DPDP Act for clinics: patient consent and data, explained simply
A plain-English guide to the DPDP Act, 2023 for clinics in India: patient consent, notice, data safety and WhatsApp messages. Not legal advice.
Every clinic holds personal data. A patient's name, phone number, age, visit history and notes all sit in your register, your phone or your software. India's Digital Personal Data Protection Act, 2023 (the DPDP Act) sets rules for how such data is handled. If you run a clinic, it is worth understanding in plain words.
This article is general information for clinic owners. It is not legal advice. The rules under the Act are being brought into force in stages, so check the latest position on the official MeitY website or with a qualified adviser before you change your processes.
The key ideas in simple words
The Act uses a few terms.
- Data Principal: the person whose data it is. For a clinic, that is the patient.
- Data Fiduciary: the one who decides why and how the data is used. For many clinics, that is the clinic itself.
- Consent: the patient's agreement to your using their data for a stated purpose.
- Notice: a clear message telling the patient what data you collect and why.
In short, the Act expects you to collect only what you need, tell the patient clearly why, use it only for that reason, keep it safe, and respect their choices.
Notice: tell patients what you collect and why
When you ask for a patient's details, you should give a short notice. It should be in simple language and say:
- What details you collect (for example name, phone number, visit notes)
- Why you collect them (for example to book appointments, keep records and send reminders)
- How they can contact you with questions or to withdraw consent
- How to complain if they are unhappy
You can show this on your booking page, on a form at the front desk, or on a small board at reception. Use a language the patient understands, such as English or Hindi. Keep it brief and readable.
Consent: free, clear and specific
Good consent has these qualities.
- Freely given. The patient is not forced. You should not refuse an urgent consultation because they declined an optional message.
- Specific. Agreement for appointment reminders is not agreement for advertising.
- Clear action. A tick box the patient selects, or a clear message, is better than silence.
- Easy to withdraw. The patient can say "stop messaging me" and it should be as easy as saying yes.
Keep a simple record of when and how consent was given. Online booking helps here, because the patient confirms details themselves with a code sent to their phone.
Which messages need which consent
A useful way to think about it:
| Message | What patients expect |
|---|---|
| Appointment confirmation and reminders | Expected, as part of booking |
| Follow-up request from the doctor | Expected, if told at booking |
| Offers, camps and promotions | Only if the patient agreed to marketing |
| Review request after a visit | Polite, and easy to ignore or stop |
Do not mix promotions into reminders. If you want to send marketing, ask for that permission separately. See our guide to WhatsApp reminders for clinics.
Collect only what you need
Ask yourself of every field on your forms: do we truly need this? A booking usually needs a name, a phone number and a time slot. A doctor's notes belong in the patient record, not on a public board. Less data means less risk.
Keep data safe
The Act expects reasonable security safeguards. For a small clinic, this means practical habits.
- Separate logins. Each staff member should have their own account, not a shared password.
- Limit access. Reception may need the schedule and phone numbers, while clinical notes are for doctors.
- Remove access quickly when someone leaves the clinic.
- No patient data on personal phones' chats that are not controlled by the clinic.
- Do not post patient information in public groups, even without names.
- Lock screens and computers at the front desk.
- Back up data in a secure way.
Paper registers need care too. Keep them in a locked cupboard, not on an open counter.
Patients' rights
Under the Act, patients can generally ask what data you hold about them, ask for corrections, ask for data to be erased when it is no longer needed, and withdraw consent. Decide who at your clinic handles such requests, and publish a contact, such as an email address. Respond politely and within a reasonable time.
Medical record keeping has its own professional and legal requirements, so deleting a record on request is not always straightforward. Speak to your adviser about how long you must keep clinical records.
If something goes wrong
If patient data is lost or seen by the wrong people, tell your adviser straight away. The Act includes duties around data breaches and can impose penalties for failures. Having a simple plan in advance (who to call, how to secure systems, how to inform patients) is better than working it out in a panic.
Children and elders
Special care applies to minors. The Act has particular rules about children's data, including parental consent in many cases, with some exemptions for health services. Because the details matter, ask your adviser how this applies to paediatric or family clinics. Many elderly patients are helped by family members, so also record who is authorised to act for them.
A practical checklist for your clinic
- A short privacy notice on your booking page and at reception
- Separate staff logins, with access limited by role
- A clear opt-in for reminders and, separately, for marketing
- A way for patients to stop messages or ask questions
- A person responsible for data requests
- A habit of collecting only needed details
- A plan for what to do if data is exposed
Choosing software with this in mind
When you compare tools, ask the vendor who can see your clinic's data, whether each staff member has a separate login, how patient messages are sent, and whether you can export your patient list. Our checklist for choosing clinic management software covers these questions.
In Clinicly, each clinic has its own separate login and data, and only your team can see your patients. Doctors and front-desk staff get their own accounts, and the connection is encrypted. Patients confirm bookings with a code sent to their own WhatsApp. You can read the Clinicly privacy policy for details.
Talking to your staff
Rules on paper do not protect data unless your team follows them. Spend ten minutes with your staff to explain three points: patient details are private, share only what is needed, and ask if you are unsure. Make it clear who to go to with a question or a mistake, and that reporting a mistake early is better than hiding it.
Add a short line on data protection to the staff joining checklist, and repeat the reminder from time to time. A confident front desk that knows what to say when a patient asks "why do you need my number?" is the best protection a small clinic can have.
Frequently asked questions
Does the DPDP Act apply to small clinics?
The Act applies to the processing of digital personal data, and a clinic that keeps patient details in software or on a phone is likely covered in some way. Ask a qualified adviser how it applies to your clinic.
Do I need written consent to send appointment reminders?
Patients should expect these messages and be able to stop them. The simplest approach is to tell them at booking and keep a record that they agreed.
Can I send promotional messages to old patients?
Only if they agreed to receive promotions. Keep promotions separate from appointment reminders and make it easy to opt out.
Can I keep patient records in a paper register?
Paper records still contain personal information, so keep them locked and limit who can see them. The Act's main focus is on digital personal data, but the same care is good practice for paper.
Is this article legal advice?
No. It is general information in simple words. Rules are being brought into force in stages, so check the latest position with an adviser or the official government website.