, claims, and disclosure paperwork processed faster, with defensible, audit-ready records.

Clinics & specialty practices

Provider agreements, patient forms, and referrals signed and stored in minutes, across locations.

Integrations

Connects to the healthcare systems you already run

Trigger consent and signing from your EHR, HIS, or patient portal, then get every signed record synced straight back. Free API access on every plan lets your team embed consent capture into any clinical workflow.

YOUR HEALTHCARE STACK BACK IN YOUR SYSTEMS EHR / EMR Hospital Information System (HIS) Patient Portal & App Salesforce Health Cloud Oracle Health Telehealth Platform Certinal DPDP Consent & Compliance Platform Captured, stored & auditable with a full DPDP audit trail
Explore integrations
FAQ

Your DPDP questions, answered

The essentials on the law, timelines, and how Certinal gets you compliant.

What is the DPDP Act and who does it apply to?

The Digital Personal Data Protection Act, 2023 is India’s data protection law. It applies to any organisation (“Data Fiduciary”) that processes the digital personal data of individuals in India, setting rules for consent, data principal rights, breach notification and accountability.

How does Certinal help us capture valid consent?

Our platform lets you present clear, purpose-specific notices and capture granular consent across web, mobile and offline touchpoints. Every consent is timestamped, versioned, and withdrawable, giving you a verifiable, audit-ready record.

Can it integrate with our existing systems?

Yes. Certinal offers REST APIs and SDKs so you can embed consent capture and data-principal rights into your own applications and workflows.

How quickly can we go live?

Fast. The Certinal consent platform is typically deployed in around 7 days, so you can start capturing compliant consent almost immediately.

How does Certinal handle data-principal rights requests?

Access, correction, and erasure requests are captured in one place and routed through automated workflows with SLA tracking, so every request is actioned and evidenced within the timelines the Act expects.

What happens when enforcement begins?

Once enforcement is active, the Data Protection Board of India can investigate complaints and levy penalties of up to ₹250 crore per instance. Building consent, rights, and breach workflows now means you can demonstrate compliance from day one, not scramble afterwards.

Get started

Make DPDP compliance your competitive edge

See how Certinal’s DPDP Consent & Compliance Platform can transform the way your organisation manages consent and privacy.

Book a free demo Explore the platform
✓Deployed in ~7 days ✓Audit-ready consent records ✓Enterprise-grade security