The central misconception
'We're ABDM-compliant, so we're DPDP-compliant.' We hear this in every healthcare engagement. It is not correct.
NDHM and ABDM consent governs data sharing under the ABDM ecosystem. DPDP consent (Section 6) governs your processing of personal data within your facility. They overlap but neither is a substitute for the other.
Where they align
The principles are aligned: granular, purpose-limited, time-bounded consent. ABDM consent expressions (purpose, data categories, expiry) map fairly cleanly onto DPDP consent requirements. Where you've built ABDM consent flows, you're likely 70% of the way to DPDP-compliant flows for the same data.
Where they diverge
Three significant divergences:
- Scope: ABDM covers data shared via ABDM. DPDP covers all personal data you process. A patient's appointment booking data is DPDP scope but not ABDM scope.
- Withdrawal parity: ABDM consent withdrawal is via the ABDM consent manager. DPDP requires withdrawal parity with the channel of giving — your facility must offer it directly.
- Children's data: ABDM has paediatric consent flows. DPDP Section 9 + Rule 10 raises the bar — verifiable parental consent is required, not just parental signature.
The retention puzzle
You face multiple retention drivers:
- Clinical Establishments Act / state rules: 3-5 years post-discharge minimum
- NMC Regulations on Medical Records: 3 years indoor, longer for surgical / oncology
- PCPNDT Act: specific obligations for diagnostic centres
- D&C Rules: Schedule H prescription records
- NABH (where applicable): per accreditation chapter
- DPDP: erasure on request unless statutorily required to retain
The right way to handle this: a single retention schedule (Template 15) that maps each data category to the strictest applicable retention obligation, with the legal source explicitly recorded. Use it as the master reference for DSAR responses.
The HealthTech app variant
If you're a HealthTech app — telemedicine, fitness, mental health — most of the above applies. Plus: most users will be adults but a meaningful minority will be parents using the app on behalf of children. Section 9 applies to that minority. Build the verifiable parental consent flow even if the majority of users won't need it.