Your clinic has until 13 May 2027 for most of what the DPDP Rules 2025 ask, and a couple of milestones land sooner. The Rules were notified on 13 November 2025, but they switch on in stages, not all at once. So you don’t need panic. You need a calendar. This page is that calendar: what hits when, what a clinic actually has to do, and how to vet any AI tool that touches patient data before the deadline arrives.
One honesty note before the dates. This is reporting, not legal advice, and the Data Protection Board is still standing up its machinery. Treat the schedule below as the published one and confirm specifics for your practice with counsel. Want the broader obligation primer instead of a dated timeline? Our DPDP Act for clinics guide walks the obligations themselves. This page is purely about timing.
Key takeaways
- The DPDP Rules 2025 were notified 13 November 2025 and commence in phases, not on day one.
- Definitions and the Data Protection Board provisions are already live. The Consent Manager rule follows on 13 November 2026.
- The bulk clinic obligations, notice, consent, breach, retention, and patient rights, take effect on 13 May 2027.
- Breach rule: notify patients and the Board without delay, then file a detailed report to the Board within 72 hours.
- The operative 2002 medical ethics code requires three-year retention for indoor patient records; it does not set a blanket three-year outpatient period. The NMC 2023 regulations remain in abeyance.
Key facts
- DPDP Rules 2025 notified; definitions and Board provisions live
- 13 Nov 2025
- Consent Manager registration framework (Rule 4) in force
- 13 Nov 2026
- Bulk obligations live: notice, consent, breach, retention, rights
- 13 May 2027
The phased timeline, with real dates
The thing most coverage gets wrong is treating “DPDP is here” as a single switch. It isn’t. The DPDP Act 2023 got Presidential assent on 11 August 2023; the Rules that make it operational were notified on 13 November 2025 (through Gazette notifications G.S.R. 843 to 846(E)). And the Rules themselves commence in three waves.
| Phase | Date | What switches on | What a clinic does |
|---|---|---|---|
| On notification | 13 Nov 2025 | Definitions (Rules 1, 2) and Data Protection Board constitution and functioning (Rules 17–21) | Nothing operational yet; the enforcement body is being built |
| One year out | 13 Nov 2026 | Consent Manager framework (Rule 4): registration, eligibility, obligations | Understand how Consent Managers will mediate consent; plan for it |
| Eighteen months out | 13 May 2027 | The bulk: notice, consent, security safeguards, breach reporting, retention and erasure, children’s data, data-principal rights, cross-border (Rules 3, 5–16, 22, 23) | This is your real deadline; the consent-and-rights build must be done |
DPDP Rules 2025 implementation milestones
Definitions and Data Protection Board provisions
On notification
Consent Manager registration framework
One year after notification
Bulk operational obligations
Eighteen months after notification
The main deadline is 13 May 2027. Before then, clinics need time to build and review their consent workflow, breach process, and vendor due diligence. Tools selected today should support those processes.
What a clinic has to do, in plain terms
When the bulk obligations land, a clinic, as a Data Fiduciary, owes its patients (the Data Principals) a specific set of things. None of it is exotic. Most of it is good practice you could start tomorrow.
Consent has to be done properly. That means consent that’s free, specific, informed, unconditional, and unambiguous, with an itemised notice telling the patient what you collect and why, purpose by purpose. A bundled, take-it-or-leave-it checkbox doesn’t clear the bar.
Then purpose limitation. Use the data for the purpose you stated, and not for whatever else later turns out to be convenient.
Breach reporting is the one to get exactly right, because it’s so widely misquoted. Under Rule 7 you notify affected patients without delay, and you notify the Data Protection Board without delay, and then you file a detailed report to the Board within 72 hours (or longer if the Board allows). So the “72 hours” floating around is the detailed-report clock. The first alarm, to patients and to the Board, is immediate.
Patient rights come next. A patient can ask for a summary of their data and how it’s processed, request correction or completion, request erasure, nominate someone, and use a grievance-redress route you’re required to publish.
And children’s data. Processing a child’s data (under 18) needs verifiable parental or guardian consent, and you can’t run tracking or targeted advertising to children.
Here’s one thing you don’t have to do. The time-bound three-year retention written into the Rules applies to large platforms, big social media, e-commerce, online gaming, not to a clinic. Your retention is governed by purpose limitation plus your sector’s record-keeping rules. Which brings us to the question every doctor asks next.
How long must you keep records, and which rule governs?
The Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations 2002 are the operative rules. Regulation 1.3.1 requires indoor patient records to be maintained for three years from the start of treatment; it does not set the same period for all outpatient records. Regulation 1.3.2 requires requested records to be issued within 72 hours. The NMC Registered Medical Practitioner (Professional Conduct) Regulations 2023 were held in abeyance. Set an outpatient retention schedule using the applicable legal, specialty, contractual, and operational requirements.
DPDP and the record-keeping rules pull in the same direction. Keep what you need for as long as the purpose (and the medical-council expectation) requires, then erase it. A tool that lets you export or delete any patient record on demand makes both obligations easier to honour.
And no, DPDP doesn’t force your data to stay in India
Worth clearing up, because it drives a lot of nervous procurement. The DPDP Act uses a negative-list model for cross-border transfer (Section 16): data may be transferred to any jurisdiction except those the central government specifically restricts by notification. No blanket data-localization mandate sits in the Act itself. Individual sector regulators may impose their own localization rules, and those still apply, but they don’t flow from DPDP. So “DPDP requires my patient data to live in India” is an overstatement. Where your data lives is a fair buying question. It just isn’t one the statute decided for you.
The DPDP question set for any AI tool
If anything touches patient data, a scribe, an EMR, a billing add-on, run it through these before May 2027 quietly arrives:
| Ask the vendor | A DPDP-aligned answer |
|---|---|
| How do you handle consent and purpose limitation? | Consent-first, purpose-bound, with a clear notice; not buried in a ToS |
| What happens to visit audio, and when is it deleted? | A one-sentence answer with a timeline; ideally “never stored” |
| How would a breach be reported to me? | A defined process matching Rule 7’s without-delay and 72-hour structure |
| Can I export or delete any patient record? | Yes, anytime, no ticket; the data belongs to the practice |
| Where does the data live, and who can access it? | A clear location, role-scoped and logged access |
Here’s how we answer, on the record. The AI Medical Scribe is one module of Practice Copilot from Patient Square: it listens during the visit and hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft, ready to review and sign about two minutes after the visit. Data is handled to DPDP Act 2023 standards, consent-first and purpose-limited. Visit audio is processed in memory and discarded the moment the note drafts, so there’s no audio archive to breach or produce. Notes are encrypted (TLS 1.2+ in transit, AES-256 at rest), access is role-scoped and logged, and the notes belong to your practice, export or delete any visit anytime. A SOC 2 Type II audit is underway, that phrase exactly. The full posture is on our security page. One honest line we won’t blur: ABDM integration is on our roadmap, not live; we never claim to be ABDM-compliant, because we’re not yet. If you want to walk the five questions against a live tool, review the current Practice Copilot scope and ask each one out loud. This describes live consultation audio; uploaded recordings use a separate retention mode with explicit consent.
What to do this quarter
You have until 2027 for the big obligations, so spend the runway building instead of bracing for it:
- Map your patient-data flows. What you collect, why, where it goes, who can see it. You can’t write a consent notice for data you haven’t mapped.
- Draft the consent notice and patient-rights process before the 13 May 2027 deadline. Review them with your team and counsel before using them with patients.
- Vet every data-touching vendor with the five questions above, and get the audio-retention answer in writing.
- Apply the operative 2002 rules’ three-year retention requirement to indoor patient records. Set an outpatient retention policy with counsel, accounting for other applicable duties, and make sure requested records can be produced within 72 hours.
- Plan for the Consent Manager framework arriving 13 November 2026, ahead of the bulk deadline.
The companion India AI scribe buyer’s guide covers price, language, and data-handling questions. Ask each vendor the five DPDP questions directly and evaluate with synthetic scenarios. Review consent, retention, and privacy terms before using patient data.