DPDP Applicability to Physical Records and Subsequent Digitisation

What happened

OpenPR reports that hospitals, banks, and government offices are upgrading the security of their physical document storage to prevent unauthorised access to patient and citizen files. Entities are adopting access-controlled mobile compactor storage systems from vendors like Myriad Storage System LLP. The manufacturer has completed over 500 installations for clients including ISRO, SBI, and Tata. Medical facilities are treating the physical security of signed patient forms and medical files as an immediate operational priority alongside their digital infrastructure upgrades.

Does the DPDP Act apply here?

Section 3 of the Digital Personal Data Protection Act, 2023 defines the territorial and material scope. The Act applies to digital personal data processed within India where the data is collected in digital form or collected in non-digital form and digitised subsequently. Patient intake forms and physical ID photocopies fall under the Act the moment a clinic or hospital scans them into an electronic health record system. Until that digitisation occurs, the physical files themselves are not technically covered by the Act.

Hospitals digitise almost all paper records eventually. General counsel must ensure that vendor contracts for offsite or onsite physical storage include strict access control clauses. If physical files are compromised before digitisation, the data fiduciary may face patient litigation under general tort law or sector-specific health regulations. The jurisdiction of the DPDP Act over purely offline incidents remains untested, but the transition point creates high risk.

Legal implications under DPDP

Under Section 8(4) of the DPDP Act, a data fiduciary has a duty to implement reasonable security safeguards to prevent personal data breaches. If a physical patient file is scanned into a digital system, the resulting file is subject to this mandate. The DPDP Rules, 2025 establish strict timelines for breach response. If a digital patient record is compromised, the fiduciary must intimate the affected Data Principals without delay and submit a detailed report to the Data Protection Board of India within 72 hours.

Consent is the primary basis for processing, except where Section 7 legitimate uses apply. Patients must receive itemised notices under the Rules, 2025 before their physical data is digitised and stored in third-party systems. General counsel should evaluate whether their physical storage vendors provide sufficient indemnity and limitation of liability coverage in the event that poor physical access controls lead to a downstream digital data breach.

Could this happen to you

Healthtech platforms often integrate with physical clinics that maintain hybrid environments of paper files and digital systems. A physical break-in or unauthorised staff access to a file room at a partner clinic creates immediate legal exposure. If a malicious actor steals physical intake forms and later uploads them online, the Data Protection Board will investigate the data fiduciary.

The regulator will ask for evidence of access logs, vendor indemnity agreements, and physical security policies. If your healthtech company acts as a Significant Data Fiduciary, the Board will expect an independent data auditor report validating both digital firewalls and physical access controls at data entry points. Missing these controls exposes the fiduciary to penalties up to 250 crore rupees.

What companies should do in the next 30 days

General counsel and medical directors should map the digitisation pipeline. The compliance lead needs to document every physical document type that clinic staff eventually scan into the healthtech platform.

The legal department should update vendor contracts. Counsel must renegotiate agreements with physical storage vendors to include specific liability caps and audit rights.

The legal head must test breach workflows by simulating a combined physical and digital breach. The team needs to verify that they can notify the Data Protection Board within the 72-hour window mandated by the Rules, 2025.

Healthcare general counsel can run a rapid self-assessment at freescan.complydp.com to identify gaps in their clinic integration contracts.

What to watch

The Ministry of Electronics and Information Technology will soon finalise the DPDP Rules, 2025. Healthtech platforms should monitor the establishment of the Data Protection Board and its early guidance on hybrid physical and digital environments. Exactly 245 days remain until the DPDP hard compliance deadline of 13 May 2027. Legal teams need to finalise their vendor contract remediation well before this date to ensure defensibility during regulator audits.