JBMOnboard360 / Resources / DPDP Act for clinics
Data protection guide
The DPDP Act for clinics: what to do before May 2027.
India's Digital Personal Data Protection Act, 2023 now has its Rules, notified in November 2025 and coming into force in stages. Most of the obligations that touch a clinic's front desk apply 18 months after notification, around May 2027. This guide explains what changes for clinics, salons and wellness businesses in plain language, and what you can start doing now.
The basics
Who the DPDP Act applies to
The Act applies to processing of digital personal data in India, and to non-digital data that is later digitised. If your clinic keeps patient names, phone numbers, appointment history or case sheets in software, a spreadsheet or even WhatsApp, you process digital personal data. In the Act's language your clinic is a Data Fiduciary (you decide why and how the data is used), the patient is the Data Principal, and a software vendor that stores data on your behalf is a Data Processor.
Unlike the older SPDI Rules of 2011, the DPDP Act doesn't create a separate category of "sensitive" health data. All personal data is covered, and the core duties are the same whether you run a single-doctor clinic or a chain. The penalties in the Act's schedule go up to ₹250 crore per instance for failing to take reasonable security safeguards to prevent a breach.
The timeline
The Ministry of Electronics and IT notified the DPDP Rules, 2025 in November 2025, with a phased start:
| When | What comes into force | What it means for a clinic |
|---|---|---|
| On notification (Nov 2025) | Rules 1, 2 and 17–21, including the Data Protection Board's set-up | The regulator exists; most clinic duties not yet in force |
| One year later (Nov 2026) | Rule 4: registration of Consent Managers | Consent Manager platforms can register; optional for you to use |
| 18 months later (around May 2027) | Rules 3, 5–16, 22 and 23: notices, security safeguards, breach reporting, retention, children's data, rights | The obligations below apply |
Timeline as reported from the Gazette notification by Storyboard18 and Mondaq. Check the Gazette text and MeitY for exact dates.
Obligations
What the Rules ask of a clinic
1. A clear consent notice
Under Rule 3, when you ask for consent you must give a notice that stands on its own, in clear and plain language, listing the personal data you collect and the specific purposes, and giving a way to withdraw consent, exercise rights and complain. Withdrawing consent must be as easy as giving it. For a clinic, the natural place for this is the intake form.
2. Reasonable security safeguards
Rule 6 expects measures such as encryption or masking, access control, visibility of who accessed data (logs), backups for continuity, and contracts with processors that require the same. It also requires keeping logs for at least a year to help detect and investigate breaches.
3. Breach reporting
Under Rule 7, if there is a personal data breach you must inform affected people without delay, and the Data Protection Board immediately, followed by a detailed report within 72 hours.
4. Retention and erasure
Personal data must be erased once the purpose is served, unless a law requires you to keep it. Medical record-keeping rules, tax law and consumer law may require you to keep some records for years, which is a lawful reason to retain them. For some classes of large platforms the Rules set inactivity periods and a 48-hour warning before erasure; clinics should still set and document their own retention periods.
5. Children's data
Processing a child's data generally requires verifiable consent from a parent. The Rules' Fourth Schedule exempts certain purposes, including health services provided by clinical establishments and healthcare professionals to the extent necessary for the child's health. Check the exact wording before relying on it.
6. Rights and grievances
Patients can ask to access, correct or erase their data and nominate someone to act for them. You must publish how to raise a grievance and respond within the time the Rules set.
Checklist
A DPDP checklist for small clinics
- Map your data. List where patient data lives: software, spreadsheets, paper files, staff phones, WhatsApp, email.
- Get it off personal phones. Patient chats on a receptionist's personal WhatsApp are hard to secure, log or erase. Move conversations to a WhatsApp Business number connected to your system.
- Rewrite the intake form. Add a plain-language notice: what you collect, why, who you share it with, how to withdraw. Our intake form templates include sample wording.
- Separate marketing consent. Consent to treatment and consent to receive WhatsApp offers are different purposes. Ask separately.
- Control access. Give each staff member their own login and the least access they need. Turn on multi-factor authentication.
- Check your vendors. Ask every software provider where data is hosted, how it's secured and how they'd notify you of a breach.
- Write a breach plan. Who decides, who calls patients, who informs the Board, within 72 hours.
- Set retention periods. Decide how long you keep each kind of record and why.
Being straight about our software
What JBMOnboard360 helps with, and what it doesn't
| DPDP area | In JBMOnboard360 today |
|---|---|
| Data hosted in India | Yes, AWS Mumbai (ap-south-1) via Supabase |
| Individual logins, roles, MFA | Yes |
| Consent checkboxes on intake forms | Yes, form-level consent fields |
| WhatsApp broadcasts only to opted-in contacts | Yes, opted-out contacts are skipped |
| Export of a patient's data | Yes, CSV export |
| Consent management (versioned notices, withdrawal tracking, Consent Manager integration) | No |
| Complete access audit log across all records | Partial; not every record type is logged |
| Automatic erasure on retention schedules | No |
Software alone doesn't make a clinic compliant. Your notices, processes and staff behaviour matter as much.
Questions
DPDP questions from clinics
When do the DPDP Rules apply to clinics?
Most obligations that affect clinics, including consent notices, security safeguards, breach reporting and retention, come into force 18 months after the Rules were notified in November 2025, which is around May 2027.
Does a small clinic need to comply?
Yes. The Act has no size threshold for ordinary Data Fiduciaries. Larger obligations apply only to entities notified as Significant Data Fiduciaries.
How fast must a breach be reported?
Affected people must be told without delay, and the Data Protection Board must be informed immediately, with a detailed report within 72 hours, under Rule 7.
Can I keep patient records after treatment ends?
Yes, where another law requires you to keep them, or while the purpose continues. Set and document a retention period for each type of record.
Can I send WhatsApp offers to patients?
Only with consent for that purpose, separate from consent to treatment, and with an easy way to opt out. WhatsApp's own policy also requires opt-in.
Is this legal advice?
No. This is a plain-language summary. Read the Act and Rules and take advice from a lawyer for your clinic's situation.
Keep reading
Related pages
Sources: MeitY data protection framework; PIB explainer on the DPDP Rules, 2025; Storyboard18 and Mondaq on the phased timeline and rule contents. Checked October 2026. Not legal advice.
Try it with your own data
Start with a 7-day free trial.
Full access for 7 days, no card needed. Or talk to the team in Hyderabad that builds JBMOnboard360: we'll set it up around how your business runs today.
- 7-day free trial
- No card needed to start
- Data hosted in India (Mumbai)