Government of Maharashtra | Project PRAGATI
Security, Audit and Compliance
How the system is designed to meet DPDP Act 2023 obligations, ABDM security requirements, and state / national compliance frameworks. Certifications are targets, not achieved.
Draft for discussion | October 13, 2026
DPDP Act 2023 Obligations
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) establishes the legal framework for processing digital personal data. The table maps key obligations to the system design.
| Obligation | System measure | Verification |
|---|---|---|
| Consent for processing (Section 6) | Consent manager captures, stores and manages consent artefacts | Verified (ABDM Consent Manager spec) |
| Right to access (Section 11) | Patient portal provides access to records and audit trail | To be validated against the final ABDM spec |
| Right to correction and erasure (Section 12) | Patient portal: request correction or deletion; PMU processes | To be validated |
| Right to revoke consent (Section 13) | Consent manager includes grant / revoke toggle for each data fiduciary | Verified (concept in ABDM spec) |
| Data principal grievance mechanism (Section 14) | PMU helpdesk and online grievance portal | To be validated |
| Data fiduciary obligations (Section 8) | Role-based access, encryption, audit logging, periodic audits | Designed as described; audit readiness to be tested |
| Data Protection Board adjudication (Section 18) | System records evidentiary audit logs for production if required | Designed; Board not yet established at the time of writing |
Note:Full DPDP Act text: egazette.gov.in (Act No. 22 of 2023). The Data Protection Board was notified for establishment on 13 November 2025. System design anticipates compliance with all provisions that will enter force on 13 November 2026.
ABDM Security Requirements
The ABDM ecosystem imposes security requirements on all connected Health Information Providers (HIPs) and Health Information Users (HIUs). The system is designed to align, not yet certified.
- Registration and authentication: all HIPs and HIUs must be registered in HFR and HPR and must authenticate through the ABDM gateway.
- Consent-based data exchange: no health data is shared without a valid consent artefact managed by a registered Consent Manager.
- Audit trail: every access to health data must be logged with who, what, when, and for what purpose.
- Data encryption: data in transit (TLS) and at rest (AES-256) as per ABDM guidelines.
- API security: token-based authentication (OAuth2 / JWT) for all FHIR endpoints.
Role-based Access Control (RBAC)
Access is granted by role, not by individual identity. Roles are defined by the PMU and approved by the Health Department.
| Role group | Scope | Privileges |
|---|---|---|
| Clinician (doctor, nurse) | Own facility patients | Read / write EHR, order labs, prescribe |
| Radiologist / specialist | All referred studies | Read DICOM, write report, accept / override AI |
| CHW / ANM | Assigned catchment population | Read screening data, write camp records |
| State / district admin | Aggregate dashboards | Read KPI dashboards, no patient-level access |
| PMU / system admin | System-wide | Audit log, configuration, user management |
Note:Roles are indicative and must be mapped to the actual staffing structure by the PMU.
Encryption and Audit Trail Design
Encryption and audit logging are designed at the platform level.
- Data in transit: TLS 1.3 for all API and web traffic between components.
- Data at rest: AES-256 encryption for all databases, PACS storage, and backups.
- Audit trail: every API call, data read, data write, consent grant and consent revocation is logged with a timestamp, user ID, role, action and resource ID. Logs are immutable and stored separately.
- Retention: as per applicable statutory retention periods (health records: as defined by MCI / PCM / state rules; audit logs: minimum 5 years or as per DPDP Act).
Compliance Targets (Not Achieved)
The following certifications and alignments are targets for the system. None are certified or achieved at the time of this note.
| Framework | Target | Status |
|---|---|---|
| ISO/IEC 27001 | Information security management system (ISMS) certification | Target - to be achieved post-deployment |
| STQC certification | Standardisation, Testing and Quality Certification for e-governance applications | Target - to be submitted for evaluation |
| DISHA alignment | Digital Information Security in Healthcare Act draft guidelines | Target - align with DISHA principles where enacted |
| DPDP Act 2023 compliance | Full compliance with the Act provisions by the compliance date | Target - designed for; audit readiness to be demonstrated |
| ABDM compliance | Conformance to ABDM HIP / HIU technical specifications | Target - to be submitted for ABDM sandbox testing |
Note:None of the above certifications or alignments are claimed as achieved at this stage. They are targets for the delivery phase.