MeitY and Nasscom Confirm Firm DPDP Deadline and Automated Processing Rules

What happened

On October 7, Nasscom and the Ministry of Electronics and Information Technology initiated a series of readiness workshops in New Delhi for the Digital Personal Data Protection Act, 2023. The International Association of Privacy Professionals reported that MeitY Secretary S. Krishnan delivered the keynote address to clarify implementation details. The ministry confirmed that the compliance deadline remains firm. Government officials used the sessions to confirm that automated operations fall within the definition of processing personal data. The Act lacks a dedicated right for individuals to demand an explanation of an automated decision or human review.

Does the DPDP Act apply here

The Act applies to digital personal data processed within India under Section 3. Healthtech platforms collect digital data daily, triggering compliance obligations for the enterprise. MeitY statements indicate that automated operations, such as algorithmic claim routing or triage tools, constitute processing under the statute. The regulatory scope covers digital data tied to Data Principals in India. CFOs evaluating vendor consolidation should track that anonymised data and corporate intellectual property remain outside the Act.

Legal implications under DPDP

Consent is the primary basis for processing, except where Section 7 legitimate uses apply. The text of the DPDPA defines processing to include automated decision-making. The law does not grant Data Principals a specific right to demand human review or an explanation of automated decisions. The DPDP Rules, 2025 require itemised notices and verifiable consent records. Healthtech firms relying on automated processing must manage cross-border transfers carefully. Under Section 16, transfers are generally permitted unless the Central Government restricts transfer to notified countries or territories.

Could this happen to you

A firm enforcement deadline accelerates the need for compliance budget provisioning. Healthtech CFOs carry immediate contingent liability if patient data platforms lack verifiable consent trails. Missing the 13 May 2027 cutoff exposes the enterprise to penalty ceilings up to INR 250 crore. An incident involving unmapped data flows will trigger rapid regulatory scrutiny. The Rules, 2025 mandate a detailed breach report to the Data Protection Board within 72 hours. Failure to produce compliance evidence increases audit fees and risks spiking cyber insurance premiums, directly impacting EBITDA.

What companies should do in the next 30 days

1. The CFO should allocate budget for data flow mapping software to evaluate total cost of ownership against penalty exposure.

2. The compliance lead must audit automated healthtech features to verify if data collection matches given consent notices.

3. The finance team should review existing SaaS contracts to consolidate vendors and verify data processing agreements meet the Rules, 2025 standards.

4. The medical director and IT head should document the response workflow to satisfy the 72-hour breach notification requirement.

What to watch

Exactly 202 days remain until the DPDP hard compliance deadline of 13 May 2027. Future Rules phases will detail requirements for Significant Data Fiduciaries. Healthcare enterprises processing high volumes of patient data are prime candidates for SDF designation. Failing to provision for these obligations now will increase compliance costs next year. Evaluate your penalty exposure and current data mapping capability by reviewing the ComplyDP audit preview at https://www.complydp.com/audit-preview today.