DPDP compliance spine
Consent-manager integration, one-year-plus audit logging, role-based access and operationalised patient rights — access, correction, withdrawal, grievance. Obligations start November 2026, full compliance May 2027, no small-entity exemption, and a hospital cannot transfer liability to its software vendor. We already hold the primitives: consent records, record-access log, e-signatures, retention batches.