On this page
- Does the DPDP Act apply to a clinic or school website?
- What should notice and consent look like on an online form?
- What changes for children's data?
- How careful should a clinic be with health data online?
- Who is responsible when hosting, CRM or WhatsApp tools leak data?
- What should the privacy page say, and what about cookies?
- Website DPDP checklist for clinics and schools
- How DVM Techno Can Help
- FAQs
Key takeaways
- A clinic or school decides why and how website form data is used, so under the DPDP Act it is the Data Fiduciary and stays responsible even when a hosting, CRM or WhatsApp provider handles the data.
- The Rules were published in the Gazette on 13 November 2025, and most duties, including notice, security, breach reporting and children’s consent, start 18 months later.
- Anyone under 18 is a child: get verifiable parental consent and never use tracking or targeted ads aimed at children, because the exemptions for clinics and schools are narrow.
- Publish a contact person, a way to exercise rights and a response period of up to 90 days on your website, and keep forms limited to what you actually need.
Does the DPDP Act apply to a clinic or school website?
Yes. The Digital Personal Data Protection Act, 2023 covers personal data collected in digital form, and every online form, chat widget and parent login collects it. The clinic or school decides why and how that data is used, so it is the Data Fiduciary. Your hosting company, CRM, form plugin and WhatsApp tool are usually Data Processors.
Section 8(1) says the Data Fiduciary stays responsible for processing done on its behalf by a processor. A dental clinic on Sohna Road with an appointment form and a school in a DLF phase taking admission enquiries both hold names, phone numbers and often a child's details.
The duties arrive in phases. Rule 1 of the Gazette notification of the DPDP Rules, 2025 (G.S.R. 846(E)) sets the dates, and the PIB release of 14 November 2025 describes an "18-month phased compliance timeline":
| Phase | Rules in force | What it covers |
|---|---|---|
| On publication (Gazette dated 13 November 2025) | Rules 1, 2 and 17 to 21 | Definitions and the Data Protection Board |
| One year later (13 November 2026, by our count) | Rule 4 | Consent Managers |
| 18 months later (13 May 2027, by our count) | Rules 3, 5 to 16, 22 and 23 | Notice, security safeguards, breach intimation, retention, contact details, children's consent, rights |
In early 2026, it was reported that MeitY had sought comments on shortening the 18-month window to 12 months. We did not find any notified change on official sites when writing this, so check MeitY before you plan around a date.
What should notice and consent look like on an online form?
Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (Section 6), and the notice must stand on its own in clear, plain language (Rule 3). A pre-ticked box or a line buried in the footer is hard to call a clear affirmative action.
Rule 3 asks for, at minimum, an itemised description of the data and the specific purpose, plus how to withdraw consent, exercise rights and complain to the Data Protection Board. Withdrawing must be as easy as giving consent. Section 5(3) also requires the option to read the notice in English or any Eighth Schedule language, such as Hindi.
Purpose limitation matters most. Section 7(a) lets you use data a person gives voluntarily for that purpose, such as calling back about an appointment. Adding the same number to a marketing list is a new purpose and needs its own consent. A practical form looks like this:
- Short notice above the button: "We use your name, phone number and preferred time only to reply to this appointment request. See our privacy notice for your rights and how to withdraw."
- Separate, unticked box for anything extra: "Send me health camp and open day updates on WhatsApp."
- Only the fields you need: no date of birth, address or Aadhaar number on a first enquiry.
- A record of each consent: date, time, form version and the wording shown, because Section 6(10) puts the burden of proving notice and consent on the Data Fiduciary.
What changes for children's data?
Under the Act, anyone under 18 is a child. Section 9 requires verifiable parental consent before processing a child's data and bars "tracking or behavioural monitoring of children or targeted advertising directed at children".
Rule 10 says the Data Fiduciary must check that the person giving consent as a parent is an identifiable adult, using reliable identity and age details it already holds, details the parent provides, or a virtual token from an authorised entity such as DigiLocker. For new admission enquiries, address the form to the parent and confirm identity during admission. How far a self-declaration goes is a question for your lawyer.
The Fourth Schedule exemptions are narrow. A clinical establishment or healthcare professional is exempt only when processing is restricted to providing health services to the child. An educational institution is exempt only for tracking and behavioural monitoring for its educational activities or the safety of enrolled children, which is why a school bus tracking setup can fit. Neither exemption mentions advertising.
Keep advertising and retargeting pixels off student portals, results pages and any page children use. Target admission ads at parents, not students.
How careful should a clinic be with health data online?
Very careful. The Act has no separate "sensitive data" category, but a leaked diagnosis harms far more than a leaked phone number. Collect the minimum online.
- Ask for name, phone, department and preferred time on the website, not symptoms or medical history.
- Do not accept report uploads through a general contact form that lands in a shared inbox.
- Send reports to the patient's own number or a secure patient login, never to a staff WhatsApp group.
- Give receptionists only the screens they need, and remove access the day someone leaves.
Our clinic and hospital website design page covers appointment forms built this way.
Who is responsible when hosting, CRM or WhatsApp tools leak data?
You are, as the Data Fiduciary. Section 8(2) allows processors only under a valid contract, and Rule 6 requires that contract to include reasonable security safeguards. List every tool that touches form data: hosting, email, CRM, WhatsApp provider and backups.
Rule 6 minimums include encryption or masking, access control, logs, backups and keeping logs for one year. If you use a WhatsApp CRM, check who at the vendor can read chats.
If a breach happens, Rule 7 requires you to tell each affected person without delay, in plain language, what happened, the likely consequences, what you are doing and whom to contact. You must also tell the Data Protection Board without delay and send a detailed report within 72 hours of becoming aware, unless the Board allows longer.
On retention, Section 8(7) says erase data when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep it, and make your processors erase it too. Rule 8(3) separately requires keeping processing logs and related data for at least one year. So write a schedule, for example reviewing unconverted admission enquiries after each admission season.
What should the privacy page say, and what about cookies?
The privacy page should explain, in plain words, what each form collects, why, who it is shared with, how long it is kept and how people can use their rights or complain. It does not replace the short notice at each form.
- Contact person (Rule 9): publish, prominently, the business contact of a person who can answer questions about data processing.
- Rights (Rule 14): how to ask for access, correction or erasure, and which identifier you need, such as a patient ID, enrolment number or mobile number.
- Response period: Rule 14(3) requires publishing a period of not more than 90 days for responding to grievances.
- Grievances (Section 8(10) and 13): a working email or form, because people must use it before approaching the Board.
- Withdrawal: one simple way, such as replying STOP on WhatsApp or one email.
- Children: how parental consent is taken, and that you do not target ads at children.
The Act and Rules do not mention cookies. But analytics or advertising tags can link browsing to a person, especially behind a parent or patient login. List the tags you use, remove unused ones, and ask your lawyer whether advertising pixels need a consent banner. Our gym biometric attendance and DPDP Act guide shows the same thinking applied to front-desk data.
Website DPDP checklist for clinics and schools
Work through this table with whoever manages your website and WhatsApp number. Most items are content and settings changes.
| Area | What to check | Basis |
|---|---|---|
| Forms | Only needed fields; short notice above the submit button | Section 6, Rule 3 |
| Consent | Unticked, separate boxes for marketing; consent records kept | Section 6(1), 6(10) |
| Language | Notice available in English and Hindi | Section 5(3) |
| Children | Parent-facing forms; verifiable parental consent; no ads aimed at children | Section 9, Rule 10 |
| Health data | No symptoms or reports through open forms; restricted inbox access | Section 8(5), Rule 6 |
| Vendors | Written contracts with security clauses for hosting, CRM, WhatsApp | Section 8(2), Rule 6(1)(f) |
| Security | HTTPS, strong admin passwords, access logs, backups | Rule 6 |
| Breach plan | Who informs patients or parents, and the Board within 72 hours | Section 8(6), Rule 7 |
| Retention | Written deletion schedule; processors told to erase | Section 8(7), Rule 8(3) |
| Contact and rights | Named contact, request method, response period of up to 90 days | Rules 9 and 14 |
The penalties in the Schedule to the Act are large: up to 250 crore rupees for failing to take reasonable security safeguards, up to 200 crore rupees each for failing to report a breach or meet the children's data duties, and up to 50 crore rupees for other breaches.
This is general information, not legal advice. Ask a lawyer how the DPDP Act and Rules apply to your clinic or school.
How DVM Techno Can Help
DVM Techno is a web and software company with its team in Gurgaon. We build and update websites with privacy notice pages, consent checkboxes on forms, parent-facing admission forms and secure enquiry handling. See our website development services in Gurgaon or school website design, or call +91-8448523313. We handle the website side; your lawyer handles the legal review.
Frequently Asked Questions
Does a small clinic or school have to follow the DPDP Act?
Yes. The Act applies to anyone who processes digital personal data, and it has no general exemption for small clinics or schools. A website appointment form, an admission enquiry form or a WhatsApp chat collects personal data, so the clinic or school is a Data Fiduciary. Most duties under the DPDP Rules, 2025 start 18 months after their publication in November 2025.
Is a privacy policy page enough for DPDP compliance?
No. A privacy page helps, but Rule 3 asks for a notice that stands on its own and itemises the data and purpose, so each form needs a short notice too. You also need a published contact person, a way to exercise rights, a grievance process, vendor contracts, security safeguards, a breach plan and a deletion schedule. The page is one part of the work.
Do schools need parental consent for an admission enquiry form?
If the form collects a child's details, Section 9 generally requires verifiable consent from a parent, and anyone under 18 counts as a child. The Fourth Schedule exemption for educational institutions covers tracking and behavioural monitoring for educational activities or safety, not every use of a child's data. Address the form to the parent and confirm identity during admission.
Can a clinic share reports on WhatsApp under the DPDP Act?
The Act does not ban WhatsApp, but the clinic must take reasonable security safeguards and stays responsible for its tools. Send reports only to the patient's own registered number or a secure login, never to staff groups, and get the patient's agreement to receive reports this way. Check who at your WhatsApp provider can access chats and where they are stored.
How quickly must a data breach be reported?
Under Rule 7, the Data Fiduciary must inform each affected person without delay, in plain language, and inform the Data Protection Board without delay. A detailed report to the Board is due within 72 hours of becoming aware of the breach, unless the Board allows more time on a written request. Rule 7 is among the provisions that start 18 months after the Rules' publication.
Related articles
Make your forms and privacy page DPDP-ready
We can add privacy notices, consent checkboxes and parent-facing forms to your clinic or school website.