The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's law governing how personal data is collected, processed and protected when handled digitally. It applies to any organisation that determines the purpose and means of processing personal data — called a Data Fiduciary — including clinics that keep patient records digitally.
Under the Act, a patient is a Data Principal with rights to access, correct and request erasure of their data. A clinic, as Data Fiduciary, must obtain valid consent, keep data only as long as needed, secure it appropriately, and report a data breach within the required timeline. The Act's rules are phased in through 2027, with penalties for non-compliance structured in crores of rupees.
For a clinic, DPDP readiness is mostly operational: consent capture, role-based access, an audit trail, and a clear retention policy — all of which Saaro Health builds into the product rather than leaving as a separate compliance exercise. See our DPDP compliance page and checklist for the practical detail.