The DPDP Act and your clinic: a practical reading

India's Digital Personal Data Protection Act, 2023 governs how organisations handle personal data. If you store patient names, phone numbers, clinical notes, X-rays or before-and-after photographs, it applies to you — and health data carries the highest sensitivity.

The five obligations that actually change what you do

1. Consent, recorded

You need a lawful basis to process patient data, and for most of what a clinic does that means consent — freely given, specific, informed, and recorded. "The patient came in, so they consented" is not a record.

In practice: capture consent at registration, record what it covers and when it was given, and separate the consent to be treated from the consent to be sent marketing. Those are different things and bundling them undermines both.

2. Purpose limitation

Data collected to treat a patient can be used to treat that patient. Using the same list to promote a new laser package is a different purpose and needs its own basis. This is the obligation most often breached casually — a WhatsApp broadcast to every patient who ever visited.

3. The right to access and correction

A patient can ask what you hold about them and ask you to correct it. You need to be able to answer within a reasonable time, which in practice means being able to produce one patient's complete record — visits, notes, files, invoices — without a manual search.

4. Erasure

A patient can ask you to delete their data, subject to retention you are otherwise required to keep. This is genuinely difficult if records live in three WhatsApp accounts and a phone gallery, and straightforward if they live in one system with a deletion path.

5. Breach notification

If patient data is exposed, you are expected to report it. Which means you need to be able to tell that it happened — and that is an argument for systems that log access rather than shared logins where everyone is "the clinic".

Three habits that create most of the exposure

• Clinical photographs in personal phone galleries, backed up to somebody's personal cloud account.
• A single shared login, so no action can be attributed to a person.
• Patient lists exported to spreadsheets and emailed, which then live in an inbox forever.

Each is a habit, not a technology gap, and each is fixable this month without buying anything.

Questions for any software vendor

1. Where is patient data physically stored? For Indian health data, in-country storage is the sensible default.
2. Can I export a single patient's complete record on request?
3. Can I delete a patient's data, and what exactly happens to the clinical history when I do?
4. Is consent recorded as data, with what was agreed and when?
5. Who at your company can see my patients' records, and is that access logged?

On the last one: support staff occasionally need to see a practice's data to help. The question is whether that access is logged and attributable. GullyMed stores everything in India, records consent per patient, supports export and erasure, and makes every support impersonation fully audit-logged — you can see who looked and when.