What the DPDP Act means for a small clinic

You are a Data Fiduciary

The Act uses the term Data Fiduciary for whoever decides how personal data is used. A clinic deciding what to record about a patient is one, and there is no small-business exemption from the core duties.

The obligations are not onerous individually. Give notice of what you collect and why, before collecting it. Have a lawful basis, usually consent, which has to be specific and can be withdrawn. Keep data only as long as the purpose requires. Maintain reasonable security. Publish someone to contact about it, and answer when they do.

The first exercise is usually deletion

Write down everything you hold about a patient and why. Most clinics find at least two fields collected out of habit that are never used for anything: a full address where a phone number would do, a date of birth captured twice, an occupation nobody has ever looked at.

Data you do not hold cannot leak and does not have to be secured. Collecting less is the cheapest compliance measure available and almost nobody starts there.

Where clinics actually fall short

Not usually the notice or the consent form. It is two other things.

1. Everyone can see everything. Reception rarely needs clinical detail, and access that was never restricted is the most common real exposure in a small practice.
2. Reports and patient details travel over personal messaging accounts, on personal phones, and stay there indefinitely, including after somebody leaves.

Both are habits rather than systems, which is why buying software does not resolve them.

Three questions worth paying for advice on

Medical record retention periods, what may be disclosed to an insurer or a family member, and the position on minors. These are governed by professional and regulatory rules that sit alongside the DPDP Act, and they are specific to your kind of practice.

This guide is orientation. It is not legal advice and should not be the last thing you read before deciding any of the three.