Healthcare & life sciences

Sectors on this page

• Healthcare Providers
• Clinics & Specialty Care
• Diagnostics & Labs
• HealthTech & Digital Health
• Pharma & Life Sciences

A few of the questions the readiness assessment asks

1. Do you process the personal data of anyone under eighteen, or of a person with a disability who has a lawful guardian?
2. If children or persons with disability who have a lawful guardian use your service, do you first get verifiable consent from the parent or guardian, as rules 10 and 11 prescribe?
3. Do encryption, access control, logging and backups cover every system holding personal data, including your vendors'?
4. Could you notify every affected individual, with all five required elements, without delay after discovering a breach?
5. Could you produce, for one individual, everything you hold and everyone you shared it with?
6. Is every vendor that processes personal data on your behalf covered by a current written contract?

From obligation to audit record

1. Statutory obligations become controls with owners, evidence with reviewers, and a record you can put in front of an auditor.
2. The place the compliance work actually happens: a control per obligation, an owner per control, evidence per requirement, and a queue where somebody reviews it.
3. An append-only audit record behind every decision and every piece of evidence

What you record in DPDPNiti

• Health data held against a starter set of data categories, with unknowns shown as unknown rather than guessed
• The Section 9 obligations for children surfaced by the assessment, with their controls and owners
• Clinical and administrative purposes registered separately, not blurred into one
• Rights requests and incidents, each on its own lifecycle, with every transition attributable

Frameworks carried beside the Act

• CERT-In Directions on cyber incident reporting: carried for every organisation

On the roadmap

• Age assuranceComing
• Advanced consentComing
• Breach notices to affected peopleComing