--- title: DPDP Act Compliance url: https://curaverto.com/dpdp updated: 2026-11-01 source: first-party vendor documentation --- # India's DPDP Act 2023: What Every Clinic Must Know The Digital Personal Data Protection (DPDP) Act 2023 is India's first comprehensive data privacy law. It was passed in August 2023 and establishes mandatory obligations for how clinics and hospitals collect, store, use, share, and delete patient data. Enforcement rules were notified in 2024–25. The Data Protection Board of India becomes fully empowered to investigate clinics and levy fines from 13 May 2027. Under the Act, patients are Data Principals with legal rights over their data. A clinic is a Data Fiduciary, legally responsible for protecting that data. There is no opt-out and no minimum size threshold — a solo GP practice carries the same obligations as a 500-bed hospital. Health data is classified as Sensitive Personal Data, the highest protection tier under the Act. ## Penalties Penalties are set out in Schedule I of the Act and apply per incident, not per year: | Violation | Maximum fine | | --- | --- | | Failure to implement reasonable security safeguards (unencrypted records, inadequate access control, insecure third-party integrations) | ₹250 crore | | Failure to notify the Data Protection Board and affected patients within 72 hours of a confirmed breach | ₹200 crore | | Processing a minor's data without verified parental consent or required protections (§9) | ₹200 crore | | Failure to respond to a patient rights request (access, correction, erasure) within the prescribed timeline | ₹10,000 per patient | ## Who is in scope Any clinic that collects patient data digitally is in scope, including through an EMR, billing software, or WhatsApp. This covers general practice/OPD, dental clinics, IVF and fertility clinics, multi-specialty hospitals, diagnostic centres, teleconsultation platforms, physiotherapy clinics, pharmacy chains, and Ayurveda and wellness clinics. Exemptions exist only for personal use, certain government processing, and pre-digitisation records. ## Seven obligations 1. **Written notice before any data collection.** Patients must receive a plain-language notice specifying what data is collected, why, and for how long, before collection. A general "I agree to terms" checkbox does not satisfy this. 2. **Purpose-specific, granular consent.** Separate consent is required for each distinct use — treatment, referrals, and marketing each need their own consent. A single blanket consent form covering all uses does not satisfy the Act. 3. **Patient access within 48 hours.** Any patient can request a copy of all personal data a clinic holds on them, and the clinic must produce it within 48 hours, backed by a documented process. 4. **Data deletion on request.** Patients can request erasure once the treatment relationship ends. Clinical records must be retained for 3 years under MCI guidelines; other data (contact details, billing history, communications) must be deletable on request. 5. **Written data retention and deletion policy.** A documented policy must specify retention periods per data type, and data must be deleted once it has served its purpose rather than archived indefinitely. 6. **Data Processing Agreements with every third party.** Every lab, pharmacy, insurer, and software vendor receiving patient data must have a signed Data Processing Agreement; the clinic remains liable for how that third party handles the data. 7. **72-hour breach notification capability.** A clinic must be able to notify the Data Protection Board within 72 hours of a data breach, which requires a written incident response plan in place before any breach occurs. ## Enforcement timeline The Act is already in force. The Data Protection Board of India's power to investigate clinics and levy fines under it begins **13 May 2027**. ## Frequently asked questions **What is the DPDP Act 2023?** India's first comprehensive data privacy law, passed in August 2023, giving individuals legal rights over their personal data and making any organisation that handles it — including every clinic — a legally accountable Data Fiduciary. **Does it apply to small clinics and individual doctors?** Yes. There is no minimum-size threshold; a solo GP practice carries the same core obligations as a 500-bed hospital. **What are the penalties for a clinic?** Up to ₹250 crore for failing to maintain reasonable security safeguards, and up to ₹200 crore each for failing to notify a breach or failing to protect children's data. Penalties apply per incident. **When does enforcement begin?** 13 May 2027, when the Data Protection Board of India gains the power to investigate and levy fines. **Is patient health data covered?** Yes. Any digital personal data of a patient — name, phone number, diagnosis, prescription, or billing record — is covered, and health information is expected to draw close regulatory scrutiny. **What does a clinic need to do to comply?** Give patients a plain-language notice before collecting data, obtain purpose-specific consent, honour access and erasure requests, sign Data Processing Agreements with every vendor, keep a written retention policy, and be able to report a breach within 72 hours. **What is a Data Fiduciary?** Any person or organisation that decides why and how personal data is processed. A clinic becomes one the moment it collects patient data. **Is consent needed to store medical records?** Yes, with limits — separate consent per purpose, though clinical records required to be retained under medical-council guidelines may be kept for the mandated period regardless. **How can a clinic check its readiness?** CuraVerto offers a free DPDP Readiness Check: 14 clinic-specific questions producing a personalised report and prioritised action list in about five minutes, with no login required. --- Canonical: https://curaverto.com/dpdp Contact: sales@curaverto.com This document is CuraVerto's own description of its product.