DPDP Act Milestone on 13 November 2026: What Clinics and Health Screening Programmes Must Do

MeitY notified the DPDP Rules on 13 November 2025 and built in a phased rollout. Rule 4, which governs consent managers, comes into force one year later on 13 November 2026 (Mondaq, Aug 2026). The core obligations on security, breach notice within 72 hours, retention and patient rights apply from May 2027 (DPDPA timeline).

November is not the final deadline for most providers. It is the point where preparation time starts running out.

Yes. Independent doctors, dental clinics, Ayurveda and homeopathy centres and standalone labs all fall under DPDP if they collect or process digital patient information (Kratikal). Size does not create an exemption.

The same applies to health screening programmes run by employers, CSR teams, housing societies and governments. A health kiosk that records blood pressure, sugar and ECG is processing personal data.

• Get specific, informed consent. Blanket or implied consent is no longer valid for patient data (KPMG, Dec 2025).
• Use data only for the stated purpose. Screening data collected for a health report should not be reused for unrelated marketing.
• Secure it. Encryption, access controls, logging and backups.
• Report breaches within 72 hours.
• Honour patient rights. Access, correction, erasure, grievance redressal and nomination (Acuity Law, Oct 2026).
• Delete data you no longer need under a defined retention policy.

DPDP also gives clinical establishments and healthcare professionals a limited exemption from parental consent for children's data, but only when the processing is confined to health services that protect the child's health.

Preventive screening only works if people trust where their numbers go. If a factory worker or a villager fears their results will be shared without permission, they will not step up to the machine.

That is why data protection has to be designed into the screening workflow, not added afterwards. Ask any screening partner five questions:

• How is consent captured before the first test?
• Where is the data hosted, and who can access it?
• What security certifications does the platform hold?
• Can patients get their report, correct it, or ask for deletion?
• Can the data sit on our own servers if we need it to?

The Clinics On Cloud Health ATM platform is built with ISO 27001 information security, IEC 62304 software processes, and regular VAPT and WASA security testing. Data is hosted on AWS cloud infrastructure with primary, secondary and long-term backups. Where an organisation needs it, the application and data can run on client-controlled servers (platform FAQ).

Reports go straight to the person screened through WhatsApp or email. Integrations with HMIS, EMR and government systems run through approved APIs (Data and Analytics). Read our privacy policy for details.

Use the months before May 2027 to map what patient data you collect, where it goes and who sees it. If you run or plan a screening programme for employees, students or communities, talk to our team about a setup that fits your DPDP plan.

Related reading: India is spending ₹40,000 crore on hospital beds. Prevention is the cheaper fix. · AI in Indian healthcare has moved from pilots to practice

This article is general information, not legal advice. Consult qualified counsel for your organisation's DPDP obligations.