Can Patients Ask Hospitals to Correct or Delete Their Medical Data Under the DPDP Act? (2026 Guide)
A patient visits a hospital, undergoes treatment, and later discovers their medical record contains an incorrect diagnosis, an outdated address, or information that doesn't belong to them. Another patient wants an old digital record deleted because they are concerned about how their personal information is being stored or shared. These situations raise an important question: Can a patient ask a hospital to correct or delete their medical data under Indian law?
The answer depends on the nature of the information, the reason for the request, the applicable legal framework and the stage at which the relevant provisions have come into force. India's Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a statutory framework for protecting digital personal data. Section 12 specifically addresses the right to correction, completion, updating and erasure of personal data. However, as of October 2026, Section 12 has not yet commenced. The Government's notification dated 13 November 2025 schedules its commencement for 13 May 2027.
This distinction matters for patients and healthcare institutions alike. Hospitals should understand the direction of the new legal framework, while patients should avoid assuming that every medical record can already be deleted on demand under Section 12. This guide explains the legal position, the distinction between correcting and deleting medical records, the responsibilities hospitals should prepare for and the practical steps patients can consider when they find an error in their records.
Why Is Medical Data Protection Important in Healthcare?
Medical information is among the most personal information an individual shares with an institution. A hospital record may contain a patient's name, contact details, medical history, prescriptions, laboratory reports, diagnostic findings, treatment plans, insurance information and details of previous consultations. When this information is inaccurate, incomplete or disclosed inappropriately, the consequences can extend beyond administrative inconvenience. An incorrect allergy entry, for example, could affect a clinical decision. An inaccurate diagnosis could create confusion during a future consultation. Unnecessary disclosure of reproductive-health information or another sensitive medical detail could affect a person's privacy and dignity. Appropriate healthcare governance and medico-legal guidance can help institutions assess their responsibilities and strengthen their compliance processes.
Healthcare institutions therefore need processes that address both the accuracy of medical information and its appropriate use. These processes should allow errors to be reviewed and corrected without compromising the integrity of the medical record. At the same time, maintaining accurate records is not simply a data-protection exercise. Hospitals may need to retain records for continuity of care, clinical accountability, regulatory requirements, insurance matters or legal proceedings. The challenge is to protect the patient's rights while ensuring that the medical record remains reliable and that applicable retention obligations are respected.
What Does the DPDP Act Say About Correcting or Erasing Personal Data?
Section 12 of the DPDP Act, 2023, deals with the right to correction, completion, updating and erasure of personal data. The Act uses the term Data Principal for the individual to whom personal data relates. In a hospital setting, this will ordinarily include the patient whose digital personal data is being processed. The provision is intended to give individuals a formal mechanism to seek changes to personal data held by an organisation, subject to the conditions laid down by the Act. For a hospital, this could become relevant when a patient identifies incorrect personal details, requests an update to information that has changed or seeks erasure of personal data that is no longer necessary for the purpose for which it was processed, where the legal conditions for erasure are met.
However, Section 12 should not be interpreted as a blanket right to rewrite clinical history or remove every medical document from a hospital's systems. The applicable law, the purpose of processing and any legal obligation to retain the information must be considered. It is equally important to distinguish a statutory right from a general compliance recommendation. Although Section 12 is part of the enacted Act, its scheduled commencement means that patients and hospitals should not treat it as an operative statutory entitlement as of October 2026.
Can a Patient Ask a Hospital to Correct an Incorrect Medical Record?
Consider a patient whose hospital record contains an incorrect date of birth, an outdated address or a spelling error in their name. Such mistakes can create problems when the patient seeks a follow-up consultation, submits an insurance claim or requests copies of their records. A patient can approach the hospital's records department or designated administrative contact and request a review of the error. The patient should explain what is incorrect and provide appropriate supporting documents where necessary.
For example, an incorrect name may be supported by identification documents, while an incorrect date of birth may be supported by a relevant official record. A request concerning a clinical entry may require a different review process from a request involving basic demographic information. Clinical information requires particular care. If a patient disagrees with a diagnosis or believes that a treatment note is inaccurate, the hospital may need to review the underlying clinical documentation rather than simply replace the entry at the patient's request.
A patient's disagreement with a medical opinion does not automatically establish that the opinion is factually incorrect. Equally, a hospital should have a reasonable process for examining credible concerns about errors in a record. As a sound records-management practice, hospitals should preserve the integrity of the original documentation and maintain an appropriate audit trail when amendments are made. The precise legal duties applicable to a particular request depend on the circumstances and the law in force.
Can Patients Ask Hospitals to Delete Their Medical Records?
This is a more complicated question than correcting an incorrect address or updating contact details. A patient may want a hospital to delete old medical records because treatment has ended, they have changed healthcare providers or they no longer wish their information to be stored digitally. However, the fact that a patient requests deletion does not, by itself, establish that the hospital must remove the records.
Medical records may serve important purposes beyond an individual treatment appointment. They may be relevant to continuing care, clinical history, applicable regulatory requirements, insurance matters, audits or pending legal disputes. A hospital may also have obligations under other applicable laws, professional standards or record-retention requirements. Under Section 12 of the DPDP Act, the right to erasure is subject to the conditions provided by the Act, including circumstances in which retention is necessary for compliance with law. The provision must be read in its entirety rather than interpreted as requiring automatic deletion whenever an individual asks.
For hospitals, the practical lesson is that deletion requests need a documented review process. The institution should identify the records concerned, determine the purpose for which they are held, consider the applicable retention requirements and communicate its decision appropriately. For patients, it is useful to specify whether the concern relates to an inaccurate entry, unnecessary information, unauthorised disclosure or a request to remove an entire medical history. These are different issues and may require different legal or administrative responses.
What Is the Difference Between Correcting and Deleting Medical Data?
Correction and erasure address different problems, and treating them as interchangeable can create confusion. Correction is generally concerned with making information accurate. If a patient's address has changed, a demographic entry contains an error or a record has been incorrectly linked to the wrong individual, the issue may be resolved by reviewing and updating the relevant information.
Erasure concerns removing personal data where the applicable legal conditions permit it. A request to erase an entire treatment record therefore requires a different assessment from a request to correct a spelling mistake. Completion and updating are also relevant. A hospital may need to add missing information or update an existing entry without deleting the underlying record. For example, if a patient's medical file contains an incorrect contact number, an appropriate correction may be sufficient. If a patient believes that a clinical entry is inaccurate, the hospital may need to review the entry and document the outcome. If the patient seeks deletion of an entire file, the hospital must additionally consider the purpose of retaining that information and any applicable legal obligations. For healthcare institutions preparing for the DPDP framework, distinguishing these request types is an important part of building a workable patient-data governance process.
What Is the Legal Position as of October 2026?
The commencement timeline is particularly important for this topic. The DPDP Act was enacted in 2023, and the Digital Personal Data Protection Rules, 2025, were notified in November 2025. However, the Government adopted a phased commencement approach rather than bringing every provision into force on the same date.
Under the commencement notification dated 13 November 2025, Section 12 is scheduled to commence 18 months after publication, on 13 May 2027. Accordingly, as of 15 October 2026, the statutory right to correction and erasure under Section 12 is not yet operative. This does not mean that patients have no options when a medical record is wrong or their privacy is affected. Hospitals may have existing responsibilities under other applicable laws, professional standards, contractual arrangements and institutional policies. The appropriate route depends on the facts of the case and the nature of the complaint.
It also does not mean that hospitals should postpone all preparation until May 2027. Reviewing record-management practices, identifying responsible personnel and developing clear procedures for patient requests can help institutions prepare for the scheduled commencement of the relevant DPDP provisions. Healthcare organisations should monitor official notifications for any subsequent changes to the commencement timeline.
What Should Patients Do If They Find an Error in Their Medical Records?
A patient who discovers an error should begin by identifying the exact record and the information that appears incorrect. A general complaint that the medical file is wrong may be harder to resolve than a specific request identifying the entry, the reason it is disputed and the supporting evidence. The patient can contact the hospital's medical records department, patient-relations team or other designated administrative contact. The request should explain whether the patient is seeking correction, an update, clarification or deletion and should include relevant supporting documents where appropriate.
It is advisable to keep a copy of the request and any acknowledgement received. If the hospital declines the request or does not provide a satisfactory explanation, the patient can ask for the decision and the applicable policy or legal basis in writing. Where the concern involves a serious clinical error, unauthorised disclosure or another potential legal issue, the appropriate escalation route will depend on the nature of the problem. A routine demographic correction, a dispute about a clinical diagnosis and a privacy complaint should not automatically be treated as the same kind of matter. Patients should also avoid sending unnecessary medical documents or sensitive information to unverified email addresses or informal contacts. Requests should be directed through channels that the hospital identifies as appropriate.
What Should Hospitals Do to Prepare for DPDP Compliance?
Hospitals handle personal data through multiple systems, including registration desks, electronic health records, diagnostic platforms, billing software, insurance workflows and outsourced service providers. A request involving one record may therefore require coordination between several departments. A practical preparation exercise begins with understanding where patient information is stored, who can access it and which teams are responsible for responding to requests. Hospitals should review their existing policies to determine how correction requests are received, how clinical disagreements are escalated and how decisions are documented.
They should also distinguish between information that can be corrected through a routine administrative process and clinical entries that require review by an authorised professional. Requests to erase records should be assessed against the applicable retention obligations rather than accepted or rejected automatically. Staff training is another important consideration. Front-desk personnel, medical records teams, clinicians, IT administrators and compliance officers may all encounter patient-data requests, but their responsibilities will differ. Clear internal escalation procedures can help prevent inconsistent responses.
Hospitals should also review the role of vendors that host or process patient data. Contractual arrangements and access controls should be examined so that the institution can understand how requests may need to be handled across its technology and service-provider environment. These measures are practical governance recommendations, not a claim that every specific procedure is already mandated by Section 12 in October 2026. The legal obligations in force at the relevant time must be assessed separately from preparation for future commencement.
Why Is a Clear Medical Data Request Policy Important?
A well-designed policy helps patients understand where to submit requests, what information they need to provide and how the hospital will review the matter. It can also help the hospital maintain consistency. Without a clear process, one department might amend a demographic field while another might alter a clinical record without appropriate review. Similarly, deletion requests may be handled inconsistently if staff do not understand the difference between privacy rights and record-retention obligations.
A structured policy should identify the responsible contact, establish an appropriate review and escalation process, protect the confidentiality of the request and document the outcome. It should also make clear that the treatment of a request depends on the applicable law and the type of record involved. For hospital management, this is not merely an administrative exercise. Accurate records, controlled access and transparent communication contribute to patient trust and institutional accountability.
Conclusion
The ability to correct inaccurate personal information and seek erasure where legally permitted is an important part of data protection. In healthcare, however, these rights must operate alongside the need to maintain reliable medical records and comply with applicable retention obligations. Section 12 of India's DPDP Act, 2023, addresses correction, completion, updating and erasure of personal data. Its scheduled commencement is 13 May 2027, meaning that as of October 2026, it should not be presented as an already enforceable statutory right. Patients may nevertheless have other legal or administrative routes depending on the circumstances. Hospitals can use this period to review their records-management policies, establish clear procedures for patient requests and prepare staff for the evolving data-protection framework. A transparent approach can help protect patient privacy while maintaining the accuracy and reliability of clinical documentation.
How Lexcuriam Can Help
Lexcuriam LLP advises healthcare institutions on regulatory compliance, healthcare governance, patient-data protection and medico-legal risk. Our work focuses on helping institutions understand their legal obligations, review their policies and develop practical compliance processes suited to their operations. For hospitals and healthcare organisations preparing for the DPDP framework, obtaining a legal review of patient-data policies and medical-record management practices can help identify issues before they become more difficult to address.