Why Every Indian Doctor Needs to Know the DPDP Act Right Now India's Digital Personal Data Protection (DPDP) Act 2023 came into force and is now being actively enforced. If you run a clinic, hospital, or diagnostic centre — you are a Data Fiduciary under this law. That means you are legally responsible for how you collect, store, use, and protect your patients' personal data. This is not optional. Penalties for non-compliance can reach ₹250 crore per breach. Every Indian doctor practicing in 2026 needs a practical roadmap. What Is the DPDP Act 2023? The Digital Personal Data Protection Act 2023 is India's first comprehensive data privacy legislation. It governs how organisations — including healthcare providers — handle the personal data of Indian citizens. Personal data in a clinic context includes: patient name, phone number, address, medical history, diagnosis, prescriptions, lab reports, imaging, ABHA ID, and payment information. Under the DPDP Act, your clinic is a Data Fiduciary and your patients are Data Principals. Your responsibilities are defined and enforceable. 5 Core Obligations for Indian Clinics Under the DPDP Act 1. Obtain Valid Consent Before Collecting Patient Data You must get clear, informed, and specific consent from patients before collecting or processing their personal data. Consent must be: written in plain language the patient understands, specific to the purpose (e.g., 'to manage your treatment at this clinic'), freely given (not bundled into fine print), and revocable at any time by the patient. Verbal consent is insufficient. You need documented consent — a signed form or a digital acknowledgement in your clinic software. 2. Use Data Only for the Stated Purpose You cannot use a patient's contact number (collected for appointment reminders) to send them promotional messages for a new service. Every use of patient data must stay within the purpose for which consent was given. This is called Purpose Limitation and it is strictly enforced. 3. Implement Data Security Safeguards Clinics must implement 'reasonable security safeguards' to prevent data breaches. This means: encrypted patient record storage, role-based access (not every staff member can view all records), regular backups, secure WhatsApp or messaging practices (no sending patient data over personal devices), and secure cloud storage or on-premise servers with access controls. 4. Honour Patient Rights (Data Principals' Rights) Under the DPDP Act, your patients now have legal rights over their data. They can: access a summary of their personal data you hold, correct inaccurate data, erase their data (right to erasure) where applicable, and nominate someone to exercise these rights on their behalf. You must have a process to respond to such requests within a reasonable timeframe. Ignoring patient data requests is a compliance violation. 5. Report Data Breaches to the Data Protection Board If a data breach occurs at your clinic — someone hacks your system, a laptop is stolen, an unauthorised staff member shares patient records — you must notify the Data Protection Board of India and affected patients promptly. Delaying or concealing a breach is a serious offence under the Act. DPDP Act and ABDM Integration: What Changes? If your clinic uses ABDM (Ayushman Bharat Digital Mission) for linking patient records through ABHA IDs, DPDP compliance is already partially built in — but not entirely. ABDM enforces consent-based health record sharing and uses Health Information Exchanges (HIEs). However, DPDP adds additional obligations around data retention timelines, purpose limitation, and breach reporting that ABDM alone does not cover. Clinics integrated with ABDM-compliant software are a step ahead — but must still implement their own consent management, staff training, and breach reporting protocols. Frequently Asked Questions: DPDP Act for Indian Doctors Q: Does the DPDP Act apply to small clinics and solo practitioners? A: Yes. The DPDP Act applies to any entity that processes digital personal data in India, regardless of size. A solo GP with a digital patient register is covered. The obligations scale to size, but non-compliance is not excused by being a small practice. Q: Can I use patient phone numbers to send health tips via WhatsApp? A: Only if you collected explicit consent for this specific purpose. You cannot use data collected for appointment management to send unsolicited health education messages. Get a separate consent for marketing communications. Q: How long can I retain patient records under DPDP? A: Personal data must not be retained beyond what is needed for the stated purpose. For medical records, the NMC and state regulations recommend a minimum retention of 3 years (longer for surgical/specialised cases). Once the purpose is fulfilled and legal minimums met, data should be deleted or anonymised. Q: What are the penalties for non-compliance? A: Financial penalties under the DPDP Act can reach up to ₹250 crore for significant violations (failure to implement security safeguards, non-reporting of breaches). For lesser violations, penalties range from ₹2 crore to ₹50 crore. Reputational damage and loss of patient trust are additional risks that cannot be quantified. Q: What is the 'Data Protection Officer' requirement under DPDP? A: Significant Data Fiduciaries (those processing large volumes of sensitive data) must appoint a Data Protection Officer resident in India. Most small-to-mid clinics may not meet the threshold for this obligation, but as rules evolve, it is prudent to designate an internal data point-of-contact even if not legally required. How Doctrust Helps Your Clinic Stay DPDP Compliant Doctrust is built specifically for Indian clinic compliance. It provides ABDM-aligned patient record management with structured consent workflows, role-based access controls so only authorised staff view sensitive patient data, encrypted cloud storage with regular automated backups, and audit trails for every data access event — exactly what the DPDP Act demands. Instead of building compliance systems from scratch, Doctrust gives Indian doctors a ready-made compliant infrastructure. Book a free demo at www.doctrust.in and see how your clinic can be DPDP-ready in days, not months.