DPDP Act 2023 Compliance Guide for Dental Clinics in India
The Digital Personal Data Protection Act 2023 (DPDP Act) is now India's primary law governing how businesses collect, store, and use personal data. Dental clinics handle some of the most sensitive data that exists: names, phone numbers, medical history, X-rays, and WhatsApp conversations about treatment. If you have not reviewed your data practices since the Act came into force, this is the right time.
What the DPDP Act means for a dental clinic
Under the Act, your clinic is a Data Fiduciary and every patient is a Data Principal. As a Data Fiduciary, you must collect data only for clearly stated purposes, get valid consent, protect the data with reasonable security, and allow patients to access, correct, or delete their information.
This applies whether the data sits in a physical file, a clinic management software, a WhatsApp chat, or a Google Drive folder of X-ray images.
What counts as personal data in your clinic
- Patient name, phone number, and address collected during booking
- Medical and dental history, treatment notes, prescriptions
- X-rays, intraoral photos, and scans, since these can identify a person combined with other records
- WhatsApp chats containing appointment requests, payment discussions, or treatment questions
- Billing and insurance details
Consent: the foundation of compliance
You need clear, informed consent before collecting patient data, not a vague signature buried in an intake form. Practically, this means:
- A short notice at the front desk or on your booking form stating what data you collect and why (appointment scheduling, treatment records, follow-up reminders)
- A separate, clearly worded line if you plan to use patient contact numbers for marketing or promotional WhatsApp messages
- A record of when and how consent was given, even a simple checkbox log in your booking system counts
Consent for treatment records is generally implied by the doctor-patient relationship, but consent for marketing communication is not. Keep these two purposes separate in your paperwork.
WhatsApp-specific practices
Most Indian clinics run patient communication through WhatsApp because that is where patients already are. To stay compliant:
- Use WhatsApp Business, not a personal number shared by multiple staff
- Set a screen lock and app lock on the device used for clinic WhatsApp
- Avoid forwarding X-rays or patient chats to personal numbers of doctors or staff for "quick opinions"
- Delete chat backups from personal Google Drive or iCloud accounts that are not clinic-controlled
Storing X-rays and clinical images safely
X-rays are high-risk data because they are permanent, identifiable, and often shared between the front desk, the dentist, and sometimes a lab or referring specialist.
- Store images in a system with access control, not an open shared folder
- Restrict lab or specialist sharing to encrypted transfer, not casual WhatsApp forwarding
- Keep a log of who accessed or exported a patient's imaging file
Retention and deletion
The DPDP Act expects you to delete personal data once its purpose is served, unless another law requires retention. For dental clinics, the Dentists Act and general medical record-keeping norms typically require retaining clinical records for a minimum period, often cited around 3 years for routine records, longer for medico-legal cases. Set a clinic policy: how long you keep X-rays, chat logs, and billing data, and who is responsible for periodic deletion.
Penalties: what non-compliance can cost
| Violation | Potential penalty (as per the Act) |
|---|---|
| Failure to implement reasonable security safeguards | Up to Rs 250 crore |
| Failure to notify a data breach | Up to Rs 200 crore |
| Failure to fulfil obligations for children's data | Up to Rs 200 crore |
| General non-compliance with Data Principal rights | Up to Rs 50 crore |
These are ceiling figures set for serious corporate violations, but they show the direction of enforcement. Even a modest clinic-level breach investigation can be costly in time, legal fees, and reputation.
A practical 30-day compliance checklist
- Write a one-page data notice for patients and display it at reception
- Separate consent for treatment records versus marketing messages
- Move clinic WhatsApp to Business app with app lock enabled
- Restrict X-ray folder access to authorized staff only
- Set a written retention and deletion schedule
- Appoint one staff member as the point of contact for data requests
Compliance is not a one-time project. Review your data practices every few months, especially as you add new software, staff, or communication channels.
See what Klyient can do for your clinic
Marketing across Meta, Google and your website. AI answering every enquiry. Your whole clinic on one app.
Frequently asked questions
Does the DPDP Act apply to small single-doctor clinics too?
Yes. The Act applies to anyone processing digital personal data of Indian residents, regardless of clinic size. There is no exemption for small practices, though enforcement in year one is likely to focus on larger, repeat, or reported violations.
Do we need separate consent for WhatsApp and for X-rays?
You need consent for the purpose of processing, not for each channel. One clear consent notice covering appointment data, treatment records, and imaging is enough if it lists all purposes. But if you later use the same data for marketing, that needs fresh, specific consent.
Can we still use free WhatsApp Business app to message patients?
Yes, WhatsApp itself is not banned. The obligation is on your clinic to secure the device, control access, and not export chat data to unsecured third parties. Using WhatsApp Business API through a compliant vendor is safer for growing clinics.
What happens if a patient asks us to delete their data?
Under the DPDP Act, patients (Data Principals) can request correction or erasure of their data. You must comply unless you have a legal reason to retain it, such as the Dentists Act or income tax record-keeping rules, which typically require retaining clinical records for a minimum period.