Clinic website privacy notice under DPDP What it must say, what else the site must publish, and what applies before May 2027.

Under the Digital Personal Data Protection Act, 2023, a clinic website that asks patients for their details must show a notice, before or with the request for consent, that tells them what personal data is collected and why, how they can withdraw consent and exercise their rights, and how they can complain to the Data Protection Board. Rule 3 of the DPDP Rules, 2025 adds that the notice must stand on its own, be in clear and plain language, and itemise the data. The site must also publish a contact person and the way to make rights requests. These duties start on 13 May 2027; before that, the 2011 IT rules on sensitive personal data apply to a clinic that is a body corporate.

This post is about the website and its forms. The DPDP duties at the front desk, consent, retention and breaches are in our main guide, the DPDP Act for clinics, and what a clinic website may show under the NMC rules is in can doctors have a website.

When does the DPDP notice rule apply to my clinic website?

From 13 May 2027. MeitY's notification G.S.R. 843(E) of 13 November 2025 brings sections 3 to 5 of the Act, which include the notice in section 5, into force "eighteen months from the date of publication". Rule 1(4) of the DPDP Rules, 2025 (G.S.R. 846(E), also published 13 November 2025) does the same for rules 3, 5 to 16, 22 and 23, so the notice rule (3), the contact rule (9) and the rights rule (14) start together.

The Act covers "digital personal data", which section 3 says includes data collected in digital form, and data collected on paper and digitised later. A booking form, an enquiry form or a report upload all collect personal data in digital form. A clinic is a Data Fiduciary for that data, because section 2(i) defines a Data Fiduciary as "any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data".

What must the privacy notice say?

Section 5(1) lists three things: "the personal data and the purpose for which the same is proposed to be processed", "the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13", and "the manner in which the Data Principal may make a complaint to the Board". Rule 3 sets the form and adds detail. Read together, a clinic website's notice needs these parts:

Section 6(1) also says consent must be "limited to such personal data as is necessary for such specified purpose". The Act's own illustration uses a telemedicine app that asks for the phone's contact list; that consent stays limited to the data needed for the service. Look at your booking form with the same eye: if it asks for full address, occupation or Aadhaar number and the booking does not need them, take the field out rather than explain it in the notice.

Where on the website should the notice appear?

Next to every form that collects data, and as its own page. Section 5(1) says every request for consent "shall be accompanied or preceded by a notice", so a footer link alone, far from the booking button, is weaker than a short line above the form's submit button that links to the full notice. Rule 3(a) says the notice must be "understandable independently of any other information", which is why it should not be folded into terms and conditions.

What else must the website publish?

Three more items, each from a separate rule:

• A contact person. Rule 9: every Data Fiduciary shall "prominently publish on its website or app" the business contact information of a person "who is able to answer on behalf of the Data Fiduciary the questions of the Data Principal about the processing of her personal data". For a small clinic this is usually the owner doctor or the practice manager, with a work email and phone.
• How to make a rights request. Rule 14(1) asks for the "details of the means using which a Data Principal may make a request" and any identifier needed, such as the mobile number the booking was made with.
• The grievance response period. Rule 14(3) asks the Data Fiduciary to publish on its website the period within which its grievance system responds, "not exceeding ninety days". Section 8(10) separately requires "an effective mechanism to redress the grievances of Data Principals".

What applies before May 2027?

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (G.S.R. 313(E), 11 April 2011). They are made under section 43A of the IT Act, and they apply to a "body corporate" as section 43A defines it; ask your lawyer whether your clinic's form of ownership falls within that. Section 44(2) of the DPDP Act omits section 43A, and the November 2025 notification brings section 44(2) into force on the same 13 May 2027 date. Until then the 2011 rules stand.

Rule 3 of the 2011 rules lists "physical, physiological and mental health condition" and "medical records and history" as sensitive personal data. Rule 4 requires a body corporate that handles such information to "provide a privacy policy" and says "such policy shall be published on website of body corporate". It must cover:

1. Clear and easily accessible statements of its practices and policies.
2. The type of personal or sensitive personal data collected.
3. The purpose of collection and usage.
4. Disclosure of the information, as rule 6 provides.
5. The reasonable security practices and procedures under rule 8.

Rule 5(9) adds that the body corporate "shall designate a Grievance Officer and publish his name and contact details on its website", and that grievances are redressed "within one month" of receipt. A notice written now to the DPDP rule 3 structure, with the 2011 security and disclosure statements and a named grievance officer added, covers both regimes; on 13 May 2027 you can drop the parts that depended on the 2011 rules.

A checklist for the clinic website

1. List every place the site collects personal data: booking form, enquiry form, chat widget, report upload, newsletter.
2. Cut each form down to the fields the stated purpose needs (DPDP s.6(1)).
3. Write one standalone notice: itemised data, purpose, withdrawal, rights, complaint to the Board, website and contact (rule 3).
4. Put a one-line link to it above each form's submit button (s.5(1)).
5. Publish the contact person, the way to make rights requests and the grievance response period of ninety days or less (rules 9, 14).
6. Until 13 May 2027, add the security practices and disclosure statements and name a grievance officer who answers within one month (2011 rules 4 and 5(9)).
7. Offer the notice in the language your patients read (s.5(3)).
8. Ask any software or booking vendor behind the form for its terms on processing your patients' data; our list of security questions for clinic software helps.