Anyone on a hospital/health-tech board dealing with DPDP compliance actually reaching the board level now?

Curious how widespread this is — I've been reading that DPDP compliance is increasingly showing up as an actual board agenda item at hospital groups and health-tech companies, not just something IT or legal handles quietly in the background.

The reasoning makes sense on paper: the Act makes the organization itself (not IT, not a vendor) the legally accountable party, so liability apparently travels straight to whoever owns governance decisions. And there's real financial stuff tied to it beyond just penalty risk — apparently insurers and referral networks are starting to ask for documented DPDP readiness before contracts get signed, and data governance is becoming a standard line item in M&A due diligence for hospital acquisitions and health-tech funding rounds.

Has anyone actually sat through a board discussion on this, or seen how a board is supposed to oversee something like consent architecture or vendor governance without micromanaging implementation? Also curious about the "Significant Data Fiduciary" designation — seems like a big deal (mandatory India-based DPO reporting to the board) but the actual criteria for who qualifies doesn't seem fully settled yet? Found a pretty detailed explainer on why this is becoming a board issue that helped me understand the mechanics, but would love real experiences from anyone actually on a board dealing with this.