Certinal makes DPDP compliance an operating standard for healthcare, not a project - every patient consent captured, signed, purpose-tagged, and audit-ready for the Data Protection Board, NABH surveys, and ABDM.
Under the DPDP Act, health data is sensitive personal data and the penalties are not symbolic. A single leaked record, an unlogged consent, or a missed breach notice can put a hospital in front of the Data Protection Board of India - with fines assessed per instance.
Before the Board asks - who owns DPDP?
01
Name an accountable owner
Significant Data Fiduciaries must appoint an India-based Data Protection Officer who reports directly to the hospital Board.
02
Answer rights in 90 days
Access, correction, and erasure across the EHR, LIS, billing, and every vendor holding a patient's records - captured and evidenced on time.
03
Show your working
Purpose-tagged consent, DPIAs, and independent audit records kept ready as a by-product of everyday care.
Hospital network80%
Reduction in patient check-in wait times, with 100% automated, audit-ready consent logs across 70+ hospitals and 10,000+ beds.
One of Asia's largest healthcare networks
Primary care7,000+
Weekly documents signed directly in Epic, eliminating $210K+ in annual administrative cost across 30+ locations.
Independent primary-care network
Private hospital93%
Of patients sign consent forms digitally, saving 4 hours of staff effort a day for 1.1M+ patients served annually.
Leading Southeast Asia hospital
Compliance, mapped in
Consent management starts with compliance
Enforceable agreements and protected health data, mapped to the Indian laws, healthcare standards, and security certifications regulated enterprises are held to.
Indian law
DPDP Act 2023IT Act 2000ABDM Framework
Audit-ready in step
Standards & security
NABH StandardsISO 27001SOC 2 Type II
Purpose-tagged consent
Every patient consent timestamped, versioned, and exportable as proof on demand.
Section 5 (IT Act) electronic signatures for medical records, prescriptions, and consent forms - admissible in Indian courts.
DPDP Section 6, built in
Purpose-based capture, granular notice, and Data Principal rights for sensitive health data - consent that stands up to the Data Protection Board and NABH surveys.
Enforcement clock · Live
Enforcement·May 13, 2027
The window is closing
Enforcement is months away
The law is not theoretical anymore. The work runs in sequence - map the data, serve fresh notices, then stand up consent and rights.
--Days
--Hrs
--Min
--Sec
May 13, 2027Enforcement deadline
Enforcement May 13, 2027
Today
11 Aug 2023 · Enacted
Now · Transition
May 2027 · Enforcement
11 Aug 2023 · Enacted
DPDP Act passed
The Digital Personal Data Protection Act is enacted by Parliament as India's data protection law for every Data Fiduciary.
Now · Transition
Rules notified
The transition begins - months, not years, to build the consent, rights, and breach workflows the Act expects.
May 2027 · Enforcement
Penalties active
Audits and scrutiny begin, with fines of up to ₹250 crore assessed per instance against the hospital as Data Fiduciary.
The window is closing
From enacted to enforced - and where you stand today
2023of 2023-2027
The law2023
DPDP Act enacted
Passed by Parliament as India's data protection law
Every hospital becomes a Data Fiduciary by definition
The law2025
Rules notified
The transition begins - months, not years
Consent, rights, and breach workflows become expected practice
The transitionNow
Map the data
Every place patient data is captured, shared, or stored
A named purpose against each processing activity
The transition+90d
Serve fresh notice
Itemised notice in the patient's chosen language
Legacy consent re-papered against Section 6
The transition+6mo
Stand up consent and rights
Purpose-tagged capture at intake, admission, and procedure
Access, correction, and erasure routed on a 90-day SLA
The deadline2027
Penalties active
Board audits, NABH surveys, and patient complaints
Up to ₹250 crore assessed per instance against the hospital
How Certinal works
Consent, rights, and proof in one platform
01Capture
Compliant patient consent captured wherever care happens - intake, admission, procedures, and remote care.
Purpose-tagged capture
Clear, purpose-specific notices and granular consent across web, mobile, and offline touchpoints - timestamped and withdrawable.
Live from day one
The Certinal consent platform is typically deployed in around 7 days, so compliant capture starts almost immediately.
93%Sign digitally
7 daysTo go live
100%Audit-ready
Every corner of care
From large hospital networks to diagnostics and telehealth, Certinal captures compliant consent across every setting.
Providers
Hospitals & systems
Clinics & practices
Diagnostics & labs
Digital & partners
Telemedicine
Pharma & trials
Insurance & TPAs
02Serve rights
Access, correction, and erasure requests captured in one place and routed with SLA tracking across every system.
When the Board, a NABH surveyor, or the Data Protection Board asks, the evidence is on hand - not a project to assemble.
Show your working
Independent data audits, DPIAs for high-risk processing, and purpose-tagged consent - versioned where the processing happens.
CaptureTimestampVersionExportAudit
Patient-consent records structured so external auditors can verify without archaeology.
₹250cr max fine90-day rights SLA7-day go-liveSection 5 valid1.1M+ patients
Connects to your stack
Live
Trigger consent and signing from your EHR, HIS, or patient portal, then get every signed record synced straight back.
RESTAPIs & SDKs
FreeAPI on every plan
7,000+Weekly docs in Epic
Free API access: embed consent capture into any clinical workflow, on every plan.
Every patient consent captured, signed, purpose-tagged, and audit-ready - for the Data Protection Board, NABH surveys, and ABDM.
System of record · Live now
Consent, end to end
One system of record
Certinal keeps every patient consent, rights request, and audit artefact in one place - so compliance is a by-product of everyday care, not a scramble before an audit.
Purpose-tagged consentEvery consent timestamped, versioned, and exportable as proof.
Data Principal rightsAccess, correction, and erasure captured in one intake with SLA tracking.
Automated routingRequests fan out across the EHR, HIS, labs, and vendors that hold the data.
DPIAs & auditsImpact assessments and independent audit records, versioned where processing happens.
Breach workflowsNotifications and evidence kept ready for the Data Protection Board.
Proof
Outcomes across healthcare
Hospitals
80%Shorter check-in waits
100%Audit-ready logs
70+Hospitals live
Patient intake, admission, and procedure consent captured digitally with the audit trails regulated care demands.
Primary care
7,000+Weekly docs in Epic
$210K+Annual cost removed
Signed directly inside the systems clinicians already use, across 30+ locations.
Private hospital
93%Sign digitally
4 hrsSaved every day
Consent for 1.1M+ patients a year, digital, purpose-tagged, and defensible.
Diagnostics & labs
AnyDevice signing
100%Purpose-tagged
Test authorizations, sample-collection consent, and report release, signed anywhere.
Certinal healthcare customers, 2026 · results vary by deployment and workflow.
Scale
Consent at the scale healthcare runs on
70+
Hospitals on a single network
10000+
Beds served across facilities
1M+
Patients served annually
7000+
Weekly documents signed in Epic
93%
Patients signing digitally
7 days
Typical time to go live
Recognition & certifications
Analyst-recognized. Compliance-certified.
Named a Leader in the IDC MarketScape for Worldwide eSignature Software
Featured in the Gartner Market Guide for Electronic Signature
Recognized in Gartner Peer Insights Voice of the Customer
Rated by verified enterprise reviewers on Gartner Peer Insights
Consent built for DPDP Section 6 and sensitive health data
Electronic signatures admissible in Indian courts
Consent documentation aligned with NABH patient-rights standards
Consent for ABHA-linked records and Health Information Exchange
