Confidentiality agreement for clinic staff: what it can cover An NDA for the receptionist, nurse and attendant that passes down the DPDP duties and stays enforceable.

A confidentiality agreement for clinic staff is a one- or two-page undertaking, signed with the appointment letter, that names what the employee may not disclose or copy: patient records in any form, the clinic's fees and patient list, its documents and templates, and its logins. It passes down the clinic's duties as Data Fiduciary under section 8 of the DPDP Act, states that the duty continues after the employment ends, and says what happens on a breach. It does not try to stop the employee from working at another clinic later, because section 27 of the Indian Contract Act makes that promise void.

Why a clinic needs a signed undertaking at all

Because the law places the duty on the clinic and the risk at the desk. Section 2(i) of the Digital Personal Data Protection Act, 2023 defines the Data Fiduciary as the person who "determines the purpose and means of processing of personal data"; that is the clinic. Section 8(1) says the Data Fiduciary "shall, irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties provided under this Act, be responsible for complying with the provisions of this Act ... in respect of any processing undertaken by it or on its behalf". Section 8(5) requires "reasonable security safeguards to prevent personal data breach", and rule 6(1)(g) of the DPDP Rules, 2025 adds "appropriate technical and organisational measures to ensure effective observance of security safeguards". A written rule that each employee has signed is the plainest organisational measure a four-person clinic can show.

The second reason is older than the DPDP Act. The fee schedule, the referral relationships, the patient list and the clinic's own prescription and certificate templates are what a competitor would want and what a leaving employee can carry out on a phone. A confidentiality clause is the lawful way to protect them; a non-compete is not.

What the undertaking covers

The clauses, one by one

1. Definition. "Confidential information" means the four heads above, in any form, whether marked confidential or not, and whether learnt before or after signing.
2. Purpose limitation. The employee uses confidential information only for the clinic's work and the patient's care, and only for the purpose the patient gave it for. This mirrors section 4(1) and section 7(a) of the DPDP Act, which allow processing for the specified purpose the patient voluntarily provided data for.
3. No copies outside the clinic. No photographs, screenshots, forwards, downloads or notes of patient data on a personal phone, personal WhatsApp, personal email or any cloud account. Patient communication goes only through the clinic's channel to the number the patient registered.
4. Access. The employee signs in with their own credentials, never shares them, locks the screen on leaving the desk, and looks up only the records the day's work needs. The clinic keeps access logs for a year under rule 6(1)(e) and may review them.
5. Breach reporting. The employee reports any suspected loss, wrong send, lost device or unauthorised access to the doctor or clinic admin the same day, in writing, so the clinic can meet rule 7's seventy-two-hour deadline to the Data Protection Board. Reporting a slip honestly is not itself misconduct; hiding one is.
6. Patient requests. The employee does not hand over records to anyone but the patient or the attendant the patient names; a request for records under the clinic's record rules goes to the doctor. See patient requests for medical records within 72 hours.
7. Return and deletion. On leaving, the employee returns every document, key and device and deletes any clinic material from personal devices, and confirms in writing.
8. Survival. The duty continues after the employment ends, without time limit for patient data and for a stated period for business information.
9. Consequences. Breach is misconduct under the appointment letter and may lead to termination; the clinic may also seek civil remedies. Say it once, without threats.
10. Acknowledgment of training. The employee confirms they attended the clinic's privacy briefing and received the six-rule sheet; our post on DPDP training for clinic staff has the session.

What it cannot do: stop the employee joining another clinic

The Supreme Court restated the rule on 14 May 2025 in Vijaya Bank v. Prashant B Narnaware (2025 INSC 691): "Section 27 of the Contract Act provides every agreement which restrains a person from exercising a lawful profession, trade or business of any kind is to that extent void. A sole exception is carved out in the proviso with regard to sale of goodwill of a business". The Court then repeated the distinction drawn in Niranjan Shankar Golikari v. Century Spinning and Superintendence Company v. Krishan Murgai: "Negative covenants operative during the period of the contract of employment when the employee is bound to serve his employer exclusively are generally not regarded as restraint of trade and therefore do not fall under Section 27", whereas "the doctrine of restraint of trade ... applies only when the contract comes to an end".

For a clinic that means three things. A clause that the receptionist will not work for another clinic while employed here is valid. A clause that she will not join a clinic within three kilometres for a year after leaving is void to that extent, and a court will not enforce it. A confidentiality clause that survives termination is neither, because it restrains disclosure, not the profession; it is the clause that protects the clinic after the employee has gone. Do not confuse the three, and do not put the void one in writing.

Signing and keeping it

• Sign it on the day of joining, together with the appointment letter; our post on the employment contract for clinic staff describes the rest of the file.
• Use the language the employee reads. A Hindi or regional-language version signed by the employee is worth more than an English one she did not understand.
• Have visiting consultants, locums and the part-time accountant sign a version too; they see the same data.
• Keep the signed copy with the ID papers and the training attendance sheet. Re-sign on a change of role, and have the return-and-delete confirmation signed on the last day.