The DPDP Act for therapists and clinics: a practical checklist

The Act was passed in August 2023. The DPDP Rules, 2025 were notified in November 2025 and bring the Act into force in stages. The obligations that matter most to a practice (notices, consent, security safeguards, breach reporting and clients’ rights) apply 18 months after notification, from May 2027. That is the deadline to be ready by, but most of the steps below are good practice today.

Under the Act, whoever decides why and how personal data is processed is the Data Fiduciary. For your clients’ records, that is you (a solo practitioner) or your clinic. Your software vendor, cloud provider and SMS provider are Data Processors: they process data on your behalf, under your instructions.

That means the responsibility stays with you even when a vendor holds the data. You need a written contract with each processor, and you should choose vendors who can show how they protect data.

Give a clear notice and get consent

Before collecting a client’s data, tell them in clear, plain language what you collect, why, and how they can withdraw consent or complain. The notice should be available in English or any language in the Eighth Schedule of the Constitution if the client asks. Consent must be free, specific and unambiguous, and withdrawing it must be as easy as giving it.

Collect only what you need

Use data only for the purpose you told the client about. If you want to record or transcribe sessions, use data for research or share it with anyone outside the care team, that is a separate purpose and needs its own consent. Saying no must never stop the client from getting care.

Keep it secure

The Rules expect reasonable security safeguards, including encryption or similar measures, access control, logs of who accessed data (kept for at least a year), backups, and contracts that require your processors to do the same.

Report breaches

If client data is leaked, lost or accessed without permission, inform the affected clients and the Data Protection Board without delay, and send the Board a detailed report within 72 hours.

Respect clients’ rights

Clients can ask what data you hold, ask for corrections and ask you to erase data you no longer need. Publish a contact (such as a Grievance Officer email) who will respond.

Children’s data

For anyone under 18, the Act requires verifiable consent from a parent or guardian. The Rules exempt healthcare professionals and clinical and mental health establishments from parts of this when the processing is needed to provide health services, but involving a parent or guardian remains the norm in practice. Check the exemption for your situation.

The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to report a breach or for breaching the obligations on children’s data. The amount depends on the seriousness of the breach and the size of the organisation, but the message is clear: security is not optional.

The DPDP Act doesn’t replace the confidentiality you already owe clients. The Mental Healthcare Act, 2017 gives people with mental illness a right to confidentiality of their information and to access their records, and your professional code (RCI, NMC or your association) sets record-keeping duties. Where they ask for more, follow the stricter rule.

1. List what client data you collect, where it is stored (software, WhatsApp, email, paper, phone) and who can see it.
2. Move clinical notes out of WhatsApp chats, personal email and personal laptops into one access-controlled system.
3. Write a short privacy notice for clients and put it on your booking page and intake form.
4. Ask for separate consent before recording or transcribing sessions, and make "no" easy.
5. Limit who can read clinical notes: reception and billing staff don’t need them.
6. Turn on two-step login, and make sure every view of a record is logged.
7. Sign a data processing agreement with each vendor; ask where data is stored.
8. Set how long you keep records and what happens when a client leaves.
9. Name a person who handles data requests and complaints, and publish their contact.
10. Write down what you will do in a breach, including who tells clients and the Board.

MindConnect acts as your data processor. Reception staff never see clinical notes, and notes can be limited to the client’s care team. Messages between patients and the clinic, check-in notes and homework answers are stored encrypted with a key for each clinic. Logins use a one-time code, record views can be logged and exported for a client’s request, and nothing is hard-deleted. Patients choose for themselves whether a session is transcribed, can change their mind, and saying no never blocks the session. Files are stored in AWS Mumbai. Our Privacy Notice lists every processor we use.