DPDP Act for Clinics, Hospitals & Diagnostic Labs

Last updated: 26 October 2026

Clinics, diagnostic labs and small hospitals hold some of the most personal data there is: diagnoses, test results, prescriptions, phone numbers and addresses. Under India’s DPDP Act, 2023 and the DPDP Rules, 2025, protecting that data becomes a legal duty, with most obligations applying from 13 May 2027.

Why clinics are a target

The DPDP Act doesn’t create a separate “sensitive data” class, but a leak of health records causes the most harm to patients and draws the most attention. Attackers know clinics often run on old software, shared passwords and unprotected websites.

Where patient data leaks in a typical clinic

• Appointment and enquiry forms on the website, sometimes sending data without encryption.
• WhatsApp: reports and prescriptions sent from a personal phone with no lock, shared by several staff.
• Lab and billing software with one shared login and no record of who viewed what.
• Email: no SPF or DMARC, so criminals can send fake “reports” or payment requests from your exact address.
• Old staff accounts that were never closed.

What the DPDP Act expects from you

1. Notice at the point of collection. Tell patients what you collect and why: at your website forms, on registration forms and at the front desk.
2. Valid consent where you rely on it, for example for follow-up marketing or health camp messages, and an easy way to withdraw. Care for a patient is a different situation from marketing to them, so don’t mix the two.
3. Reasonable security safeguards: encryption, access control, logs and backups for systems holding patient data.
4. Breach reporting. Tell affected patients and the Data Protection Board without delay, with a detailed report to the Board within 72 hours.
5. Answer patient requests to access, correct or erase data, subject to medical record retention rules that apply to you.
6. Contracts with vendors such as your lab software, website developer and hosting, covering security and breach notice.

The Rules give limited relief to healthcare providers for certain children’s-data duties when the purpose is treatment or care. Check whether this applies to you.

Clinic DPDP checklist

• ☐ Website runs fully on HTTPS, and forms send data securely
• ☐ Privacy notice linked at every form and displayed at reception
• ☐ Separate login for each staff member in lab and billing software
• ☐ Two-factor login on email and admin accounts
• ☐ Reports shared through a secure link or portal, not personal WhatsApp
• ☐ SPF and DMARC set up for your email domain
• ☐ Encrypted, tested backups
• ☐ A named person to handle patient data requests
• ☐ A one-page 72-hour breach plan

Start with your website

Your website is the one part of your clinic anyone in the world can inspect. Our free DPDP Security Check shows your grade and top issues in 30 seconds, and it’s completely passive and safe.