Every homeopathy clinic in India holds personal data: names, phone numbers, case sheets, family histories, reports. From mid-May 2027, how you collect and protect that data is governed in detail by the Digital Personal Data Protection Act, 2023 and its Rules.
Here is what changes, when, and a checklist you can work through this year.
The timeline
The Ministry of Electronics and Information Technology notified the DPDP Rules, 2025 in November 2025 (dated 13 November, published in the Gazette on 14 November). They come into force in three phases:
| Phase | From | What starts |
| 1 | November 2025 | Data Protection Board and its procedures |
| 2 | November 2026 | Registration and duties of Consent Managers |
| 3 | May 2027 (18 months after notification) | Notice, consent, security safeguards, breach reporting, children’s data and most other obligations |
Phase 3 is the one that touches daily clinic work.
Your role: the clinic is the Data Fiduciary
The Act defines a Data Fiduciary as whoever decides why and how personal data is processed. For patient records, that is you or your clinic.
Your clinic software, cloud storage and messaging providers are Data Processors. The Act places no direct obligations on processors; instead, the fiduciary must ensure compliance through its contracts with them. In practice, responsibility sits with the clinic.
Health data isn’t a special category — but confidentiality still binds you
Unlike some other countries’ laws, the DPDP Act treats all personal data the same way and does not add heavier rules for health data.
That does not lower the bar for homeopaths. Regulation 16 of the NCH Code of Ethics (2022) requires confidentiality, and Regulation 36(l) makes disclosing a patient’s confidential information without consent professional misconduct, except in court under a judge’s order.
What Phase 3 asks of a clinic
A clear notice. When you ask for personal data, the notice must be standalone and understandable on its own, without referring to other documents.
Consent you can show. The burden of proving consent sits with the Data Fiduciary. Keep a record of what the patient agreed to and when.
Children’s records. The Rules require verifiable consent from a parent or guardian before processing a child’s data. Paediatric patients are routine in homeopathy, so this affects most clinics.
Security safeguards. Reasonable safeguards are mandatory, and they extend to processors working for you.
Breach reporting. If records are exposed, the Board must be informed (commentators summarise the window as 72 hours) and affected patients notified promptly through their registered contact.
Erasure. Data must be deleted once its purpose is served and any retention period has passed.
The penalties
The Act’s Schedule sets penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to report a breach or for breaching children’s-data obligations. These are ceilings, not fixed fines, but they show how seriously the law treats security.
A checklist for the next six months
- Map your data. List every place patient data lives: paper case files, clinic software, phones, WhatsApp chats, call recordings, email, spreadsheets.
- Write a one-page patient notice. What you collect, why, who processes it, how to withdraw consent or ask for correction. Offer it in the language your patients read.
- Add guardian consent to your intake form for patients under 18.
- Check vendor contracts. Do your software, cloud and messaging providers commit to security, breach notification and deletion on request? Where is data stored?
- Move off personal WhatsApp for clinical records where you can. Case details on a personal phone are hard to secure or erase.
- Decide retention periods. Note any record another rule requires you to keep — the NCH Code, for example, asks you to keep a copy of medical certificates for at least three years — and take advice on how that interacts with erasure.
- Write a breach plan. Who notices, who decides, who informs the Board and patients, within what time.
- Name a contact person patients can reach about their data.
Where software fits
Good clinic software can make several items easier: access controls by staff role, encryption, audit trails and export or deletion on request. It cannot make you compliant on its own. Consent, notices and decisions about retention remain the clinic’s.
If you are evaluating any vendor, including us, ask four questions: where is data stored, is it encrypted at rest and in transit, which sub-processors handle it, and is your data used to train AI models.
DPDP Rules 2025 highlights (SCC Online)
Phased timeline (DSK Legal via Mondaq)
Fiduciary/processor, no sensitive category (Hogan Lovells)
Consent notice (Mondaq) · Penalties (Compliance Hub)
NCH Code of Ethics 2022