The Digital Personal Data Protection Act 2023 is in force. Enforcement and fines begin 13 May 2027. Most clinics have not taken a single compliance step.
Read what it means for your practiceThe Digital Personal Data Protection Act 2023 was passed in August 2023 and establishes the first comprehensive legal framework for data privacy in India. For clinics and healthcare providers, it creates mandatory obligations around how patient data is collected, stored, used, shared, and deleted.
Under the Act, your patients become Data Principals (they have legal rights over their data). Your clinic becomes a Data Fiduciary (you are legally responsible for protecting it). There is no opt-out and no minimum size threshold. A solo GP practice has the same obligations as a 500-bed hospital.
The Data Protection Board of India will have the power to levy these fines from the date of enforcement. They apply per incident, not per year.
Failure to implement reasonable security safeguards, including inadequate access controls, unencrypted patient records, or insecure third-party integrations.
Failure to notify the Data Protection Board and affected patients within 72 hours of a confirmed data breach.
Processing data of patients under 18 without verified parental consent, or without the heightened protections required under §9.
Failure to respond to a patient's rights request (access, correction, or erasure) within the prescribed timeline.
Exemptions exist only for personal use, certain government processing, and pre-digitisation records. A clinic that uses any software (EMR, billing, WhatsApp) is within scope.
These are legal obligations, not best-practice suggestions. Each gap is an independent ground for a fine.
Before you collect a patient's name, phone number, or health information, you must give them a written notice specifying exactly what data you are collecting, why, and for how long. The notice must be in plain language. A form saying "I agree to terms" is not sufficient.
You must get separate consent for each distinct use of patient data. Consent for treatment does not cover referrals. Consent for referrals does not cover marketing. A single blanket consent form covering all uses violates the Act.
Any patient can formally request a copy of all personal data you hold on them. You must produce it within 48 hours. You need a documented process, not just the intention to comply, because you will need to prove it in the event of an audit.
Patients have the right to request erasure of their data once your treatment relationship ends. Clinical records must be retained for 3 years under MCI guidelines; all other data (contact details, billing history, communications) must be deletable on request.
You must have a documented policy specifying retention periods for each type of patient data. When data has served its purpose, it must be deleted, not archived indefinitely. "We never delete anything" is a compliance failure.
Every lab, pharmacy, insurance company, and software vendor that receives patient data from you must sign a Data Processing Agreement. You remain liable for how they handle the data you share. "We trust them" is not a legal defence.
If you experience a data breach (leaked patient records, hacked EMR, lost device), you must notify the Data Protection Board within 72 hours. This requires a written incident response plan in place before the breach happens, not after.
Plain-language answers to the questions doctors and practice managers ask most about the Digital Personal Data Protection Act 2023.
On 13 May 2027, the Data Protection Board of India becomes fully empowered to investigate clinics, levy fines, and order remediation. Clinics that act now have adequate time. Clinics that wait until notices arrive do not.
Check your clinic's readiness in 5 minutes →