The DPDP Act, 2023
for clinics.

What the DPDP Act is, in one paragraph

The Digital Personal Data Protection Act, 2023 is India’s law on how organisations collect and use personal data in digital form. A clinic that keeps patient names, phone numbers, visit histories or prescriptions on a computer, in an app or in a cloud system is a Data Fiduciary under the Act; the patient is the Data Principal. The Act does not care how small the clinic is. It cares whether the patient knew what was being collected, agreed to it, and can get it corrected or erased.

This page is a plain-language summary for clinic owners, not legal advice. The Act received assent on 11 August 2023; the DPDP Rules, 2025 that make it operational were notified in November 2025 with a phased timeline, so some duties are already live and others arrive over the following eighteen months. Check the current dates with your lawyer before relying on them.

What a small clinic must do

Tell patients what you collect and why

Before or while collecting data, give a notice in plain language: which personal data you take, what you use it for, how the patient can exercise their rights, and how to complain. For most clinics this is a short notice on the booking page and at the counter, available in English and the languages your patients read.

Get consent that is free, specific and informed

Consent must be a clear affirmative act for a stated purpose. Booking a consultation is such an act for the data needed to run that consultation. Using the same phone numbers to promote a new service is a different purpose and needs its own consent. Patients can withdraw consent as easily as they gave it.

Use the data only for the purpose you stated

Treatment, billing, follow-ups and the records the law requires you to keep are the purposes. Selling or sharing patient lists is not. Once the purpose is served and no law requires you to keep the record, the data should be erased.

Keep it secure

The Act requires reasonable security safeguards and makes the clinic responsible for its processors — including the software vendor. In practice: individual logins for each staff member, access limited by role, no shared passwords, no patient files on personal WhatsApp, and a vendor who stores data in India with encryption and backups.

Report a breach

If patient data is leaked, lost or accessed without authority, the clinic must notify the Data Protection Board of India and the affected patients in the form and time the Rules prescribe. Have a one-page plan now: who checks, who tells the vendor, who informs patients.

Honour patient rights

Patients can ask what you hold about them, have it corrected or updated, have it erased when it is no longer needed, nominate someone to act for them, and complain to the clinic first and then to the Board. Decide who at the clinic answers these requests and how quickly.

Children and dependants

For a patient under 18, verifiable consent of a parent or guardian is required, and children’s data must not be used for tracking or targeted advertising. Family-member bookings should record who gave consent.

What to ask your clinic software vendor

• ✓Where is the data stored? Ask for the country and the cloud provider. Treatlly stores personal and health data on servers in India.
• ✓Who can see what? Role-based access: reception should not see clinical notes; an accountant should see money, not records. Treatlly gives each person their own login and role.
• ✓Is there a written agreement? The vendor is your processor; the contract should say what they do with the data and that they do nothing else.
• ✓Can a patient’s record be exported or deleted on request? You will need this for access and erasure requests.
• ✓How are backups and breaches handled? Ask for the backup schedule and who gets told, how fast, if something goes wrong.

Until the DPDP Rules fully replace them, the SPDI Rules of 2011 under the IT Act still treat health records as sensitive personal data and expect reasonable security practices. Following the DPDP duties above covers both. Treatlly’s own notice is in its privacy policy.

Does the DPDP Act apply to a single-doctor clinic?+

Yes. The Act applies to anyone processing digital personal data, with no size threshold. Some lighter duties may be notified for small entities, but notice, consent, security and patient rights apply to every clinic that keeps patient data digitally.

Do paper registers count?+

The Act covers data in digital form and data collected on paper that is later digitised. A register that is typed into a computer, photographed or scanned is in scope from that moment.

Can I send appointment SMS and WhatsApp messages to patients?+

Messages about the visit the patient booked are part of the stated purpose. Marketing messages are a separate purpose and need separate consent, which the patient can withdraw.

What are the penalties?+

The Act allows the Data Protection Board to impose penalties up to ₹250 crore for failing to take reasonable security safeguards, with lower ceilings for other breaches. The practical risk for a small clinic is a complaint from a patient; the practical defence is a clear notice, honest consent and limited access.