DPDP compliance spine
Consent workflow, retention logging aligned to the notified requirements, role-based access, and operationalised patient rights — access, correction, withdrawal, grievance. DPDP’s principal obligations are scheduled for May 2027, with Consent Manager registration provisions activating from November 2026 (not a blanket hospital integration deadline). Section 17(3) leaves room for notified exemptions for certain entity classes, and a hospital retains responsibility for its own data processing regardless of its software vendor. We already hold some of the primitives: consent records, record-access log, e-signatures, retention batches.