ComplyDP4 mins
OneConsent and PHDCCI Launch DPDP Act Readiness Partnership for Indian Businesses
OneConsent and PHDCCI have formed a partnership to help Indian businesses build compliance tracking systems for the DPDP Act 2023, focusing on automated consent management and auditable records.
Last updated:
What Happened
On October 16, 2026, OneConsent and the PHD Chamber of Commerce and Industry (PHDCCI) announced a partnership to help Indian businesses prepare for the Digital Personal Data Protection Act, 2023. The Tribune India reported that the collaboration launched at the DPDP Readiness Forum at PHD House in New Delhi. Mohit Luthra, Assistant Secretary General at PHDCCI, stated during his welcome address that industries must view data protection as a business priority as India approaches implementation.
OneConsent sponsored the event to present its AI-powered Consent Management Platform. The tool helps organisations manage the consent lifecycle, including collection, tracking, and withdrawal, while creating auditable records.
Does The DPDP Act Apply Here
OneConsent's platform manages consent for processing digital personal data. Section 4(1) of the Act applies to persons processing personal data for a lawful purpose based on consent or certain legitimate uses. HealthTech platforms process high volumes of patient data, triggering these requirements.
The Act covers digital personal data processed within India. It also covers processing outside India connected to offering goods or services to Data Principals in India. Corporate IP or anonymised data falls outside this scope. Health clinics deploying such consent platforms process personal data of patients, making them Data Fiduciaries under the law.
Legal Implications Under DPDP
The Act requires fiduciaries to prove they have valid grounds for processing. Consent is the primary basis for processing, except where Section 7 legitimate uses apply. A consent management platform addresses the requirement to maintain evidence of this consent. The DPDP Rules, 2025 detail how itemised notices must precede consent requests.
Data Fiduciaries must allow Data Principals to withdraw consent as easily as they gave it. Section 15 of the Act imposes duties on Data Principals, such as providing verifiably authentic information when requesting correction or erasure. An auditable record system helps compliance heads prove that patient data collection matches the stated purpose.
Could This Happen To You
Relying on manual spreadsheets to track patient consent leaves a healthtech platform exposed during an audit. If the Data Protection Board of India (DPBI) investigates a grievance, they will demand clear consent artefacts. An auditor will ask to see your Record of Processing Activities (RoPA) and proof that a specific patient opted in to data sharing on a specific date.
Hospital compliance teams require accurate tracking without extreme software complexity, but they face identical regulatory scrutiny to large banks. If a patient withdraws consent, the clinic must stop processing and instruct downstream vendors to delete the data. Without automated tracking, this manual effort consumes hundreds of hours per month and risks regulatory penalties.
What Companies Should Do In The Next 30 Days
1. The Head of Compliance should map current consent flows across all patient intake portals and mobile applications.
2. The IT director needs to evaluate whether existing data systems can capture granular consent artefacts and time-stamped withdrawals.
3. The compliance team must review vendor contracts to ensure third-party processors can accept automated deletion signals.
4. Generate a trial RoPA covering your three largest patient data repositories to test audit readiness.
What To Watch
Exactly 192 days remain until the 13 May 2027 hard deadline. Companies evaluating consent platforms must measure them against the DPDP Rules, 2025. Future DPBI enforcement will clarify the exact format required for electronic consent records.
HealthTech platforms anticipating Significant Data Fiduciary (SDF) status should monitor upcoming guidelines on Data Protection Impact Assessments (DPIAs). You can run a baseline evaluation of your current consent architecture at https://www.complydp.com/audit-preview to determine your readiness gaps.
Sources
Frequently asked questions
Does the DPDP Act apply to patient consent in healthtech platforms?
Yes. The Act covers digital personal data processed within India. Healthtech platforms collecting patient data must obtain valid consent or rely on a legitimate use under Section 4(1) of the Act.
How does a consent management platform help with DPDP compliance?
Platforms capture and store consent artefacts. This allows compliance heads to produce exact records of collection and withdrawal during an audit. The system generates the evidence trail required by the DPDP Rules, 2025.
What happens if a patient withdraws consent under the DPDP Act?
The Data Fiduciary must stop processing the personal data and instruct vendors to erase it. Relying on manual processes to track these withdrawals increases the risk of missed deletions and potential regulatory penalties.
When is the DPDP Act compliance deadline?
Exactly 192 days remain until the 13 May 2027 hard deadline. Companies should evaluate their consent architecture and implement compliant tracking systems well before this date.