Photo: Jacob Woitzel, U.S. Navy, public domain, via Wikimedia Commons.
Most dental registration forms end with one sentence: "I consent to the clinic using my information for treatment and other purposes." From 13 May 2027, that sentence will not meet the DPDP Rules. The Rules ask for a notice that stands on its own, lists what you collect, and says what each item is for.
This article covers that notice for the core of a visit: treatment, billing and the clinical record. WhatsApp recall is a separate purpose with its own consent, and we cover it in a separate guide. What follows is a plain-language reading of the primary texts, not legal advice.
The DPDP Rules 2025 were notified on 13 November 2025. Rule 1(4) brings Rule 3, the rule on notices, into force eighteen months after that date, which is 13 May 2027.
A paper form does not put patient data outside the Act. Section 3(a) of the DPDP Act closes that gap: the Act covers personal data collected in digital form, and personal data collected on paper and digitised later. If the details on your form end up in software, a spreadsheet or a WhatsApp chat, the form is covered.
Your clinic is the The DPDP Act's term for whoever decides why and how personal data is used. In a clinic that is the practice itself, not the software it uses.. Section 4(1) lets you process a patient's data on one of two grounds: their consent, or a A ground listed in Section 7 of the DPDP Act that allows processing without asking for consent, such as data a person gave you voluntarily for a stated purpose, or a medical emergency..
Section 7(a) is the legitimate use that fits a dental visit. It covers data a person voluntarily gives you for a specified purpose, as long as they have not told you they do not consent. The Act's own example is a pharmacy texting a receipt the customer asked for. A patient who fills in your form so you can examine and treat them is in a similar position. Section 7(f), medical emergencies involving a threat to life or an immediate threat to health, is a separate ground and does not cover routine dentistry.
The catch is in the definitions. Section 2(za) defines the "specified purpose" as the purpose mentioned in the notice the Data Fiduciary gives. So even the legitimate-use route leans on a notice that names the purpose. And for anything you do ask consent for, Section 5(1) says every consent request must come with, or after, a notice. This article does not pick a ground for you. A notice written to Rule 3 works under either.
Rule 3 sets the minimum content of the notice. Here is each element next to what it means at the registration desk.
| Rule 3 asks for | At the registration desk, that means |
|---|---|
| A notice understandable on its own, apart from any other information | Its own block or half page, not a line under the treatment consent or the fee list |
| Clear and plain language, giving a fair account of the details | Short sentences a patient can read while waiting, with no legal boilerplate |
| An itemised description of the personal data | Each item named: contact details, medical history, X-rays and photographs, treatment notes, payments |
| The specified purposes, and the services or uses they enable | One line per purpose: treatment and the clinical record, bills and receipts, reminders for booked appointments |
| The link to your website or app | The address of the page where these details, and your contact person, are published |
| How to withdraw consent, exercise rights and complain to the Board | Who to tell at the clinic, how to reach them, and that the Data Protection Board takes complaints |
If your clinic has no website, the Rules assume you will have one. Rule 9 says the business contact details of the person who answers questions about patient data are to be published on the website or app, and Rule 14 says the same for how patients make a rights request and how long you take to answer a grievance, which cannot exceed ninety days.
"Personal information" is not an itemised description. Walk through the form and the chair and write down every kind of data the clinic records about a patient. For most general practices that is:
Then say who else sees it. Section 8(2) lets you involve a Data Processor, such as a dental lab or your software provider, only under a valid contract, and Section 8(1) keeps the responsibility with you. Rule 3 asks you to describe the uses your processing enables, so a crown or aligner case that goes to a lab with the patient's name on it belongs in the notice.
The Act treats anyone under eighteen as a child, under Section 2(f). Section 9(1) normally requires Consent from a parent or guardian that the clinic has checked comes from an identifiable adult, using details it already holds or ones the parent provides. Rule 10 sets out how. from a parent before any of a child's data is processed.
Treatment is exempt. Rule 12 and Part A of the Fourth Schedule lift that requirement for a clinical establishment or healthcare professional, where the processing is restricted to providing health services to the child, to the extent necessary for the protection of her health. The exemption stops there. Putting a child's details on a promotional list is outside it, and Section 9(3) separately bars targeted advertising directed at children. In practice a parent fills in the form for a child, so write the notice for the parent to read.
Section 5(3) says the patient must have the option of reading the notice in English or in a language listed in the Eighth Schedule to the Constitution, such as Hindi, Marathi or Tamil. For most clinics that means an English version and one in the language your patients actually read.
Section 6(3) says a consent request must give the contact details of a person authorised to respond to the patient about their rights, and Section 8(9) says those details must be published. Those rights are to access a summary of their data (Section 11), to correction and erasure (Section 12), to grievance redressal (Section 13) and to nominate someone to act for them (Section 14). Name one person at the clinic, give a working phone number or email, and put the same details on the notice and the website.
The single consent line most forms carry today fails on four counts: it is not separate from the rest of the form, it does not itemise anything, "other purposes" is not a specified purpose, and it says nothing about withdrawal, rights or the Board. Here is the same notice rebuilt, section by section. Replace everything in square brackets.
| Section | Sample wording |
|---|---|
| Who we are | [Clinic name], [address]. For questions about your data, contact [name] on [phone] or [email]. |
| What we record | Your name, age, sex, mobile number and address. Your medical history. X-rays, photographs and notes from your examinations and treatment. Records of your bills and payments. |
| Why | To examine and treat you and keep your clinical record. To prepare your bills and receipts. To remind you of appointments you have booked with us. |
| Who else sees it | [The dental lab that makes your crowns or aligners.] [Our practice software provider, which stores your records on our behalf.] |
| Your choices | You can ask to see, correct or erase your details, or withdraw your consent, by telling the front desk or writing to [email]. We may keep records the law requires us to keep. |
| Complaints | If we do not resolve your concern, you can complain to the Data Protection Board of India. |
| Where to find this | This notice and our contact details are at [clinic website address]. |
The line about records the law requires comes from Section 8(7), which ties erasure to the patient withdrawing consent or the purpose ending, unless retention is necessary to comply with another law. How long that is for dental records is a separate question, covered in our records retention guide.
Anything beyond the visit, such as recall reminders or offers on WhatsApp, goes in a separate block with its own unticked box. Treatment cannot depend on ticking it, because Section 6(1) requires consent to be unconditional.
Number the notice and keep every version you use. Section 6(10) puts the burden on the clinic to prove a notice was given wherever consent is relied on, and a record of which version a patient saw is the easiest proof there is.
Not necessarily. Section 7(a) of the DPDP Act lets a clinic use data a patient voluntarily provides for a specified purpose, such as treatment, unless the patient says they do not consent. The Act defines the specified purpose as the one named in the clinic's notice, so a notice that meets Rule 3 is still needed.
Not for the treatment itself. Rule 12 and Part A of the Fourth Schedule to the DPDP Rules 2025 exempt a clinical establishment or healthcare professional from that requirement, where the processing is restricted to providing health services to the child. Using the child's details for anything else, such as promotions, falls outside the exemption.
On 13 May 2027. Rule 1(4) of the DPDP Rules 2025 brings Rule 3, which sets out what the notice must contain, into force eighteen months after the Rules were notified on 13 November 2025.
The notice is yours to write and hand over. Dentomate does not print a DPDP notice and does not record which version of your notice each patient saw, so keep that on the signed form for now.
What it can help with is the itemising. A Dentomate patient record holds name, mobile number, age, sex, address, medical history and treatment records, so if you use it, those are fields your notice should list. When you import an existing patient list, the app records who confirmed it is your clinic's own list and when. That is your confirmation, not the patient's consent. Where we sit under the Act is set out on our DPDP page.
The free plan covers 20 new patients a month. Starter at ₹399 a month and Pro at ₹799 a month have no new-patient limit. Full details are on the pricing page.
Registration details, medical history and treatment notes in one record, not spread across a register and a cupboard. Free forever, no card required.
.jpg){kind=link}