DPDP Act for clinics: what to do before May 2027 Notice, consent, security, breaches and patient rights for a 1–3 doctor OPD.

From 13 May 2027, a clinic in India that keeps patient details on a computer or phone has to give patients a clear notice, process their data only on a lawful ground, keep it secure, report breaches to the patient and to the Data Protection Board, and answer requests for access, correction and erasure. That date comes from G.S.R. 843(E), the notification that brings most of the Digital Personal Data Protection Act, 2023 into force eighteen months after the Gazette of 13 November 2025, and from rule 1(4) of the DPDP Rules, 2025, which does the same for the Rules. Nothing in the Act exempts a clinic for being small, and most of what it asks is work a well-run OPD desk can do in a few weeks.

Does the DPDP Act apply to a 1–3 doctor clinic?

Yes, if any patient data is in digital form. Section 3 applies the Act to digital personal data collected "in digital form" or "in non-digital form and digitised subsequently". A parchi that the receptionist types into software, a registration on a tablet, a WhatsApp photo of a report saved to the clinic phone: all of it is in scope. A register kept only on paper and never digitised is outside the Act, though not outside your duty of confidentiality.

The clinic is the Data Fiduciary, defined in section 2(i) as "any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data". There is no size threshold in that definition. The patient is the Data Principal, and for a child, section 2(j) includes the parents or lawful guardian. Your software vendor, cloud host or the agency that sends your SMS is a Data Processor under section 2(k): it processes data on your behalf, and section 8(1) keeps the responsibility with you.

When does each part start?

The Ministry of Electronics and Information Technology published two notifications in the Gazette of India dated 13 November 2025. G.S.R. 843(E) appoints the commencement dates for sections of the Act. G.S.R. 846(E) is the DPDP Rules, 2025, and its rule 1 staggers the Rules in the same three steps. The Press Information Bureau gives the notification date as 14 November 2025; the Gazette itself is dated Thursday, 13 November 2025. Count from 13 November to be safe.

The Rules carry a corrigendum, G.S.R. 892(E) of 10 December 2025, which corrects the wording of rule 1 from "of this Gazette" to "in the Official Gazette"; the dates do not move. The only later change we found is the DPDP (Removal of Difficulties) Order, 2026, S.O. 5458(E) of 5 October 2026, which fixes the wording of sections 9(1) and 10(2). As of 22 October 2026 we found no Gazette notification changing the commencement dates. A DPDP milestone is a review trigger for this article.

One loose end: section 44(2), which omits section 43A of the Information Technology Act, 2000, is also in the eighteen-month group. Until 13 May 2027 section 43A stays on the statute book. If you want to know what that means for your clinic today, ask a lawyer; we have not covered the older rules here.

Do you need the patient's consent for everything?

No. Section 4 allows processing for a lawful purpose on one of two grounds: the patient's consent, or one of the "certain legitimate uses" in section 7. Three of those uses matter at an OPD.

• Section 7(a): data the patient "has voluntarily provided" for a specified purpose, where she has not said she does not consent to its use. The Act's own illustration is a pharmacy customer who gives her phone number so the pharmacy can send her a payment receipt. A patient who gives her name, age and phone number at the desk to be seen by the doctor is close to that example.
• Section 7(f): "responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual". It is written for a real emergency; a routine OPD visit is unlikely to qualify.
• Section 7(g): medical treatment or health services "during an epidemic, outbreak of disease, or any other threat to public health".

Section 7(d) also covers processing to fulfil a legal duty to disclose information to the State, such as a notification a law requires you to make. Anything outside these uses needs consent: a health-camp mailing list, a promotional WhatsApp broadcast, sharing details with a lab that pays you, a testimonial. Where you do rely on consent, section 6(1) says it must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" and limited to the data necessary for that purpose. A pre-ticked box on the registration form does not meet that bar. Section 6(4) lets the patient withdraw consent at any time, as easily as she gave it, and section 6(10) puts the burden on the clinic to prove that notice was given and consent was obtained.

Which ground fits each thing your clinic does is a legal judgement. Write down your answer for each purpose (registration, consultation, prescription, billing, reminders, marketing) and have your lawyer look at the list once.

What must the patient notice say?

Section 5(1) requires a notice with every request for consent. Rule 3 sets its content. The notice must stand on its own, in clear and plain language, and give at the minimum:

1. An itemised description of the personal data you collect (name, age, sex, phone, address, complaints, vitals, diagnosis, prescriptions, bills).
2. The specified purpose of each, and a description of the service it enables (consultation, prescription, billing, appointment and token messages).
3. How the patient can withdraw consent, as easily as she gave it.
4. How she can exercise her rights under the Act.
5. How she can complain to the Data Protection Board.
6. The link to your website or app, if you have one, and any other way to reach you for these.

Section 5(3) gives the patient the option to read the notice in English or any language in the Eighth Schedule to the Constitution, so plan a version in the language your patients read, such as Hindi, Marathi or Tamil, alongside the English one. Section 6(3) adds the contact details of the person who will respond to rights requests. For patients whose consent you took before 13 May 2027, section 5(2) asks you to send the notice "as soon as it is reasonably practicable"; you may keep processing until they withdraw.

Rule 9 also asks every Data Fiduciary to publish, on its website or app, the business contact of the person who can answer questions about processing. If the clinic has neither, print the contact on the notice and on a board at the front desk, and ask your lawyer whether that is enough.

What counts as reasonable security for a clinic?

Section 8(5) requires reasonable security safeguards to prevent a personal data breach. Rule 6(1) lists the minimum. Here is each item next to what it looks like at a small OPD.

Rule 8(3) separately asks you to keep personal data, traffic data and processing logs for at least one year from the date of processing, for the purposes in the Seventh Schedule, and to make sure your Data Processor does the same. Section 8(2) says a Data Processor may be used only under a valid contract. If you use free tools with no contract, that is the gap to close first.

What to do if there is a data breach

Section 2(u) defines a personal data breach widely: "any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data" that compromises its confidentiality, integrity or availability. A stolen clinic phone, a receptionist sharing the patient list with a lab, ransomware on the reception PC: each can qualify. Section 8(6) requires intimation to the Board and to each affected patient. Rule 7 sets how.

1. Tell each affected patient "without delay", through her registered phone or other mode, in plain language: what happened, when, how much; the likely consequences for her; what the clinic has done and is doing; what she can do to protect herself; and a contact person who can answer her (rule 7(1)).
2. Tell the Data Protection Board "without delay": a description of the breach, its nature, extent, timing, location and likely impact (rule 7(2)(a)).
3. Within 72 hours of becoming aware, or a longer period the Board allows on a written request, send the Board the detailed report: updated facts, the events and reasons that led to the breach, the mitigation, any findings about who caused it, steps to prevent a repeat, and a report on the intimations sent to patients (rule 7(2)(b)).

Write these three steps on one page now, with the name of the person who decides and the phone numbers of your software vendor and your lawyer. When a phone goes missing at 9 PM, nobody reads the Rules.

Erasure versus keeping medical records

Section 8(7) tells a Data Fiduciary to erase personal data when consent is withdrawn or the purpose is no longer served, "unless retention is necessary for compliance with any law for the time being in force". Section 12(3) applies the same exception to an erasure request from the patient. So the DPDP Act does not make a clinic delete a record that the medical-records rules require it to keep. Our post on how long a clinic must keep medical records covers the 3-year rule and the 72-hour rule under the 2002 conduct regulations.

Rule 8(1) and the Third Schedule set fixed deemed-expiry periods only for large e-commerce, online gaming and social media platforms. A clinic is not on that list. What a clinic needs is a written retention period per type of data, with the legal reason, and a habit of deleting what has no reason to stay: old marketing lists, duplicate WhatsApp photos of reports on staff phones, exported spreadsheets on a home laptop.

What rights does a patient have, and how fast must you answer?

• Access (section 11): a summary of the personal data the clinic processes and the processing done, and the identities of other Data Fiduciaries and Data Processors it was shared with.
• Correction and erasure (section 12): correct, complete or update inaccurate data; erase on request unless the data is needed for the purpose or a law requires it to be kept.
• Grievance redressal (section 13): readily available means to complain to the clinic. The patient must use this before going to the Board. Rule 14(3) has the clinic publish its response period, which may not exceed ninety days.
• Nomination (section 14): the patient can nominate someone to exercise her rights if she dies or becomes incapable.

Rule 14(1) asks you to publish how a patient makes these requests and what identifier you need from her, for example her registered mobile number or patient ID. In practice the front desk will get these requests in person or on WhatsApp. Log each one with the date, and answer access requests well inside the limit; a patient asking for her data is often a patient asking for her records, and the 72-hour rule for records still applies.

Do you need a parent's consent for a child patient?

A child under the Act is anyone under eighteen (section 2(f)). Section 9(1) requires verifiable parental consent before processing a child's data, and section 9(3) bars tracking, behavioural monitoring and targeted advertising aimed at children. Rule 10 sets how a Data Fiduciary checks that the person consenting is an identifiable adult parent.

Rule 12 and Part A of the Fourth Schedule switch off sections 9(1) and 9(3) for "a clinical establishment, mental health establishment or healthcare professional", on the condition that "processing is restricted to provision of health services to the child by such establishment or professional, to the extent necessary for the protection of her health". The Fourth Schedule takes its meaning of clinical establishment from section 2(c) of the Clinical Establishments (Registration and Regulation) Act, 2010, which names a clinic and includes one managed by a single doctor. So treating a child does not need the Rule 10 consent process. Two limits remain. Section 9(2) still bars processing likely to harm a child's well-being. And anything beyond care, such as a birthday SMS or a vaccination-camp promotion, falls outside the exemption.

Is a clinic a Significant Data Fiduciary?

Only if the Central Government notifies it as one under section 10, after assessing factors such as the volume and sensitivity of data and the risk to patients. A Significant Data Fiduciary must appoint a Data Protection Officer based in India, an independent data auditor, and carry out periodic Data Protection Impact Assessments; rule 13 makes the assessment and audit yearly. A small clinic is unlikely to be notified. You do not need a Data Protection Officer, but you do need a named person who answers patients' questions (section 8(9), rule 9).

What are the penalties?

Section 33 lets the Board impose a monetary penalty after an inquiry, if it finds the breach significant. The amounts in the Schedule are ceilings.

Section 33(2) requires the Board to weigh the nature, gravity and duration of the breach, the type of data, repetition, any gain made, how quickly and effectively the Data Fiduciary acted to limit the damage, and whether the penalty is proportionate. Health data affected, and no response plan, is the combination to avoid.

A dated checklist for a 1–3 doctor OPD

The only legal date here is 13 May 2027. The month targets are ours, spread so that a busy clinic finishes with time to spare.