If your clinic stores patient names, phone numbers or treatment notes on a computer, a phone or in WhatsApp, India's Digital Personal Data Protection Act applies to you. That covers almost every clinic in the country. The rules that make the Act enforceable were notified in November 2025, and the main obligations apply from 13 May 2027.
That date sounds far off. It isn't, once you count how long it takes to change forms, train a front desk and sort out vendors. Here's what DPDP Act compliance actually means for a clinic, in plain language, and what to do first.
Where things stand
The Act was passed in 2023. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and phase in over 18 months.
- 13 November 2025: the Data Protection Board of India and the Rules' framework came into effect.
- 13 November 2026: provisions on registered consent managers apply.
- 13 May 2027: the substantive obligations apply, including notices, consent, security safeguards, breach reporting and patients' rights.
Treat the months before May 2027 as build time. Most clinics will need all of it.
Does it apply to my clinic?
Almost certainly. The Act covers personal data in digital form, and paper records that you later digitise. Appointment software, a patient spreadsheet, enquiry forms on your website, a CRM and a WhatsApp chat with a patient all count.
Under the Act your clinic is a "data fiduciary", the party that decides why and how personal data is used. Your software vendors, call centre or marketing agency are usually "data processors" acting on your behalf. You remain responsible for what they do with your patients' data.
Health data isn't a special category, but treat it like one
Unlike Europe's GDPR, the DPDP Act doesn't create a separate, stricter category for health data. All personal data gets the same core protections. That doesn't make health data low-risk. A leaked list of a fertility clinic's patients would cause real harm, and the Data Protection Board can weigh how sensitive the data was when it decides a penalty.
Our advice is to handle treatment details as if the strictest rules applied. Most of the effort is the same anyway.
Consent, done properly
Consent under the Act has to be free, specific, informed, unconditional and unambiguous, given by a clear action like ticking a box. A pre-ticked box doesn't count. Neither does a line buried in your terms.
- Give a short notice, in plain language, listing what data you collect and why, before or when you collect it.
- Separate consents for separate purposes. Agreeing to be contacted about an enquiry is not agreeing to receive offers.
- Make withdrawing consent as easy as giving it, and act on it.
- Keep a record of who consented, to what, and when. If a patient complains, you'll need to show it.
The Act also allows some processing without consent, called legitimate uses, including responding to a medical emergency that threatens someone's life. That covers the emergency. It doesn't cover adding the patient to your newsletter afterwards.
Security safeguards and breaches
You must take reasonable security measures to prevent a breach. For a clinic that means the basics done consistently. Encrypt patient data, give each staff member their own login with access only to what they need, keep logs of who viewed or changed records, and keep backups. We explain encryption, access control and audit logs in plain terms. Stop sharing patient files through personal WhatsApp accounts.
If a breach happens, Rule 7 requires you to tell each affected patient without delay, in plain language, and to inform the Data Protection Board without delay, followed by a detailed report within 72 hours. There's no minimum size. A lost laptop with patient records counts.
Have a one-page plan now (here's how to build an incident response plan for a clinic): who decides it's a breach, who contacts patients, who files with the Board. Working that out during a breach is how 72 hours disappears.
Keeping and deleting data
Once the purpose is served, or a patient withdraws consent, you should delete their personal data unless a law requires you to keep it. Medical records often do have legal retention periods, so this isn't "delete everything". See data retention and deletion for clinics. It's knowing why you're keeping each thing.
Marketing data is the easy win. An enquiry list from three years ago, of people who never became patients, is risk with no upside.
Children's data
For anyone under 18, the Act requires verifiable consent from a parent or guardian, and prohibits tracking, behavioural monitoring and targeted advertising aimed at children. Paediatric, dental and dermatology clinics see a lot of minors.
The Rules include an exemption for clinical establishments and healthcare professionals, limited to what's needed to provide health services. It covers the treatment. It doesn't cover marketing to that child or their family.
Your vendors are part of your compliance
Most clinics' patient data lives in other people's systems: practice management software, a CRM, the WhatsApp Business provider, the website form, the ads platforms. Ask each one where data is stored, who can access it, how they'll tell you about a breach, and how you can get the data back or deleted. Put the answers in a written agreement. Our vendor security checklist lists what to ask.
What the penalties look like
The Act sets maximum penalties per breach of its rules, including up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to report a breach or for breaking the rules on children's data. Actual penalties depend on the nature and seriousness of the failure. The numbers are there to make boards pay attention, and they do.
A first checklist for clinics
- 01List every place patient data lives: software, sheets, phones, WhatsApp, email, paper.
- 02Rewrite your enquiry and registration forms with a plain notice and separate consent boxes.
- 03Give every staff member their own login. Remove access for people who've left.
- 04Write your one-page breach plan and name the people responsible.
- 05Ask each vendor the questions above and keep their answers on file.
- 06Delete old enquiry and marketing lists you no longer need.
- 07Publish a contact for data questions on your website.
Key takeaways
- DPDP applies to almost every clinic; the main obligations start 13 May 2027.
- Consent must be specific and recorded. Marketing consent is separate from enquiry consent.
- Report every breach without delay, with a detailed report to the Board within 72 hours.
- Your vendors handle your patients' data; you stay responsible for it.
This is a practical overview, not legal advice. For your specific situation, speak to a lawyer who works on data protection. If you'd like help with the operational side, consent capture, secure enquiry handling and vendor set-up, that's built into how OrvexaTech works with clinics.
Sources