Building healthcare software in India: DPDP Act, ABDM and security basics

Why this matters now

Healthcare software holds the most sensitive data a business can collect. In India, three sets of rules shape how clinic and hospital systems, telemedicine platforms and patient apps should be built: the Digital Personal Data Protection Act, 2023 and its Rules, the Ayushman Bharat Digital Mission (ABDM) framework, and CERT-In's cyber-security directions.

This article is a builder's summary to help you plan a project. It is not legal advice; confirm the specifics for your organisation with your legal and compliance advisers.

The DPDP Act, 2023: what the timeline means for your build

The DPDP Rules were notified in November 2025 and phase in over 18 months. The Data Protection Board was established immediately; registration of consent managers applies from November 2026; and the main obligations, including notice and consent, security safeguards, breach reporting and the rights of data principals, apply from May 2027.

For software you commission today, that means the system you launch will be live when the obligations bite. Build for them now:

• Clear notices and consent capture, with a record of what each patient agreed to and when.
• Access limited by role, and an audit trail of who viewed or changed a record.
• Retention rules: the Rules require certain logs of processing to be kept for at least one year, and data you no longer need should be erased on a defined schedule.
• A breach process that can notify affected people and the Data Protection Board.

ABDM: what M1, M2 and M3 mean

ABDM connects health software through ABHA health IDs and consent-based record sharing. The National Health Authority certifies software in milestones after testing in the ABDM sandbox:

• M1, ABHA and identity: create and verify ABHA numbers, and accept Scan and Share at registration.
• M2, Health Information Provider: link care contexts and share encrypted, FHIR-formatted records when the patient consents.
• M3, Health Information User: request consent, fetch records from other providers, and purge them when consent is revoked or expires.
• Claims through the National Health Claims Exchange are a separate track, often called M4.

CERT-In: incident reporting and logs

CERT-In's directions of 28 April 2022 apply to service providers, data centres, body corporates and government organisations. Two requirements shape every build: specified cyber incidents must be reported within 6 hours of noticing them, and logs of all ICT systems must be kept securely for a rolling 180 days within Indian jurisdiction. Systems also need their clocks synchronised to NIC or NPL time servers, or sources traceable to them, so logs line up.

A practical checklist for your project

• Map the personal data the system will hold, why, and for how long.
• Decide early whether you need ABDM integration, and which milestones.
• Specify roles and permissions before screens are designed.
• Log access and changes, keep logs for at least 180 days in India, and alert on suspicious activity.
• Encrypt data in transit and at rest; keep backups and test restoring them.
• Write down the incident process: who notices, who decides, who reports, within what time.
• Plan how patients can see, correct and withdraw consent for their data.