The Digital Personal Data Protection (DPDP) Act applies to every clinic that stores patient data digitally — which today means almost every clinic, even ones still using a mix of paper and WhatsApp. You don't need a legal team to get the basics right. Here's a practical checklist.
1. Know what counts as personal data
Patient name, phone number, address, and any health information (diagnosis, prescriptions, treatment notes) all count. Under the DPDP Act, health data is treated with extra care because it can reveal sensitive details about a person's life.
2. Get clear consent, and keep a record of it
- Tell patients what data you're collecting and why, in plain language
- Keep a timestamped record that consent was given, not just a verbal "okay"
- Make it easy for a patient to ask what data you hold on them
3. Don't collect more than you need
A common mistake is asking for information "just in case" — Aadhaar numbers, full family history, income details. If it doesn't serve the patient's treatment or your billing, don't store it.
4. Know where your data physically lives
Ask any software vendor where servers are hosted and whether data leaves India. Data hosted within India, on infrastructure that doesn't hand records to unrelated third parties, is the safest default for a clinic.
5. Put a real access barrier in front of records
A shared login with no PIN or password rotation is the most common way clinic data leaks — not hacking, just an unlocked front desk computer. A PIN lock on every login and role-based access (so a receptionist can't see everything a doctor can) go a long way.
6. Have a plan for deletion requests
Patients can ask you to delete their data. Know how you'd actually do that in your software before someone asks — retrofitting it under pressure is how mistakes happen.
None of this requires expensive compliance software. It requires picking tools that were built with these defaults already in place, and being deliberate about what you collect and who can see it. Moving off paper is part of that — see how digital prescriptions change record-keeping in practice.
