What is DPDP notice and consent?

Under India’s DPDP Act, a notice tells a person what personal data is collected, why, and how to withdraw consent or complain. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give.

Why it matters for hospitals

Marketing consent is where hospitals most often fall short: pre-ticked boxes, bundled consent for treatment and marketing, and no way to opt out on WhatsApp. These patterns create regulatory risk and erode patient trust.

How to put it into practice

  • Separate consent for care communication from consent for marketing.
  • Show the notice at the point of collection in plain language, and in the patient’s language where possible.
  • Record who consented, when, to what, and through which channel.
  • Offer a one-step opt-out in every marketing message.

The common mistake

Treating consent as a one-time checkbox. Consent is specific to purpose; a new use of the data needs fresh consent.

An illustrative example

A hospital’s health-check campaign sends offers only to patients with a valid marketing consent record, and every message ends with a reply-STOP option logged in the CRM. (Composite example, not a specific hospital.)

Further reading

Part of the healthcare growth and digital glossary. Last reviewed 3 October 2026.

Free download

Get the Hospital Digital Growth Audit

A 25-point self-assessment across AI operations, growth & CRM, launches, leadership, and PR. Confirm your email and it arrives in your inbox, along with the full Tools & Checklists set. Occasional notes after; unsubscribe anytime.