What the DPDP Rules mean for a 10-person clinic

Picture a clinic with two doctors, a physiotherapist, three front-desk and billing staff, a lab technician and a couple of nurses. Patients book on WhatsApp or by phone, walk in, fill a paper form, get a reminder the day before, and leave with a bill and maybe a lab report on their phone. Patient lists live in the clinic software, in an Excel sheet on the reception computer, and in the WhatsApp Business app.

That clinic is a data fiduciary under the Digital Personal Data Protection Act, 2023. It decides why and how patient data is used, so the duties in the Act and the 2025 Rules fall on it, however small it is. This post walks through what that means in practice, without the legal language.

When does this apply?#

The DPDP Rules were notified on 14 November 2025. Some parts, such as the rules about the Data Protection Board, started straight away. Most of the duties that matter to a clinic, including notices, consent, security safeguards, breach reporting and rights requests, are expected to apply about 18 months later, from around 13 May 2027.

That sounds like a long runway. It is not, for a busy clinic. Changing the front-desk routine, retraining staff and cleaning up old patient lists takes months, and you want the new habits settled before the date, not started on it.

1. Know what you collect, and why#

Start with a single sheet of paper. List every place patient data enters the clinic and every place it ends up:

• the appointment form, phone bookings and WhatsApp chats
• the consultation notes and prescriptions in your clinic software
• lab orders and reports
• bills, payment references and insurance or TPA paperwork
• reminder lists for WhatsApp and SMS
• any newsletter or health-camp list

For each one, write down the purpose in plain words ("to book and confirm appointments", "to send reminders", "to send health tips"). The Act asks you to tell people, item by item, what personal data you collect for each purpose. It is much easier to write that notice once you have this list.

2. Write a notice people can actually read#

Before or when you ask for consent, the patient must get a notice that says what data you collect, for what purpose, how they can withdraw consent, how they can use their rights, and how they can complain to the Data Protection Board of India. It has to be in clear and plain language, and it can be in English or in any of the 22 languages in the Eighth Schedule of the Constitution.

For a clinic in Pune, that probably means English and Marathi, perhaps Hindi too. A notice the patient cannot read does not do its job.

Keep the notice separate from your general terms. A notice buried on page three of a registration form, under "terms and conditions", is the kind of thing the law is trying to stop.

3. Get consent the right way at the front desk#

Consent under the Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. In clinic terms:

• One choice per purpose. "Book my appointment" and "send me health tips" are different purposes. The patient can say yes to one and no to the other.
• No pre-ticked boxes. An unticked box the patient ticks themselves is a clear action. A box you ticked for them is not.
• Optional means optional. You cannot refuse treatment because someone declined your newsletter.

Paper forms make this hard to prove later. A QR code on a standee at reception works better: the patient scans it, reads the notice in their language on their own phone, confirms with an OTP, and makes their choices. On a busy day, a tablet in kiosk mode at the counter does the same job for patients who prefer not to use their own phone. Either way, you end up with a record of exactly what the patient saw and chose, and when.

Medical emergencies are different. Care must never wait for a consent form, and the Act allows processing for medical emergencies without consent. Do not let any of this slow down an emergency.

4. Send reminders that do not reveal the care#

Reminders are useful and patients usually want them. They are also a quiet privacy risk, because phones are shared. "Your appointment at 11 am tomorrow" is fine. "Your therapy session with our psychiatrist" or a message that names a test can reveal something the patient never meant to share with their family.

Make reminders a separate, optional purpose, keep the wording neutral, and let patients choose the channel (SMS, WhatsApp or email). This matters most for mental-health care, sexual health and anything else people are likely to keep private.

5. Plan for requests before they arrive#

Patients now have clear rights. They can ask for a summary of the data you hold and who you shared it with, ask you to correct or update it, ask you to delete it, nominate someone to act for them, and raise a grievance. If they are not happy with your answer to a grievance, they can go to the Board.

In a small clinic, name one person who owns these requests. It can be the practice manager. Give them:

• a single place where requests arrive, with a reference number for the patient
• a due date for each request, and a reminder before it is late
• a short checklist of the systems to look in: clinic software, Excel, WhatsApp, the lab system

Erasure needs extra care. Medical records usually have to be kept for a minimum period under medical-council and state rules. When a patient asks you to delete their data, you can delete what you no longer need, such as marketing lists and reminder preferences, and record that the treatment records are being kept under a legal-retention exception, with the reason. Tell the patient what you kept and why, and delete it when the period ends.

6. Children and families#

Many clinics see children. Under the Act, anyone under 18 is a child, and you need verifiable consent from a parent or lawful guardian before processing their data. At the front desk, that means the parent consents, and you keep a record of who did. Adolescent care can raise harder questions about confidentiality; take advice on those.

7. Breaches: have a plan on one page#

A breach does not have to be dramatic. A lost phone with the reception WhatsApp, a laptop with the patient Excel sheet, or a staff member sending reports to the wrong number all count.

The Rules ask you to tell the Data Protection Board and the affected people without delay, and to send the Board a detailed report within 72 hours of becoming aware. You will not manage that if you are working it out on the day. Write a one-page plan: who decides it is a breach, who contacts whom, and where the facts get written down.

Penalties under the Act can be large, up to ₹250 crore for some failures such as not taking reasonable security safeguards. The amount depends on the circumstances, and the Board considers things like how serious the breach was and what you did about it. The practical lesson is simple: reasonable security and a clear record of what you did both count.

8. Keep proof, not just good intentions#

If a patient says "I never agreed to WhatsApp messages", you need to show what they saw and what they chose. A spreadsheet row that anyone at the clinic could have edited is weak evidence.

This is the problem OptProof is built for. Each consent becomes a signed receipt the patient can keep, and anyone, including an auditor, can check it at verify.optproof.in without trusting us. When a patient withdraws, that change can reach your WhatsApp list and other tools automatically, so the next reminder does not go out.

A short checklist#

• List where patient data comes in and where it goes.
• Write one plain-language notice per clinic, in the languages your patients read.
• Replace pre-ticked paper boxes with a QR code or kiosk at reception.
• Make reminders and marketing separate, optional choices with neutral wording.
• Name one person for requests and give them due dates.
• Record legal-retention exceptions instead of deleting medical records.
• Write a one-page breach plan.

None of this needs a large team. It needs a clear owner, a few changed habits at the front desk, and records you can stand behind.