CCTV in a clinic: where cameras may and may not go The DPDP Act 2023 and Rules 2025, the 2002 confidentiality regulations, and the voyeurism offence in the BNS.

Yes, a clinic may use CCTV, but only where patients do not undress or describe their illness: the entrance, waiting area, reception, cash counter and medicine store. No Indian law we found requires or bans CCTV in a small clinic, and neither the Digital Personal Data Protection Act, 2023 nor the DPDP Rules, 2025 mention cameras at all. What limits a clinic's cameras is the doctor's duty of confidentiality under the 2002 conduct regulations, the voyeurism offence in section 77 of the Bharatiya Nyaya Sanhita, 2023, and the DPDP Act's general rules for personal data, most of which apply from 13 May 2027.

Where must a clinic never put a camera?

Anywhere a patient undresses, is examined, uses the toilet or talks to the doctor. Section 77 of the Bharatiya Nyaya Sanhita, 2023 punishes whoever "watches, or captures the image of a woman engaging in a private act in circumstances where she would usually have the expectation of not being observed", or disseminates such an image, with imprisonment of one to three years and a fine on first conviction, and three to seven years on a later one. Explanation 1 says a "private act" includes being watched in a place that would reasonably be expected to provide privacy where the victim's "genitals, posterior or breasts are exposed or covered only in underwear", or where "the victim is using a lavatory".

An examination couch behind a curtain, a changing corner, a procedure room and a toilet are exactly those places. A camera pointed at them, even one meant only for theft, creates the risk the section describes, and the person who reviews or forwards the clip can be the one who commits the offence. The consultation room is off limits for a second reason: what is said there is confidential, as the next section explains. If you want a witness in the room during an examination, use a chaperone; our post on chaperones during examination covers that.

What do the medical regulations say about privacy?

They bind the doctor, not the camera, but the camera belongs to the doctor's clinic. Regulation 2.2 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 says confidences "concerning individual or domestic life entrusted by patients to a physician" should "never be revealed unless their revelation is required by the laws of the State". Regulation 7.14 lists as misconduct disclosing "the secrets of a patient that have been learnt in the exercise of his / her profession", except in a court under the judge's orders, where there is a serious and identified risk to a specific person or community, and for notifiable diseases. Regulation 7.17 bars publishing photographs of patients in a way that identifies them without their permission.

A recording of a patient in the waiting room tells anyone who sees it that the person visited your clinic, and on what day; a recording of a consultation tells them much more. The Charter of Patients' Rights prepared for adoption by the National Human Rights Commission puts it in its right to privacy: "All data concerning the patient should be kept under secured safe custody and insulated from data theft and leakage." Treat footage as you treat the OPD register.

Does the DPDP Act apply to CCTV footage?

Yes, once its main sections are in force. Section 2(t) defines personal data as "any data about an individual who is identifiable by or in relation to such data", and a digital recording of a recognisable face is digital personal data. The clinic decides why and how it records, so it is the Data Fiduciary. Under G.S.R. 843(E) of 13 November 2025, sections 3 to 5, most of section 6, and sections 7 to 10 come into force eighteen months after that Gazette, which is 13 May 2027; our DPDP guide for clinics explains the dates.

The Act does not settle which lawful ground covers a camera. Section 4 allows processing only with consent or for a "legitimate use" listed in section 7. Consent under section 6(1) must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", which a sign on the wall may not achieve on its own. Section 7(i) covers processing "for the purposes of employment or those related to safeguarding the employer from loss or liability", which may cover cameras aimed at staff areas such as the cash desk, but none of the section 7 uses is written for recording patients and visitors for security. Ask a lawyer which ground your clinic relies on, and write it down.

The duties that follow are clearer:

• Notice: where consent is the ground, section 5 and rule 3 require a notice that describes the data and the purpose in clear and plain language, and how to withdraw consent, exercise rights and complain to the Data Protection Board. Section 5(3) requires the notice to be available in English or any language in the Eighth Schedule.
• Purpose: consent under section 6(1) is limited to data "necessary for such specified purpose". A camera installed for theft is not a tool for checking how long the doctor spends with each patient.
• Security: section 8(5) and rule 6 require reasonable security safeguards, including access control, logs of who viewed the data and backups. The Schedule allows a penalty of up to ₹250 crore for failing this duty.
• Erasure: section 8(7) requires erasure once the purpose is no longer served, unless another law requires retention.
• Breach: if footage leaks, section 8(6) and rule 7 require intimation to each affected person and to the Board; see our post on patient data breaches.

How should a clinic set up CCTV?

1. Write one line saying why you record, for example theft and safety at the counter, and keep cameras to the areas that purpose needs.
2. Point no camera into the consultation room, examination area, procedure room, changing area or toilet, and check the angle through doorways and glass partitions.
3. Disable audio recording unless you have legal advice that you need it; sound carries consultations from the next room.
4. Put up a notice at the entrance in English and the local language saying that the area is under CCTV, why, and whom to ask about it.
5. Keep the recorder locked, with a password that only the owner and one named person know; do not view footage on the reception screen.
6. Release footage only to the person filmed on request, or to police or a court on a written requisition; our post on police or court requests for records covers the paperwork.
7. Never post or forward clips on WhatsApp or social media, including clips of an angry patient.