Condensed from the full guide: DPDP Act for clinics: what doctors need to do.
Last updated October 2026, based on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 — see sources below.
Know your data
Collect with clarity
Control access
Secure it
Plan for a bad day
Handle requests and deletion
Patient data to review
Review your vendors
Sources and further reading
- The Digital Personal Data Protection Act, 2023 — the Act's full text, published by the Ministry of Electronics and Information Technology.
- DPDP Rules, 2025 — Notified — the government's own notice on the Rules, including the phased timeline and penalty figures behind our full guide.
Requirements and official guidance can change. Verify current rules before relying on this page, and see the full detail behind each item in DPDP Act for clinics: what doctors need to do.
Frequently asked questions
Is completing this checklist enough to be DPDP compliant?
No. This checklist is a practical starting point, not a certification of compliance. Whether a clinic meets its obligations depends on exactly how it collects, uses, stores, shares and protects personal data, and that is a legal assessment, not a checkbox exercise. Get professional legal advice for your specific situation.
Does "do not keep data indefinitely" mean I should delete medical records on request?
No. Medical records often carry their own professional and regulatory retention requirements that sit alongside the DPDP Act. The point of that checklist item is to have a defined, documented retention period for each type of data, not to delete records the moment someone asks.
Where is my progress saved?
In your browser only, using local storage. It is not sent to us and will not appear if you open the page on a different device.
Does this apply to a one-doctor clinic?
Yes. The DPDP Act has no small-clinic exemption; any clinic that decides why and how it uses patient data is covered.
See Medabha in your own clinic
AI medical scribe, WhatsApp prescriptions, specialty charts and a built-in clinic website. Book a 15-minute walkthrough.
Book a demoThis is a general educational checklist, not legal advice or a certification of compliance, and your progress is saved only in your browser on this device. Ask a lawyer about anything specific to your clinic, especially exemptions and reporting a breach to the Data Protection Board. Checklist last updated October 2026, based on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 — verify current requirements before relying on it.