Photo: Unsplash
The Digital Personal Data Protection Act has been law since 2023, but for two years there was nothing to actually do, because the Rules that make it operational had not been issued. That changed in November 2025. The Rules are notified, the Data Protection Board exists, and there is now a date on the calendar.
This is a plain-language summary, not legal advice. It is written for a practice owner trying to work out what to do on Monday morning. For anything consequential, read the official notification and take advice.
The Rules were notified in November 2025 with an eighteen-month phased transition. Broadly:
Eighteen months sounds generous. It is not, if the answer to "where is our patient consent recorded" is currently "on the registration form, somewhere in that cupboard".
Your clinic is a The DPDP Act's term for whoever decides why and how personal data is processed. In a clinic that is the practice itself, not the software it happens to use.. You decide why and how patient data is processed. Your patients are Data Principals. Your software vendor, your lab, and your accountant are typically Anyone who handles patient data on the clinic's behalf and on the clinic's instructions. A processor has its own security duties, but the duty owed to the patient remains the clinic's. acting on your instructions, which means the obligation to patients stays with you regardless of who is holding the file.
That last point is worth sitting with. Outsourcing the storage does not outsource the responsibility.
Not a line at the bottom of the registration form. The Rules expect a standalone, itemised notice in clear language that says what you are collecting, specifically what each item is for, and how the patient can withdraw consent or complain. "For clinic purposes" is not a purpose.
The consent to treat a patient and the consent to send them a recall message on WhatsApp are different things collected for different purposes. Bundling them is the most common mistake, and it is the one most likely to matter for a clinic, because recall messaging is the visible bit a patient can complain about.
Withdrawing consent has to be as easy as giving it. In practice: when a patient replies "stop", something in your system has to change so the next campaign does not include them. If the only record of that is a note in someone's head, you do not have a process.
Personal data is meant to be kept only as long as the purpose requires. Clinical records have their own retention obligations under medical record-keeping norms, which is a separate question from how long you keep a phone number for marketing. Write down a retention period for each, even a rough one, and know where the old paper registers are.
A patient can ask to access, correct, update or erase their personal data, and the Rules set an outer limit of 90 days to respond. Two practical questions follow. Could you produce everything you hold on one named patient? Could you correct a wrong date of birth everywhere it appears, including the backup?
A patient may nominate someone else to exercise these rights for them, which matters more in healthcare than in most sectors: elderly patients, patients who lose capacity, patients who die mid-treatment plan. You need a way to record a nominee and to honour one.
Processing a child's personal data requires verifiable consent from a parent or guardian. There are limited exemptions for essential purposes including healthcare, so treating a child is not the problem. Adding that child's number to a marketing list is a different matter entirely. Paediatric practices should look at this closely.
Individual staff logins rather than one shared password. Access limited to what a role actually needs. Encryption in transit. Backups. A record of who looked at what. Most clinics fail the first item on that list before reaching the interesting ones.
If patient data leaks, you must promptly inform the affected individuals in plain language, describing the nature of the breach and its likely consequences, and report it to the Data Protection Board, with reporting requirements framed around a 72-hour window. Decide now who makes that call, because you will not want to be designing the process while it is happening.
Patients need a published way to raise a complaint with you before they escalate to the Board. A named person and a working email address, on your website and on your notice.
Be sceptical of anything sold as "DPDP compliance in a box". Software can give you per-user logins, role-based access, records in one place instead of five, and a defined way to find and correct a patient's data. It cannot write your notice, decide your retention periods, or take responsibility for a decision you made.
Dentomate's own position on data handling is set out on the DPDP page and the security page, including what is built today and what is not.
If you do one thing this quarter, make it the second item on the checklist. Separating treatment consent from marketing consent is a change to a form, it takes an afternoon, and it is the obligation a patient is most likely to notice you failing.
Per-user logins, patient records you can actually find, and conversations that stay with the clinic. Free forever, no card required.
