DPDP training for clinic staff: what the front desk must know Six rules from the Act and the 2025 Rules, taught in a forty-minute session with a screen and a phone.

DPDP training for clinic staff comes down to six rules: collect only what the registration needs and tell the patient why; use the data only for that purpose; keep patient data inside the clinic's systems and off personal phones and chats; keep the screen and the counter private; use your own login and nobody else's; and report any slip the same day so the clinic can meet its seventy-two-hour deadline. Each rule maps to a section of the Digital Personal Data Protection Act, 2023 or a rule in the 2025 Rules, and the session below teaches them in forty minutes.

Who is responsible under the DPDP Act: the clinic or the staff?

The clinic. Section 2(i) defines a Data Fiduciary as "any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data", and section 8(1) says the Data Fiduciary "shall, irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties provided under this Act, be responsible for complying with the provisions of this Act and the rules made thereunder in respect of any processing undertaken by it or on its behalf by a Data Processor". A receptionist who shares a report is the clinic's breach, and the Schedule to the Act sets the penalty for a failure of security safeguards at up to ₹250 crore and for a failure to notify a breach at up to ₹200 crore. The size of the penalty is set for large companies; the duty is the same for a two-room OPD. Our post on the DPDP Act for clinics covers the Act as a whole; this one covers what staff need to know.

Timing matters. The commencement notification, G.S.R. 843(E) of 13 November 2025, brought the Data Protection Board provisions into force at once and set the substantive duties, sections 3 to 5, 6(1) to (8), 7 to 10 and others, to come into force "eighteen months from the date of publication", which falls in May 2027. Rule 1(4) of the Rules gives rules 3 and 5 to 16, which include the security safeguards and breach rules, the same eighteen-month start. A clinic that trains staff now is early, which is the right side to be on.

The six rules, each with its section

The WhatsApp rule, in plain words

Patient data goes out of the clinic only through the clinic's own channel, with the clinic's name on it, to the number the patient registered. A report photographed on a personal phone and sent from a personal WhatsApp is a copy of personal data outside the clinic's control, which the clinic can neither log under rule 6(1)(c) nor erase under section 8(7)(b). The same applies to a doctor's personal number. Our post on WhatsApp for clinics under NMC and DPDP rules covers what the clinic's channel may carry; staff training needs only the one line: never from a personal account.

Screen privacy at the OPD desk

• Turn the monitor so the waiting line cannot read it, or use a privacy filter. The queue display shows token numbers, not names and complaints.
• Do not call out a diagnosis or a test name across the room; call the token or the name only.
• Keep the paper OPD register closed and under the counter; a register left open is a disclosure to every person who leans over.
• Lock the screen when leaving the desk, even for a minute. Each staff member uses their own login so the access log under rule 6(1)(c) means something.
• Printed prescriptions and reports are handed to the patient or the attendant the patient names, and nobody else.

What counts as a breach, and what staff do in the first hour

Section 2(u) defines a personal data breach as "any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data". A report sent to the wrong number, a lost phone with the clinic app open, a laptop stolen from the car, a register left in the auto, a staff member looking up a neighbour's file: all are breaches. Rule 7(2) gives the clinic seventy-two hours from becoming aware to send the Board the detailed report, and rule 7(1) requires each affected patient to be told without delay. Staff cannot run that process, but they start it: tell the doctor or the clinic admin the same hour, write down what went where and when, and do not delete anything.

A forty-minute training session that works

1. Ten minutes: the six rules on one page, read aloud, with the section numbers. Hand it out and have each person sign it.
2. Ten minutes at the desk: show the registration screen, the consent notice, the queue display, the lock-screen key and the individual login. Show what a patient in the chair can see.
3. Ten minutes of cases: a relative asks for a report on the phone; a patient asks to send the prescription to a different number; a lab calls for a patient's history; a doctor friend asks for a file. The answer to each is the same: through the clinic's channel, to the registered patient, or not at all.
4. Five minutes on breach: what counts, who to tell, the seventy-two-hour clock.
5. Five minutes to repeat at every new joining and once a year, with a dated attendance sheet in the staff file next to the confidentiality undertaking; see our post on a staff confidentiality undertaking for clinics.