Is your clinic's WhatsApp ready for India's new data protection law?
Short answer: yes, India's Digital Personal Data Protection (DPDP) law applies to your clinic, whatever its size, and most obligations start on 13 May 2027. For WhatsApp, the big changes are separate consent for marketing, an easy way to opt out, written contracts with vendors, and a plan for reporting leaks. Six of the ten fixes below cost almost nothing.
If your clinic keeps patient phone numbers in software, a spreadsheet or a WhatsApp account, India's new data protection law applies to you. Size doesn't matter. A two-doctor clinic is covered just like a hospital.
Most of the obligations start on 13 May 2027. That sounds far away. It isn't, because the fixes involve your registration forms, your staff habits and your vendors, and all three take months to change.
This article explains the law in plain words. It is not legal advice; for your specific situation, speak to a lawyer.
The law in one paragraph
The Digital Personal Data Protection (DPDP) Act, 2023 sets the rules for how any organisation handles personal data in India. The DPDP Rules, notified in November 2025, set out how it works in practice. Under the law, your clinic is a Data Fiduciary: you decide why patient data is collected and how it is used, so you are responsible for it. Every vendor that handles that data for you (your clinic software, your WhatsApp provider, your automation partner) is a Data Processor. If they get it wrong, the responsibility still sits with you.
The dates
| Date | What happens |
|---|---|
| 13 November 2025 | Rules notified; Data Protection Board provisions in force |
| 13 November 2026 | Consent Manager registration opens |
| 13 May 2027 | Core obligations apply to everyone, including clinics |
The government has floated a proposal to bring the last date forward to November 2026. It has not been notified yet, but plan as if it might be.
What changes for a clinic
1. Consent has to be specific. A patient giving you their number for an appointment has not agreed to festival offers. Appointment reminders and marketing messages need separate consent.
2. A clear notice comes first. Before collecting data, you give a plain-language notice listing what you collect and why. It must be separate from general terms and conditions.
3. Withdrawing must be easy. A patient must be able to stop marketing messages as easily as they signed up, for example by replying STOP.
4. Breaches must be reported. If patient data leaks, you inform the Data Protection Board and every affected patient without undue delay, with a detailed report to the Board within 72 hours.
5. Vendors need contracts. Every vendor that touches patient data needs a written agreement on what they can do with it and how they protect it.
6. Data can't be kept forever. Medical records still follow their own retention rules. But marketing lists and chat data you no longer need must be deleted.
The penalties are large: up to ₹250 crore for failing to protect data, and up to ₹200 crore for failing to report a breach. The Board decides the amount case by case.
Where WhatsApp creates risk
WhatsApp is where most clinics talk to patients, so it is also where most gaps are:
- Staff personal phones. Reception uses a personal WhatsApp to message patients. The data sits on a phone the clinic doesn't control, and it leaves when the employee leaves.
- Reports sent in chat. Lab reports and prescriptions sent as images stay on every phone they reach, with no record of who saw them.
- One consent for everything. A single "I agree" on the registration form, used for reminders, offers and surveys alike.
- Unknown vendors. An API provider or chatbot set up by a freelancer, with no contract and nobody who knows where the data is stored.
10-point checklist to start now
- List every place patient phone numbers live: clinic software, registers, spreadsheets, phones.
- Move patient messaging from personal phones to one clinic-owned WhatsApp Business number.
- Add a short, plain-language notice to your registration form.
- Split consent into two tick boxes: appointment messages, and health tips or offers.
- Record when and how each patient gave consent.
- Add a simple opt-out ("Reply STOP") to every marketing message.
- Sign a data processing agreement with every vendor that handles patient data.
- Decide who at the clinic owns data questions and complaints.
- Write a one-page plan for what to do if data leaks, including who informs whom.
- Clean your marketing list: remove patients who never agreed or haven't visited in years.
Points 1–6 cost almost nothing and can be done this month. Consent also saves money: see what WhatsApp now charges clinics.
Where Tevio fits
When we set up WhatsApp and patient registration for a clinic, consent is built in from day one: separate tick boxes, a recorded consent date and an opt-out on every marketing message. We also tell you which tools hold your patients' data.
Sources: Sigosoft: DPDP Act for healthcare apps, what to fix before May 2027 · Lexwin: DPDP Act for hospitals and healthcare · eHealth: healthcare guide to DPDP Rules 2025
Not sure where your clinic stands?
We offer a free 30-minute review of how patient data moves through your clinic: registration, WhatsApp, reports and vendors. No pitch, no product demo.
BOOK THE FREE REVIEW →