Blue Copper Technologies, a governance, risk and compliance (GRC) technology company, has published a free DPDP Compliance Partner Checklist for hospitals and non-banking financial companies (NBFCs). The checklist sets out ten questions for leadership teams to ask any law firm, consultant or software vendor before hiring one for India's Digital Personal Data Protection Act, 2023 (the DPDP Act). The complete checklist appears below.

Why the choice of partner matters

The DPDP Act's duties on organisations, and the Data Protection Board of India's powers to inquire and impose penalties, begin on 13 May 2027. Under the Schedule to the Act, penalties reach up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to report a personal data breach.

Under Section 8(1) of the Act, the organisation that decides how personal data is used (the Data Fiduciary) remains responsible for compliance "irrespective of any agreement to the contrary". That responsibility covers everything its vendors do with the data. A contract with a consultant, law firm or software provider does not transfer it. Blue Copper Technologies explains who should own DPDP compliance inside a hospital or NBFC in its article at https://www.linkedin.com/feed/update/urn:li:activity:7523988255189676034

According to Blue Copper Technologies, the answer it most often hears from hospital and NBFC leaders is "IT is handling it" or "our law firm is handling it". The company points out that most DPDP duties are things an organisation must keep doing, not documents it must have. They include answering grievances within a period that cannot exceed 90 days (Rule 14), keeping logs of access to personal data for at least one year (Rule 6), reporting breaches to the Board and affected people without delay (Rule 7), and erasing data when its purpose ends (Section 8(7)).

Blue Copper Technologies sums up the principle behind the checklist in one line: an organisation can outsource the work, but not the responsibility. In the company's words, lawyers write the promise, operations produce the proof, and the Data Protection Board will test the proof. For that reason, the checklist asks every prospective partner what evidence it will leave behind.

The DPDP Compliance Partner Checklist: 10 questions for hospitals and NBFCs

Question 1. Will the partner start by finding all personal data, including data outside the main systems?

A strong answer: data discovery and mapping comes first, with an owner named for every location. In hospitals, the data most often missed sits in scanned reports stored on the scanning machine, pen drives used to move reports between departments, and details taken over the phone and typed in later. In NBFCs, it sits with loan agents, collection agencies, call recordings, partner apps and shared spreadsheets.

A warning sign: the plan starts with a privacy policy.

Question 2. Does the partner cover the whole Act, or mainly notices and consent?

A strong answer: notices and consent, the data inventory, security safeguards, rights requests, breach response, vendors, and retention and erasure.

A warning sign: the work is mostly about consent forms. The largest penalties sit with security safeguards (up to ₹250 crore) and breach reporting (up to ₹200 crore), not consent.

Question 3. What evidence will exist after the engagement ends?
A strong answer: for any sample record, the organisation can show the consent captured with its time, version and channel; a withdrawal applied across every system and vendor; one year of access logs (Rule 6); a request closed within 90 days (Rule 14); and a deletion record.

A warning sign: the deliverable is a report, not a running record.

Question 4. Who inside the organisation will own each duty?

A strong answer: named owners at the front desk, billing, HR, collections, procurement and IT, with oversight from the board.

A warning sign: everything is assigned to IT.

Question 5. How will compliance be kept up as staff, vendors and systems change?

A strong answer: a plan for people drift (leavers' access removed, joiners trained), vendor drift (new partners checked when they are added), system drift (new apps, spreadsheets and messaging groups) and purpose drift (data reused for a new reason).

A warning sign: the only check is a yearly audit, which shows how things stood on the day it was done.

Question 6. How will vendors be managed?

A strong answer: the full vendor life cycle. Know: list every third party that holds or can access personal data. Contract: include Rule 6 safeguards, breach notice within hours, audit rights, approval of sub-contractors and deletion at exit. Watch: review vendors on a schedule and when something changes. Exit: confirm in writing that the vendor has erased the data, as Section 8(7)(b) requires, and revoke access the same day.

A warning sign: vendor risk ends at a signed contract.

Question 7. Will breach response be tested against both clocks?

A strong answer: a drill against the Indian Computer Emergency Response Team's (CERT-In) rule of reporting within six hours of noticing an incident, and against the Board's requirement to report "without delay", with a detailed report within 72 hours.

A warning sign: a breach response plan that has never been tested.

Question 8. Are other regulators covered?

A strong answer: CERT-In requirements for both sectors and, for NBFCs, the Reserve Bank of India's (RBI) outsourcing and digital lending directions, tracked alongside the DPDP Act.

A warning sign: a DPDP-only approach that leaves the organisation running parallel processes.

Question 9. How will the partner work with the organisation's lawyers?

A strong answer: lawyers write the notices, contracts and legal opinions, and the partner turns that advice into tasks and evidence.

A warning sign: if a law firm is the only partner, nobody has been named to make the documents true every day after they are signed.

Question 10. What will the board see every quarter?

A strong answer: a one-page report covering data map status, vendor changes, leavers whose access was removed, requests and complaints, incidents and whether they were reported on time, and records deleted.

A warning sign: the board sees only last year's audit report.

How to use the checklist

According to Blue Copper Technologies, a partner that cannot give clear answers to Questions 1, 3 and 10 is offering paper, not proof. Under Section 33(2) of the Act, the Board must weigh the nature, gravity and duration of a breach, whether it was repeated, and what the organisation did to limit its effects when it decides a penalty. Those questions are answered with records, not policies.

Readiness in both sectors

In EY India's January 2026 survey, only 9.9% of healthcare and life sciences organisations had started DPDP compliance, against 34.7% in financial services. The advisory firm Ankura estimated in May 2026 that DPDP implementation typically takes at least three to four months, and six to eight months for large or complex organisations. In Blue Copper Technologies' experience, data discovery and mapping alone takes about two months for a mid-size hospital or NBFC.

Blue Copper Technologies expects a large volume of complaints once the Act comes into force. Every patient and borrower gains the right to complain, first to the organisation through its grievance process (Section 13(3)) and then to the Board. The company's advice is to put controls and safeguards in place now, and to keep the evidence that they were.

Blue Copper Technologies is currently taking hospitals in Eastern India through their full DPDP compliance programmes, starting with data discovery. Its VControl platform tracks RBI and CERT-In requirements alongside the DPDP Act, and the company states that it can mean up to 50% less audit preparation time.

Next steps for hospitals and NBFCs

Organisations can check their current position with the free DPDP readiness assessment at https://bluecoppertech.com/products/Vcontrol/compliance-frameworks/dpdp-act-compliance/readiness-check

Hospital and NBFC leaders who want to go through the ten questions for their own organisation can book a 30-minute DPDP call with the Blue Copper Technologies team at https://calendly.com/bct-marketing-bluecoppertech/30min or reach the team through https://bluecoppertech.com/contact

This release is for general information and is not legal advice.

About Blue Copper Technologies
Blue Copper Technologies has been building compliance and GRC technology since 2012. Its platform, VControl, supports DPDP Act compliance across five modules: notices and consent, data inventory and classification, security governance, rights and breach response, and retention. It keeps a time-stamped record of every action. More information is available at https://bluecoppertech.com/products/Vcontrol/compliance-frameworks/dpdp-act-compliance