This guide is general information, not legal or tax advice. It summarises the Act and Rules as published by MeitY. Penalties are severe and the Rules may be amended, so confirm anything that matters with a lawyer.
Where the law stands in November 2026
Parliament passed the Digital Personal Data Protection Act, 2023. The government notified the DPDP Rules, 2025 in November 2025; the Press Information Bureau puts the date at 14 November 2025, though some other sources say 13 November.
Rule 1 of the Rules sets a phased start. Rules 1, 2 and 17 to 21 came into force on publication, Rule 4 (consent managers) one year after, and Rules 3, 5 to 16, 22 and 23 eighteen months after. Rule 3 covers notice and Rules 6 to 8 cover security, breaches and erasure, so the main operational duties for a clinic begin around May 2027 on that schedule.
In early 2026 the government reportedly floated shortening the 18 months for some obligations. We could not find a notified amendment, so the 18-month schedule is what we have verified. Check MeitY’s website before relying on any date. Building good habits now costs little and avoids a scramble later.
What counts as personal data in a clinic
The Act covers digital personal data, and non-digital data that is later digitised. In a dental clinic that includes names, phone numbers, addresses, medical alerts, treatment history, photos, X-rays, prescriptions and payment records held in software, spreadsheets, WhatsApp chats or a phone gallery. Your clinic is a “Data Fiduciary” because you decide why and how the data is used. The patient is the “Data Principal”.
Notice and consent
The Act (section 5 and section 6) expects you to tell a patient what personal data you collect and why, and to obtain consent in clear language. Section 7(a) also allows processing for the specific purpose for which the patient voluntarily gave you the data, as long as they have not said they do not consent. Booking an appointment and keeping the treatment record is that kind of purpose.
Anything beyond the purpose needs consent of its own. Sending promotional messages, using a patient’s before-and-after photo on social media, or sharing details with a marketing agency are separate purposes. Keep these consents separate from the treatment consent, and record who agreed and when. Under section 6(10), if consent is the basis, you may have to prove that notice was given and consent obtained.
Children and paediatric patients
The Act defines a child as anyone under 18. Section 9 normally requires verifiable consent of a parent or guardian before processing a child’s data. The Fourth Schedule of the Rules excludes a clinical establishment or healthcare professional from parts of that rule when processing is restricted to providing health services to the child, to the extent necessary to protect the child’s health. The exemption is narrow. Using a child’s photos for marketing is not covered.
In practice, record the parent or guardian as the contact for every minor, take their consent for anything beyond treatment, and keep the child’s records separate from marketing lists.
Security safeguards and breaches
Rule 6 requires “reasonable security safeguards”. At the minimum this includes encryption, masking or tokens, access control, logs and monitoring to detect unauthorised access, backups so you can keep working after loss, and appropriate clauses in contracts with software vendors. It also asks you to retain relevant logs for one year.
Rule 7 covers breaches. You must tell each affected patient, in plain language and without delay, what happened, the likely consequences, what you are doing and who to contact. You must also inform the Data Protection Board without delay, and give fuller details within 72 hours of becoming aware of the breach, unless the Board allows longer. The Act lists penalties of up to ₹250 crore for failing to maintain reasonable safeguards and up to ₹200 crore for failing to report a breach. These are maximums for the worst cases, but they show how seriously the law treats this.
Patient rights and your contact person
Patients may ask for a summary of the data you hold, correction of wrong data, erasure when it is no longer needed, and a grievance channel. They can also nominate someone to act for them. Rule 9 requires you to publish contact details of a person who can answer questions about their data, and the PIB summary notes a maximum of ninety days to deal with requests.
Erasure does not override other laws. Medical-record retention duties for dentists are separate, so see our guide on how long to keep dental records.
A checklist for a small clinic
- Make a list of where patient data lives: software, registers, phones, WhatsApp, email, lab shares.
- Write a one-page privacy notice and display it at the front desk and on your website or booking page.
- Name one person, usually the owner or manager, as the contact for data questions.
- Give every staff member a personal login. Stop sharing one password.
- Turn on a screen lock on every phone and computer that holds patient data.
- Take separate consent for marketing messages and photo use. Never assume it.
- Record a parent or guardian for each minor.
- Prepare a short breach plan: who decides, who calls patients, how to reach your software vendor.
- Ask your software provider where data is stored and how it is protected. See data security.
- Review everything once a year.