DPDP Compliance for Clinics: What Small Practices Actually Need to Do

Most DPDP guidance is written for companies with a legal team, an IT department and a budget line for privacy. A clinic usually has a doctor, a receptionist, a laptop, a phone that doubles as the appointment line, and an EMR subscription someone set up three years ago. Nobody on that list has “data protection” in their job description.

The law does not care. The Digital Personal Data Protection Act applies to a one-doctor practice in the same way it applies to a hospital chain, and patients’ health details are about as sensitive as personal data gets. The good news is that DPDP compliance for clinics does not need to be a large project. It needs a handful of the right decisions, made on purpose and written down.

This guide walks through those decisions in the order a practice would meet them: whether the Act applies to you, what a normal clinic day does with patient data, who holds which role, what legal basis covers what you do, how long records can stay, how to stay secure without an IT team, and what to do on the day something goes wrong. It sits under our wider guide to DPDP compliance across healthcare providers. If you run a diagnostic lab or imaging centre, see our separate guide to DPDP for diagnostic labs.

1. Does the DPDP Act Apply to a Small Clinic?

Yes. Under Section 2(i) of the DPDP Act, a Data Fiduciary is any person who alone or with others decides why and how personal data is processed. A doctor running a practice decides what to collect from patients and what to do with it. That makes the doctor, or the practice, a Data Fiduciary. The Act sets no minimum turnover, headcount or patient count.

People often hope for a small-business carve-out, so it is worth being precise about what exists. Section 17(3) lets the Central Government notify certain Data Fiduciaries, including startups, as exempt from a short list of provisions: the notice duty in Section 5, Sections 8(3) and 8(7), and Sections 10 and 11. Three things follow. It is an enabling power, not an automatic exemption. We found no notification using it, so check MeitY before relying on one. And even a notified class would still carry the obligations that matter most for a clinic: consent, reasonable security safeguards and breach notification.

Two details help a small practice.

• The Act covers digital personal data only. Section 3(a) applies it to data collected in digital form, or collected on paper and later digitised. A paper appointment register that never goes into a computer is outside the Act. That is a narrow comfort, because most clinics digitise something: an EMR, a billing system, a phone full of patient chats, or CCTV footage that identifies people.
• Size will not protect you from the penalty ceilings. The Schedule sets ceilings of up to ₹250 crore for failing to maintain reasonable security safeguards and up to ₹200 crore for failing to notify a breach. The Board decides the actual amount after an inquiry, and the Act, in Section 33, asks it to weigh matters such as the nature and gravity of the breach and what the Fiduciary did to limit the harm. A clinic that can show sensible steps is in a very different position from one that can show none.

2. What Does a Clinic Day Look Like Through a DPDP Lens?

Before any rule makes sense, map where patient data actually goes. A typical day has six touchpoints.

1. Booking — call, WhatsApp or app. Collected: name, number, reason for the visit. Whose phone holds these chats, and who else can read them?
2. Front desk registration — collected: ID, address, history, emergency contact. Did the patient see a notice before handing this over?
3. Consultation — EMR or paper notes. Collected: complaints, diagnosis, prescriptions. Does everyone log in as themselves, or share one account?
4. Billing — invoices and payments. Collected: amounts, services, insurance details. Which gateway, accountant or software vendor sees this?
5. Follow-up — reminders and recalls, using the phone number and visit history. Is this care or marketing? The two need different footing.
6. Marketing and reviews — photos, testimonials, posts, using images, names and stories of treatment. Did the patient agree to this specific use, separately?

The first four are routine care: booking, registration, consultation and billing. They are also where most of the data lives. The last two, follow-up and marketing, are where a clinic can drift into using data for a purpose the patient never agreed to. A reminder for a booked appointment is part of care. A recall campaign for a cosmetic procedure, a festival offer, or a before-and-after photo on the clinic’s page is something else.

Spend an hour with your receptionist and write down, for each touchpoint, what is collected, where it is stored and who can see it. That one page is the start of your compliance file. It is also what a data registry tool does at scale, which is useful once you have several doctors or several branches.

3. Who Is the Data Fiduciary in Your Clinic?

For a solo practitioner the answer is simple. For anything larger, ask the question on purpose.

• Polyclinics with visiting consultants are the setup most worth a conversation. The clinic runs registration, billing and often the EMR. The consultant makes clinical decisions and may have a practice elsewhere. Both may be deciding things about the same patient’s data for their own purposes. Under Section 2(i), Fiduciaries can act in conjunction with others, but the Act gives no framework for splitting duties between them. So write it down: who owns patient data collected at the clinic, who may use it to promote a consultant’s other practice, and who answers a patient’s request.
• Chains and franchises have the same gap in a different shape: brand and franchisee each assume the other is responsible. Our DPDP guide for diagnostic labs covers the franchise-agreement clause that fixes it, and the same approach works for clinics.
• Your software vendors are almost always Processors. The EMR, the appointment app, the billing tool, the cloud drive and the teleconsultation platform process data on your instructions. Section 8(2) says you may engage a Processor only under a valid contract, and under Section 8(1) you stay responsible for what they do. In practice that means reading the vendor’s terms once: where is data stored, who can access it, what happens to it if you cancel, and does the contract say anything about security.

4. What Legal Basis Covers What You Do?

Consent under Section 6 is the default route for processing, and our guide to DPDP consent management for businesses explains its six requirements. But a clinic has a more useful starting point for its core work.

Section 7(a) permits processing for the specified purpose for which a person has voluntarily provided their data, as long as they have not indicated that they do not consent. A patient who books a visit, fills in a registration form and describes their symptoms has voluntarily provided that data for a consultation. For the consultation, the prescription, the clinical record and the bill, 7(a) is a natural fit. Section 7(f) covers a medical emergency involving a threat to life or an immediate threat to health, where you may not be able to ask first.

The limits are the point:

• It covers the purpose the patient gave the data for. Care, yes. Marketing, no.
• Reminders sit on the line. A reminder for a booked appointment serves the care purpose. A promotional message to the same number is a new purpose and needs consent.
• Photos and testimonials need their own consent. A patient’s agreement to treatment is not agreement to appear on your social media. Ask separately, and let them say no without any effect on their care.
• Sharing with third parties is a separate purpose. An insurer, a referral partner or a pharmacy that is not part of treatment needs its own basis.

Section 5 ties the formal notice duty to requests for consent, so relying on 7(a) does not automatically trigger it. In practice, give a short notice at registration anyway. Rule 3 asks for plain language, an itemised description of what you collect and why, and availability in English or any language in the Eighth Schedule. A one-page notice in English and the local language, with a QR code or a printed copy at the front desk, does the job. Include how to withdraw consent, how to raise a complaint with you, and how to complain to the Data Protection Board.

Two more small items. Section 13 requires readily available means of grievance redressal, and Rule 9 requires you to publish contact details for questions about how you process data. A named person and an email or phone number on the notice and your website covers both. Rule 14 also asks you to say how patients can exercise their rights and how quickly you will respond.

5. How Long Can You Keep Patient Records?

DPDP does not give you a number. Section 8(7) expects personal data to be erased once its purpose is served, unless another law requires you to keep it. For clinics, the other law is mostly professional regulation.

The NMC’s Code of Medical Ethics Regulations, 2002 require a physician to maintain records of indoor patients for three years from the start of treatment, and state that efforts shall be made to computerise medical records. That three-year figure is a floor for indoor patients. It is not a ceiling and it does not speak to every outpatient record. Many practices reasonably keep records longer, because they may need them to answer a complaint or a claim.

So choose a period you can defend and write it down. A workable policy states how long you keep each category (clinical notes, prescriptions, bills, CCTV, appointment chats), the reason for that period, and what happens at the end: deletion from the EMR, from backups on a schedule, and from the phone. Two cautions:

• Do not auto-delete without checking sector rules. If your clinic performs prenatal ultrasound, the PCPNDT Act requires Form F to be preserved for at least two years, or until a case ends if proceedings begin.
• Keep security logs for a year. Rule 6 asks for logs, and the personal data they relate to, to be retained for one year for detecting and investigating unauthorised access, unless another law says otherwise.

6. What Does Rule 6 Mean for a Clinic With No IT Team?

Section 8(5) requires reasonable security safeguards, and Rule 6 of the DPDP Rules, 2025 lists seven minimum measures. They are written for organisations of every size, so translate them.

The most common weak spot in a small practice is not a sophisticated attacker. It is a shared account, a lost phone, or an appointment chat on a personal WhatsApp that three staff members can read. Fixing those costs almost nothing. The clinic needs one patient-facing phone number on a managed device, with access controlled, rather than a doctor’s personal handset.

7. What If Something Goes Wrong?

For a clinic, a breach is rarely dramatic. It is a prescription sent to the wrong number, a laptop stolen from a car, an EMR vendor hit by ransomware, or a former receptionist who still has a login. Under the Act, a personal data breach includes accidental disclosure to someone not entitled to the data, and there is no minimum size.

Section 8(6) and Rule 7 then require notification to the Data Protection Board and to every affected patient: an initial alert without delay, and a detailed report to the Board within 72 hours. Our guide to DPDP breach notification requirements sets out the exact content, and our guide to the Data Protection Board’s role and process explains what happens next. The penalty ceilings are in our guide to the penalty and enforcement structure.

Two things make the day easier. First, a one-page plan: who decides it is a breach, who tells the Board, who tells the patient, and who calls the vendor. Second, a vendor contract that obliges your EMR provider to tell you quickly, because a vendor breach is your breach to report.

8. Do Different Kinds of Clinics Face Different Rules?

The core obligations are the same. A few specialities add layers.

• Paediatric clinics. Anyone under 18 is a child, and Section 9 requires verifiable parental consent, with bans on tracking and targeted advertising aimed at children. Rule 12 and the Fourth Schedule exempt a clinical establishment or healthcare professional where processing is restricted to providing health services to the child, to the extent necessary to protect the child’s health. That does not cover marketing a child’s photo. See our guide on consent management for the verification mechanics.
• Dermatology and aesthetic clinics. Before-and-after photos are the main trap. They are identifying, they are sensitive, and clinics love to post them. Treat photos for the clinical record and photos for marketing as two different purposes with two different consents.
• Mental health practices. The Mental Healthcare Act, 2017 gives a separate statutory right to confidentiality, so keep access tighter than the general rule and avoid appointment reminders that reveal the nature of the visit.
• Clinics doing prenatal ultrasound. PCPNDT’s Form F and its two-year retention apply, and nothing in a report or message may reveal the sex of the foetus.
• HIV testing or counselling. The HIV and AIDS (Prevention and Control) Act, 2017 requires informed consent for testing and restricts disclosure of status. A general DPDP consent line does none of that work.

Our wider guide to DPDP compliance across healthcare providers covers the wider stack of sector laws and ABDM in more depth.

9. When Do These Obligations Start?

Not yet, and that is your window. The DPDP Rules, 2025 were notified on 13 November 2025. The Board exists, but consent, notice, security safeguards, breach notification and children’s data fall within an eighteen-month phased compliance window that lands on 13 May 2027. Large hospital groups may eventually be notified as Significant Data Fiduciaries, as we explain in our guide to SDF obligations, but that is a question for chains, not for a typical single clinic.

A practice can finish the starter list below in a few weeks of part-time effort. Doing it before the deadline, rather than after a complaint, is the difference between a planned project and a scramble.

10. A Right-Sized Roadmap for Clinics

Work through the eight items in roughly this order. Items 1 to 3 are paperwork you can finish in a week. Items 4 and 5 are settings and habits. Items 6 to 8 need a few conversations and one afternoon of writing.

1. A notice at registration. Plain language, what you collect and why, how to withdraw and how to complain. Section 5, Rule 3.
2. Separate consent for extras. Marketing messages, photos, testimonials: each its own yes or no. Section 6.
3. A named contact and grievance route. Someone patients can reach, published where they can see it. Rule 9, Section 13.
4. Individual logins, limited access. No shared front-desk account. Reception sees what it needs, not clinical notes. Rule 6.
5. Encrypted devices, tested backups. Laptops and phones that hold records, plus a restore you have actually tried. Rule 6.
6. A contract with each software vendor. EMR, appointment app, billing, cloud storage, with a security clause. Section 8(2), Rule 6.
7. A written retention rule. How long you keep records and why, with exceptions for sector laws. Section 8(7).
8. A one-page breach plan. Who decides, who tells the Board and the patient, and how fast. Section 8(6), Rule 7.

A few practical notes. Put the notice where patients actually look: the registration form, the front desk and the booking page. Keep a simple record of consent for marketing and photos, with the date and exactly what the patient agreed to. Review vendor contracts when they renew, not just once. And brief every staff member for ten minutes. In a small clinic, the receptionist is your compliance team.

This is where a platform can save a small practice real time. RuleExpert’s DPDP Scorecard shows you where you stand and what to fix first, our Data Registry keeps the map of what patient data you hold and where, our Consent Manager module (internal consent software for your clinic, not a registered Section 2(g) Consent Manager) records notices and consents with an audit trail, and our Breach Management workflow gives you the plan for the bad day. Role-based access control lets reception see what it needs and nothing more. If you would like to see how that looks for a practice of your size, book a demo with RuleExpert, or see how the full platform fits together on our DPDP compliance solution page.

11. Mistakes Clinics Make

• Assuming a small clinic is exempt. The Act has no size threshold, and no startup exemption has been notified that we could find.
• Running appointments from a personal WhatsApp. The channel is not the problem. Shared access, no ownership and no way to cut off a departing employee are.
• Treating consent to treatment as consent to marketing. They are separate purposes.
• Posting patient photos or testimonials without a separate, recorded yes.
• Sharing one login across the front desk. It makes Rule 6’s logging pointless.
• Never reading the EMR vendor’s terms. Where data lives and what happens on exit are your problem if the vendor fails.
• Deleting by habit. An automatic purge can collide with a sector retention rule.
• No plan for a misdirected message. It is the most likely breach a clinic will have.

12. Frequently Asked Questions

Does the DPDP Act apply to small clinics and solo doctors?

Yes. The Act applies to any Data Fiduciary regardless of size. A practice that decides how patient data is collected and used is a Data Fiduciary. Only digital personal data is covered, but most clinics hold some.

Is there an exemption for small businesses or startups?

Section 17(3) lets the government exempt notified Data Fiduciaries from a short list of provisions, but it is an enabling power. We found no notification using it, and it would not remove the duties on consent, security safeguards or breach notification.

Do paper medical records fall under the DPDP Act?

Not unless digitised. Section 3(a) covers digital personal data, including data collected on paper and later digitised. Typing paper records into an EMR brings them in.

Do I need patient consent to keep medical records?

For the core service, Section 7(a) can cover processing for the purpose the patient voluntarily provided their data for, unless they have indicated they do not consent. Marketing, photos and sharing for other purposes need their own consent.

How long should a clinic keep patient records?

DPDP sets no number. The NMC’s 2002 Code requires three years for indoor patients and says efforts shall be made to computerise records. Choose a documented period you can justify, and make exceptions for sector laws such as PCPNDT.

Is it safe to run appointments on WhatsApp?

The Act bans no channel but requires reasonable security safeguards. Use a dedicated clinic number on a managed device, limit who can read it, and do not mix patient chats with personal ones.

Are my EMR and appointment software vendors Data Processors?

Usually yes, because they process data on your instructions. Section 8(2) requires a valid contract, and you stay responsible under Section 8(1).

What counts as a data breach in a clinic?

Unauthorised processing, or accidental disclosure, of personal data. A prescription sent to the wrong number counts, with no minimum size. Notification to the Board and affected patients follows under Section 8(6) and Rule 7.

Do paediatric clinics need parental consent?

Section 9 requires verifiable parental consent for anyone under 18, with a Rule 12 exemption for health services necessary to protect the child’s health. It does not cover marketing or other uses.

When must clinics comply?

The Rules’ core operational provisions take effect on 13 May 2027, eighteen months after notification on 13 November 2025.