India's Digital Personal Data Protection Act (DPDPA) 2023 applies to every clinic and dialysis center that processes patient data — which is all of them. The obligations are significant: lawful consent for personal data, a 72-hour breach notification window to the Data Protection Board, and explicit consent for health data as a special category. This is the compliance map every healthcare facility needs.

Does DPDPA Apply to Your Clinic? Yes.

The DPDPA governs any entity processing the personal data of Indian citizens — with no turnover threshold for healthcare. Patient records, appointment lists, even employee health data all fall within scope. Health data is classified as sensitive personal data, requiring explicit (not implied) consent with a documented purpose, and the rules sit alongside the ABDM framework for digital health records — see the ABDM explainer for how the two interact.

The Three Compliance Pillars

(1) Consent: collect with a clear purpose, in a language the patient understands, with an easy withdrawal path. Healthcare consent is now a documented data-processing obligation, not just a formality — the consent form templates cover the data elements DPDPA expects. (2) Security: reasonable safeguards for patient data — encryption at rest and in transit, access controls, and audit trails. (3) Breach notification: notify the Data Protection Board within 72 hours of discovery, and affected individuals without undue delay.

Breach Notification: The 72-Hour Clock

The 72-hour notification window is the most operationally demanding obligation — it assumes you can detect a breach, assess impact, and file a notice within three days. That requires logging and monitoring: who accessed what, when, and why. Facilities without audit trails cannot meet this obligation, which is one reason compliance audits now inspect data governance as closely as clinical records.

The Practical Roadmap for 2026

For most clinics, the DPDPA roadmap is: (1) map every patient-data flow (registration, EMR, billing, WhatsApp, third-party labs), (2) review consent capture for each flow, (3) enable audit logging on every system holding patient data, (4) draft the breach response plan with a named Data Protection Officer, (5) document retention and deletion policies. The full checklist with DPDPA-DISHA mapping is in our healthcare data protection guide.

Key Takeaway

DPDPA compliance is not a legal exercise — it is a data-governance exercise. Consent, audit trails, and a 72-hour breach response plan are the three deliverables. Systems that log every access and encrypt patient data meet most of the obligation as a byproduct of good design.

The ZuvFlo Journal.

DPDPA 2023 for Clinics: What Changed and What's Due

The ZuvFlo
Journal.