Software
Cloud vs on-premise clinic software: which should a small clinic run? Where the data lives, who backs it up, what the DPDP Act expects of each, and the offline question that decides it.
Cloud clinic software keeps your records on the vendor's servers and needs a connection; on-premise software keeps them on a computer in the clinic and needs you to look after it. For a 1 to 3 doctor OPD the choice turns on three things: what happens when the internet drops, who takes the backup, and what the DPDP Act expects of the clinic in each case. This post sets out the trade-offs and the third option most small clinics end up wanting.
Published · Last reviewed · 6 min read
- On-premise puts backup, updates, security and the server's failure on the clinic. Cloud moves those to the vendor but makes the connection a single point of failure unless the software works offline.
- Under section 8 of the DPDP Act the clinic is the Data Fiduciary either way. It can use a processor only under a valid contract and stays responsible for the processing done on its behalf.
- Offline-first cloud software, where the desk keeps working without a connection and syncs later, removes the main reason small clinics chose on-premise.
For most 1 to 3 doctor clinics in India, cloud software that also works offline is the better choice, because it takes backup, updates and server security off the clinic while keeping the desk running through a dropped connection. On-premise software makes sense where there is no reliable connection at all, where a rule or an owner requires the data to stay on the premises, or where the clinic already has someone who maintains computers. The sections below give the trade-offs so you can check which case you are in.
What do cloud, on-premise and offline-first mean?
| Model | Where the data lives | What the clinic maintains |
|---|---|---|
| Cloud (online only) | Vendor's servers; the desk uses a browser or app | A connection and a backup line; nothing on the computer |
| On-premise (local) | A computer or server in the clinic, sometimes with a local network | The machine, its backups, updates, anti-virus, UPS and the person who fixes it |
| Offline-first cloud | Vendor's servers, with a working copy on the desk device that syncs when connected | A connection for sync and new registrations; the device holds the day's work |
What are the trade-offs for a small clinic?
| Question | Cloud | On-premise |
|---|---|---|
| Internet drops mid-OPD | Online-only stops; offline-first keeps writing and printing | Keeps working; the internet was never needed for the desk |
| Computer dies | Log in from another device; data is on the server | Data is on the dead disk unless a backup was taken last night |
| Backup | Vendor's job; ask how often and how you would get a copy | Clinic's job; someone must run it, check it and store a copy elsewhere |
| Updates and bug fixes | Applied by the vendor for everyone | Installed by you or the vendor's engineer on a visit |
| Security | Vendor's servers and your passwords | Your machine's anti-virus, patches, physical access and the USB ports |
| Second doctor or second room | Another login | Another PC on the local network, set up by someone |
| Access from home | Yes, with a login | Only if you open the clinic machine to the internet, which creates its own risk |
| Cost shape | Monthly or yearly fee; little hardware | Licence or one-time fee, plus the server, UPS, AMC and the engineer's visits |
| Leaving | Depends on export; ask for the format | The database is in the building, but reading it without the software can still need the vendor |
The row that decides it for most clinics is the first one. If the software works without the connection, the cloud's main weakness is gone, and what remains is a list of chores the vendor does for you. Our page on offline clinic management software explains how that works at the desk, and our post on what to do when the internet drops mid-OPD has the backup kit for either model.
What does the DPDP Act expect in each model?
The Digital Personal Data Protection Act, 2023 does not prefer one model. It defines the clinic that decides why and how patient data is processed as the Data Fiduciary, and anyone who processes data on its behalf as a Data Processor. The obligations in section 8 then fall on the clinic whichever way it runs its software.
- Section 8(1): the fiduciary is responsible for compliance "in respect of any processing undertaken by it or on its behalf by a Data Processor". A cloud vendor does not take the responsibility off the clinic.
- Section 8(2): the fiduciary may use a processor "only under a valid contract". For cloud software that contract is the vendor agreement; read it. For on-premise software with no vendor access to data, there may be no processor at all, and the whole duty sits with the clinic.
- Section 8(5): the fiduciary must protect personal data "including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards". Rule 6(1) of the DPDP Rules, 2025 lists the minimum: encryption or similar measures, access control, logs and monitoring, "reasonable measures for continued processing" such as data backups, one-year retention of logs, a contract clause with the processor on safeguards, and organisational measures.
- Section 8(6) and rule 7: in a breach, the fiduciary tells each affected patient and the Data Protection Board, with the detailed report to the Board within 72 hours. On-premise, the clinic must notice the breach itself; in the cloud, the vendor must tell the clinic fast enough.
Rule 8(3) of the Rules adds a retention point that bites either way: the fiduciary must keep the personal data, traffic data and logs of processing for at least one year, and the Rules' own illustration uses a company that engages a cloud provider to host records and must ensure the provider keeps the data and logs for that year. The rules on security, breach and retention come into force eighteen months after the Rules' publication on 13 November 2025. Our DPDP Act guide for clinics covers the whole timeline.
Separately, CERT-In's directions of 28 April 2022 require service providers, data centres and body corporates to keep logs of their ICT systems for a rolling period of 180 days within India. For cloud software that is a question for the vendor; for an on-premise install it is a question for whoever runs the machine.
Who takes the backup, and how would you know it worked?
In the cloud model, ask the vendor in writing how often data is backed up, where the copies are kept, how long a restore takes, and whether the clinic admin can export a full copy without asking. In the on-premise model, write a routine and give it to a named person: a backup every working day, a copy stored outside the building or in an online drive, and a test restore once a month. The MoHFW EHR Standards for India 2016 put it plainly in their hardware section: "A backup or data preservation mechanism should be put in place." Our post on clinic data backup and recovery gives the routine in detail.
When does on-premise still win?
- No usable connection. A clinic with no line and patchy mobile data cannot sync, and offline-first software still needs a connection for new registrations and updates.
- A policy requirement. Some owners, trusts or institutional clinics require records to stay on the premises. If that is written down, cloud is out unless the policy changes.
- An existing setup that works. A clinic with a server, a maintenance contract and a person who runs the backups has already paid the cost. Moving to cloud is a project; our post on switching clinic software covers it.
- A hospital with wards, lab machines and pharmacy counters on one local network. That is a different purchase and a different post.
Questions
Is cloud clinic software allowed under the DPDP Act?
Yes. The Act does not restrict the model. It makes the clinic the Data Fiduciary, allows a Data Processor only under a valid contract (section 8(2)), and keeps the clinic responsible for the processing done on its behalf (section 8(1)).
Does on-premise software mean I do not need a DPDP contract?
If no vendor or outside party processes the data for you, there may be no Data Processor to contract with. The security, breach and retention duties in section 8 and the Rules still fall on the clinic itself.
What is offline-first clinic software?
Cloud software that keeps a working copy of the day's data on the desk device, so the queue, consultation, printing and billing continue without a connection and sync when it returns. It removes the main reason small clinics chose on-premise.
Sources
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, 11 August 2023, sections 2(i), 2(k) and 8 (accessed 30 Oct 2026)
- Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025, rules 1, 6, 7 and 8 (accessed 30 Oct 2026)
- CERT-In, Directions under section 70B(6) of the IT Act, 2000, No. 20(3)/2022-CERT-In, 28 April 2022, direction (iv) (accessed 30 Oct 2026)
- MoHFW e-Health Division, Electronic Health Record (EHR) Standards for India 2016, Standards Set Recommendations v2.0, hardware section (accessed 30 Oct 2026)
This is operational guidance for clinics, not legal or tax advice. Confirm with your state authority, council or CA.
Drafted with AI assistance; every fact checked against the sources listed; reviewed by the Vitels team.