Patient data breach at a clinic: what the DPDP Act requires Who to tell, by when, what to say, and a 10-step plan for the day it happens.

When patient data is breached, the DPDP Act, 2023 requires the clinic to inform two parties: the Data Protection Board of India and every affected patient. Rule 7 of the DPDP Rules, 2025 sets the timing and content. Patients are told without delay, in plain language, through their registered contact. The Board gets a first intimation without delay and a detailed report within 72 hours of the clinic becoming aware of the breach. These duties begin when section 8 of the Act and rule 7 come into force, which is eighteen months after the notifications of 13 November 2025. Preparing now costs a page of paper; doing it for the first time on the day costs far more.

What counts as a personal data breach at a clinic?

Section 2(u) of the Act defines it widely: "any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data". Three things in that definition surprise clinics. It is not limited to hacking. "Accidental disclosure" covers a receptionist sending the wrong patient's report. And "loss of access" covers ransomware or a vendor outage that locks you out of records, even if nobody read them.

Whom must the clinic tell, and what must it say?

Rule 7(1) covers patients. On becoming aware of a breach the Data Fiduciary shall, "to the best of its knowledge, intimate to each affected Data Principal, in a concise, clear and plain manner and without delay, through her user account or any mode of communication registered by her":

• "(a) a description of the breach, including its nature, extent and the timing of its occurrence;"
• "(b) the consequences relevant to her, that are likely to arise from the breach;"
• "(c) the measures implemented and being implemented by the Data Fiduciary, if any, to mitigate risk;"
• "(d) the safety measures that she may take to protect her interests; and"
• "(e) business contact information of a person who is able to respond on behalf of the Data Fiduciary, to queries, if any, of the Data Principal."

For a clinic, "mode of communication registered by her" is usually the mobile number at registration. An SMS or WhatsApp message to that number, in the language the patient reads, meets the wording.

Rule 7(2) covers the Board. First, "without delay, a description of the breach, including its nature, extent, timing and location of occurrence and the likely impact". Then, "within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing": updated and detailed information; "the broad facts related to the events, circumstances and reasons leading to the breach"; measures implemented or proposed to mitigate risk; "any findings regarding the person who caused the breach"; remedial measures to prevent recurrence; and "a report regarding the intimations given to affected Data Principals". Under section 27(1)(a) the Board may then "direct any urgent remedial or mitigation measures", inquire, and impose a penalty.

What are the penalties?

These are ceilings. Section 33(1) lets the Board impose a penalty "if the Board determines on conclusion of an inquiry that breach ... is significant", after giving an opportunity of being heard. A clinic that had safeguards and notified properly is in a different position from one that hid the breach, and the two duties carry separate penalties.

A 10-step breach response plan for a small clinic

1. Write down the time you became aware. The 72-hour period in rule 7(2)(b) runs from here.
2. Contain it: change passwords, log the lost device out of WhatsApp and the clinic software, revoke the leaving staff member's login, ask the wrong recipient to delete the message.
3. Find out what data, how many patients and since when. Write it down as you learn it; you will need nature, extent, timing and location for the Board.
4. If a vendor is involved, ask them in writing for their account of the breach and the list of affected records. Section 8(1) keeps you responsible for what your Data Processor does.
5. Send the Board the first intimation without delay: what happened, how many patients, when, where, likely impact.
6. Tell each affected patient on their registered number, covering the five points in rule 7(1). Keep it short and in the patient's language.
7. Name one person in the clinic who answers patient calls about it, and put their number in the message.
8. Within 72 hours, send the Board the detailed report under rule 7(2)(b), including the list of intimations sent to patients. If you need longer, ask the Board in writing before the 72 hours end.
9. If the breach involved theft or a crime, file a police complaint and keep a copy with the breach file.
10. Fix the cause and record what you changed: new passwords, separate logins, encrypted phone, a different way of sending reports. That is your evidence of reasonable safeguards under section 8(5).

Keep one folder, paper or digital, with the timeline, the messages to patients, the Board submissions and the fixes. Rule 6(1)(e) asks for logs to be kept a year in any case.