The DPDP Act and Your Clinic: What Patient-Data Consent Actually Requires

Every clinic collects personal data: names, phone numbers, Aadhaar or ABHA numbers, and above all health information. The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 change how that collection has to be explained and recorded. This guide covers what consent means under the law, what you need to tell patients, and a front-desk checklist you can start on now.

Where the Law Stands in October 2026

The DPDP Act was passed in 2023. The government notified the DPDP Rules in November 2025 and set out a phased start rather than switching everything on at once:

• Immediately: the provisions setting up the Data Protection Board.
• After about 12 months: the rules for registered Consent Managers.
• After about 18 months, around May 2027: the obligations most clinics care about, including notice, consent, security safeguards and breach reporting.

So the main duties are not yet enforceable, but they are close, and starting now leaves time to redesign registration calmly. Existing obligations, such as medical confidentiality and the IT Act’s rules on sensitive personal data, continue to apply in the meantime.

In the Act’s language, your clinic is a Data Fiduciary (the one deciding why and how data is processed) and the patient is the Data Principal. Your software vendor, lab partner or cloud provider is usually a Data Processor acting on your instructions. Responsibility stays with you even when a vendor holds the data.

What Valid Consent Looks Like

The Act describes valid consent as free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. In clinic terms, that means:

• Specific: consent is tied to a stated purpose, such as treatment, billing, appointment reminders or sharing records through ABDM. One vague line covering "all purposes" is not enough.
• Limited: collect only what that purpose needs. If your registration form asks for religion or income and you never use it, remove the field.
• Separate: do not make treatment depend on agreeing to something unrelated. A patient should be able to say yes to treatment and no to health-camp messages.
• Recorded: you must be able to show that consent was given. A signature on paper works, and so does a timestamped tick-box or OTP confirmation in your software.

The practical test: could your receptionist explain to a patient, in one or two sentences, what each item of data is for? If not, the consent probably is not specific enough.

The Notice You Give Patients

Consent has to come with a notice. Under the Rules, the notice should be in clear and plain language, understandable on its own, and should set out:

• the personal data you collect, listed item by item;
• the specific purpose for each, and the service it makes possible;
• how the patient can withdraw consent, exercise their rights and complain to the Data Protection Board.

The Act also lets patients ask for the notice in English or in any language listed in the Eighth Schedule of the Constitution. For most clinics, a one-page notice in English and the main local language, displayed at reception and given on registration, is a sensible starting point.

When Consent Is Not the Only Basis

Not every use of data needs fresh consent. Section 7 of the Act lists "legitimate uses", and a few matter to clinics:

• responding to a medical emergency involving a threat to the life or health of a patient or another person;
• providing treatment or health services during an epidemic, outbreak or other threat to public health;
• data a person has voluntarily provided for a specified purpose, where they have not said they object to its use;
• complying with a law or court order.

These are narrower than they sound. An unconscious patient in casualty is covered. Adding every patient to a WhatsApp broadcast list is not. Do not rely on a legitimate use for anything routine without checking with a lawyer first.

Patient Rights, Children and Your Record-Keeping Duties

Access, correction and withdrawal

Patients can ask what data you hold about them, ask for corrections, and withdraw consent. Withdrawal should be as easy as giving consent was. After withdrawal you stop the processing that relied on it, such as reminder messages, unless another legal basis applies.

Erasure versus medical record retention

This is where clinics need care. A patient may ask you to erase their data, but medical regulations, clinical establishment rules and medico-legal prudence may require you to keep records for a set period. The Act allows retention where another law requires it. Find out which retention periods apply in your state and speciality, write them down, and explain them to patients who ask for deletion.

Children and patients who cannot consent

For anyone under 18, the Act generally requires verifiable consent from a parent or guardian, with similar rules for lawful guardians of some persons with disabilities. The Rules include exemptions for healthcare providers in defined circumstances. Paediatric and family clinics should read the exact scope of those exemptions rather than assume everything is covered.

If Something Goes Wrong: Breach Reporting

A breach is not only a hacker. A stolen laptop, a phone with patient chats left in an auto-rickshaw, or a spreadsheet emailed to the wrong person can all count. Under the Rules, once the obligations are in force, a clinic must inform affected patients without delay and inform the Data Protection Board, followed by a detailed report within 72 hours.

The Rules also expect reasonable security safeguards, including encryption or masking, access controls, logging and monitoring, and backups. The Act’s schedule of penalties is heavy, reaching up to ₹250 crore for failing to take reasonable security safeguards, so this is not an area to improvise. For the security side in more depth, see our post on security that meets India’s standards, and if you share records digitally, our guide to ABDM and ABHA explains how consent works for that exchange.

A Front-Desk Checklist to Start This Month

• Map your data. List every place patient data lives: registration forms, the EMR, billing, WhatsApp phones, lab portals, email and paper files.
• Trim the form. Remove fields you do not use.
• Split the consents. Separate treatment, reminders, ABDM sharing and any non-essential communication into distinct choices.
• Write the notice. One page, plain language, English plus your local language.
• Record consent. Decide where each consent is stored and how staff can see it during a visit.
• Plan withdrawals. Decide who handles a request to withdraw or delete, and how quickly.
• Check vendors. Ask your software and lab partners where data is stored, who can access it, and how they would tell you about a breach. Our EMR buyer’s checklist has more questions.
• Train staff. Spend fifteen minutes walking reception through the new form and how to answer "why do you need this?"

If you use MedHive Pro, patient registration, role-based staff access and records all sit in one cloud system. That makes the "map your data" step much shorter than tracing paper files and personal phones. Consent design is still a decision for your clinic.

Frequently Asked Questions

Does the DPDP Act apply to a single-doctor clinic?

The Act applies to digital personal data, and to data collected on paper and later digitised. It does not exempt clinics by size. If you keep any patient data digitally, including in a phone or a spreadsheet, assume it applies, and check the current Rules for any small-entity relief.

Do we need a Data Protection Officer?

A formal DPO is required for Significant Data Fiduciaries, a category the government designates. Most small clinics are unlikely to be designated, but you still need a named person patients can contact about their data. Check whether your organisation falls into any notified category.

Can we keep sending appointment reminders?

Reminders are a reasonable purpose to include in your notice and consent. Make the choice explicit at registration and honour opt-outs. Promotional messages are a separate question under the NMC’s rules; see our NMC compliance checklist.