DPDP Act compliance for clinics: a practical checklist for doctors
2026-09-18 · MedSlay
India's Digital Personal Data Protection (DPDP) Act applies to clinics of every size: patient records are personal data, health information is sensitive, and the clinic that collects it is responsible for how it is used. This is a practical orientation for doctors — not legal advice; for your specific obligations, consult a professional.
What the Act calls you
Two terms do most of the work. Your patient is the Data Principal — the person the data is about. Your clinic is the Data Fiduciary — the one who decides why and how it gets processed. That word is deliberate: a fiduciary holds something on someone else's behalf, and the obligations follow from that rather than from ownership.
Your software vendor is generally a Data Processor, acting on your instructions. This matters more than it sounds: outsourcing the system does not outsource the responsibility. If a vendor mishandles your patients' data, your clinic is still the fiduciary that owes those patients an answer.
The ideas that matter day-to-day
- Consent and notice. Patients should know what data you collect and why, and agree to it. Consent should be specific — voice-assisted consultation, WhatsApp communication and record sharing are separate choices, not one blanket tick-box.
- Purpose limitation. Data collected for treatment is used for treatment. Using it for anything else — marketing, research, a case study — needs its own basis.
- Data minimisation. Collect what the care requires. A field you never use is a field you still have to protect and eventually account for.
- Patient rights. Patients can ask what you hold about them, ask for corrections, and withdraw consent. Your processes — and your software — need to make that possible rather than theoretical.
- Security. Reasonable safeguards are expected: access control so staff see only what their role needs, encryption of sensitive data, and audit trails of who did what.
Two cases clinics get wrong
Children. Processing a child's data requires verifiable consent from a parent or guardian, and tracking behaviour or targeting advertising at children is not permitted. Any paediatric practice, and any clinic that sees families, needs a registration flow that captures who consented on the child's behalf — not a note in the margin.
Withdrawal. Consent that cannot be taken back was never really consent. If a patient agrees to WhatsApp updates in January and asks you to stop in June, stopping must be as easy as starting was, and the record should show when it changed and who changed it.
A short checklist for your clinic
- Map what patient data you collect, where it lives, and who can see it.
- Take granular, recorded consent at registration — and let patients revoke each consent independently later.
- Give every staff member their own login with role-based access; shared passwords make audit trails meaningless.
- Prefer software that encrypts sensitive fields and logs activity.
- Decide how long you keep records, and write the answer down rather than defaulting to forever.
- Have an answer ready for "please share / correct / delete my records", and a named person who handles it.
- Know what you would do in the first twenty-four hours of a breach, before you need to know.
Retention and breaches
Two obligations catch clinics out because neither is visible day to day.
Personal data should not be kept indefinitely once the purpose it was collected for has ended — though medical records carry their own retention expectations, which is exactly why the question deserves a deliberate answer rather than a default. And a personal data breach has to be reported: to the Data Protection Board and to the affected patients. Reporting is far easier when access is logged, because you can say what was actually reached rather than guessing at the worst case.
Where software helps
Most of this list is workflow, and workflow is what practice-management software is for. MedSlay is built to be DPDP compliant: granular, independently revocable patient consents at booking, role-based access for doctors and assistants, encrypted sensitive data, activity logs, and — by design — no storage of consultation audio or video at all, so the most sensitive material in a consultation never sits at rest anywhere.
ABHA/ABDM compliance is in progress, not complete, and we would rather say so plainly; see what ABDM asks of a private clinic for how the two relate. If compliance is shaping your choice of system, the questions in choosing practice management software are the ones worth putting to any vendor.