DPDP Act for hospital marketers: consent, retargeting, WhatsApp and CRM data

Reviewed on 14 October 2026 by Gaurav Phogat. Rules and figures checked against their original sources on the same date.

The DPDP Act for hospital marketers comes down to one test that every campaign must pass from 14 May 2027: can you show, for this person, on this channel, for this purpose, a consent that was specific, recorded and still active? Seven months is enough time to build that, but only if marketing starts now and treats it as a data project rather than a policy memo.

See every healthcare digital growth guide in one place.

Last updated: 14 October 2026.

I have already written about how the DPDP Act changes hospital marketing and why lazy hospital CRM will not survive it. This piece is the working manual: what to build, channel by channel, in the order a marketing team can actually do it. It is a practitioner’s view, not legal advice, and every hospital should confirm its position with counsel.

Key facts at a glance

Why marketers, not lawyers, carry most of this

Legal will write the privacy policy. It will not redesign the OPD booking form, re-tag the website, rebuild the WhatsApp templates, clean the CRM or rewrite agency contracts. Those sit with marketing, digital and the contact centre, and they are where a hospital’s exposure actually lives.

The Act makes the hospital the data fiduciary. Every agency, CRM vendor, WhatsApp business solution provider and outsourced call centre is a data processor acting for it, and the hospital stays answerable for what they do. In practice that means the head of marketing or digital owns more compliance surface than anyone else in the building.

An illustrative example: a group runs a knee replacement campaign. The agency uploads last year’s orthopaedic OPD list to Meta as a custom audience, the pixel on the knee pain page builds a retargeting pool, and a WhatsApp blast goes to every number in the CRM tagged “ortho”. Under DPDP, each of those three moves needs a lawful basis the hospital can show, and the audience itself reveals a health condition. None of it is fixed by a better privacy policy.

The countdown: what to do before 14 May 2027

Seven months is tight because the work is sequential. You cannot fix retargeting until you know which data is consented, and you cannot know that until the CRM holds consent as a record.

The consent matrix: purpose by channel

The mistake I see most often is one “I agree to be contacted” checkbox covering everything. DPDP consent has to be specific to a purpose, so the cleanest design is a matrix: purposes down one side, channels across the top, each cell a separate yes or no that the patient can change.

Section 7 of the Act lists the legitimate uses that do not need consent, including data a person voluntarily provides for a specified purpose and responses to a medical emergency. Neither stretches to promotion. A hospital that processed data during an emergency admission cannot later use it to sell a health check, and a number given to book one consultation is not a licence to send offers.

Two design rules follow. First, care messages must stay free of promotion, or they lose their footing. Second, the marketing opt-in must never be a condition of registration or treatment, because consent that is a condition of service is not freely given.

Retargeting and audience uploads: the rules I would set

Retargeting is where hospital marketing is most exposed, because the audience itself is health information. A list called “visited the IVF page” or “oncology OPD 2025” tells an ad platform something about a person’s health without that person ever seeing a notice.

These are the rules I would write into the performance marketing playbook:

For the next step, see CRM or CDP for a hospital group: which one you actually need, Running a CRM readiness check before any vendor demo and WhatsApp as a hospital’s front door.

• No condition-based audiences without explicit consent that names the use. That covers pixel pools built on specialty or condition pages and any list segmented by department, diagnosis or procedure.
• Customer list uploads only from consented records, and only where the platform allows them. Hashing does not change the purpose. Pull any upload from the CRM’s consent field, never from an HIS export or an agency spreadsheet.
• Pixels off sensitive pages and booking steps. Audit what fires where. Keep measurement on generic pages and use server-side conversion events that pass no condition data.
• Contextual and search-led targeting first. Search intent, location and content placement work without personal data and are usually stronger for hospitals anyway.
• Nothing aimed at children. Paediatric campaigns target parents with general content, never behavioural audiences of minors.

Ad platforms are already stricter than many hospital teams assume. Google’s personalised advertising policy lists health as a restricted category: health advertisers cannot use their own audience lists such as Customer Match or lookalikes, though Google’s predefined audiences remain available. The privacy-safe remarketing guide goes deeper on alternatives. The honest trade-off is some loss of attribution and a smaller retargeting pool. I would take that trade every time over an audience I cannot defend.

WhatsApp: opt-ins, templates and the 24-hour window

WhatsApp is where most Indian patients actually talk to hospitals, so it is where most consent will be exercised. Three layers of rules apply at once: Meta’s own messaging policy, TRAI’s telecom rules for any SMS fallback, and DPDP on top.

Opt-in. WhatsApp’s business policy already requires an opt-in before a business messages a person. DPDP raises the bar on what that opt-in says. A patient who messaged to ask about OPD timings has started a service conversation; they have not agreed to receive health check offers. Capture the marketing opt-in as an explicit choice, inside the chat or at registration, and write it to the CRM with time, channel and notice version.

Templates. Meta classifies templates as marketing, utility or authentication, and a template that mixes utility and promotional content is treated as marketing. That works in your favour if you let it: keep reminders, reports and discharge instructions as clean utility templates, and put every offer in a separate marketing template that only goes to opted-in numbers.

The service window. Replies inside the 24-hour window after a patient messages you are free, and utility templates sent inside that window are free too. Marketing templates are always charged and cost several times a utility message in India. Compliance and cost point the same way: answer fast, stay in service mode, and send marketing only where consent exists.

Stop must work everywhere. “STOP”, “unsubscribe” or “please don’t message me” in any form is a withdrawal. It should flip the CRM consent field and suppress that number on every WhatsApp number the group runs, not just the one that received the reply. Group hospitals with a number per unit fail this test most often. My WhatsApp consent flow tool has the opt-in and opt-out wording.

CRM data: the consent fields to build

A consent that lives on a paper form, in one messaging tool or in an agency’s sheet cannot be honoured across channels. It has to live in the CRM, as a record with history, and every sending tool has to read it before it sends. This is the minimum field set I would specify:

Two operating rules make the fields useful. One identity per person across units, so a withdrawal at one hospital applies at all of them. And one suppression list that every channel checks in real time, rather than nightly syncs that leave a twelve-hour gap.

The legacy database is the hard part. Years of registration numbers have no marketing consent behind them. Treat that data as care data only, and invite marketing opt-ins during genuine service moments: a reminder, a report delivery, a discharge call. A mass “please consent” blast is itself a promotional message and should go past counsel first.

Leads from agencies, aggregators and camps

Every external source needs evidence of the notice the person saw and the consent they gave, naming your hospital or clearly covering it. If an agency cannot produce it, the lead does not enter the CRM. Health camps should use their own registration form with a separate marketing choice instead of sign-up sheets typed in later. Corporate programmes need a written split of who controls which employee data.

This will cut volume from some sources. It also stops the hospital inheriting someone else’s compliance problem, which is a far bigger cost than a few hundred lost leads.

Vendors: what the contract must say

Every processor contract should cover the purpose of processing, where data is stored, security controls, breach notice to the hospital within hours rather than days, access limits, return and deletion at exit, and a ban on agencies keeping patient lists on their own drives. The hospital has to report a breach to the Data Protection Board and to affected patients, so a vendor who reports late leaves you exposed. My vendor management piece covers how to run this without micromanaging.

A one-page checklist for the head of marketing

• Every form, desk flow and chat entry point shows a purpose-specific notice in the patient’s language.
• Marketing consent is separate, unticked and never a condition of care.
• The CRM holds consent by purpose and channel, with history, and every tool checks it before sending.
• Care and promotional templates are split on WhatsApp and SMS.
• No condition-based audiences or uploads without named consent; pixels removed from sensitive pages.
• Third-party leads enter only with consent evidence.
• Vendor contracts carry data processing terms.
• Withdrawal tested end to end, as a patient, on every channel.

None of this stops a hospital from marketing well. It moves the work towards patients who want to hear from you, through channels you can account for, which is where good hospital marketing belonged anyway. For the consent wording itself, start with the DPDP consent notice template.

Sources and further reading

• DPDP Rules, 2025 (Press Information Bureau): the notified rules and phased commencement.
• WhatsApp Business Messaging Policy: opt-in requirements for business messaging.
• Pricing on the WhatsApp Business Platform (Meta): template categories and per-message billing.
• Google Ads: Restricted targeting in personalised advertising: limits on audience lists for health advertisers.

Questions people ask