The DPDP Act for psychologists in private practice: what you actually have to do

By Sadique Ali, Glyphora, maker of Psyledger7 September 20269 min read

If you keep client records on a laptop, take bookings on WhatsApp and send reminders by SMS, India's Digital Personal Data Protection Act applies to you. Not to your hospital, not to your software vendor, to you, the practitioner, because you decide what is collected and why. This guide explains what that means in ordinary language and ends with a checklist that a solo practice can complete in a week.

It is written for RCI-registered clinical psychologists, counselling psychologists and counsellors in private practice in India. It is not legal advice. Where the law leaves something open, it says so, and the right person to settle it for your practice is counsel.

First, the two words that decide everything

The Act uses two roles, and which one you are decides your obligations.

A Data Fiduciary decides the purpose and means of processing personal data. When a client books a session with you, you decide what to collect, why, and how long to keep it. That makes your practice the fiduciary for its clients' data, whether you are one person in a rented room or a clinic with five psychologists.

A Data Processor handles personal data on the fiduciary's behalf and on its instructions. Your billing software, your email provider, the company that hosts your booking page: they are processors. The Act places the duties on the fiduciary. You can outsource the work; you cannot outsource the responsibility.

Two consequences follow. First, the law does not care that you are small. There is no exemption for solo practitioners. Second, choosing a vendor is itself a compliance act: the Act expects you to use processors under a contract and to be able to say what they do with your clients' data.

What counts as personal data here

Anything that identifies a person or relates to an identifiable person: a name, a phone number, an email, an appointment time next to a name, an invoice, and of course a session note, an assessment score and a diagnosis. The Act does not carve out "health data" as a special category the way European law does. In practice that changes little for you, because your professional ethics already hold clinical records to a higher standard than the law does, and the Act's duties apply to all of it equally.

Notes on paper are outside the Act until they are digitised. The moment you type them, photograph them or store a scan, they are in scope. Most practices are past that point already.

The timetable, in one paragraph

The Act was passed in August 2023. The rules that make it operational were notified in November 2025, with obligations phased in over the following eighteen months, which means the substantive duties on fiduciaries land during 2027. The government has published the phasing; check the current date against it rather than assuming. The sensible reading for a practice is simple: the requirements are known, the deadline is close, and everything below is worth doing now regardless of the exact date.

The seven things the Act asks of you

1. Consent, and a notice that goes with it

You may process a client's personal data with their consent, given for a specified purpose, after a notice that tells them what you are collecting and why, how they can withdraw consent, how they can complain, and how they can reach the Data Protection Board. Consent must be free, specific, informed, unconditional and unambiguous, and shown by a clear affirmative action. A pre-ticked box is not consent. Silence is not consent.

For a practice this means three plain pieces of text, shown before the client confirms: what you store to manage appointments, what you store as the clinical record, and, for a minor, what the guardian is agreeing to. Keep the exact wording each client agreed to, with the date, because a client may withdraw consent later and you need to know what they withdrew from.

There is a narrower legal basis called "legitimate uses" that covers, for example, responding to a medical emergency or complying with a court order. Do not rely on it for routine practice. Consent is the basis that fits therapy.

2. Children need a guardian's verifiable consent

Anyone under eighteen is a child under the Act, and processing a child's data needs verifiable consent from a parent or lawful guardian. There is no reduced age for health services. The Act also forbids tracking, behavioural monitoring and targeted advertising aimed at children, which will not trouble a practice, but the consent rule will: you need a way to capture the guardian's consent before the first session and to keep it with the record.

3. Security safeguards

You must take "reasonable security safeguards" to prevent a breach. The Act does not list them; the rules do, in outline: encryption or equivalent measures, access control, logging that lets you detect and investigate unauthorised access, backups, and contractual controls on processors. For a practice this translates to concrete habits:

• Clinical notes live in a system with a password and, ideally, a second factor, not in a phone gallery or a WhatsApp chat with yourself.
• Only the treating clinician reads a client's notes. Front-desk staff see appointments and invoices, not clinical content.
• Every access to a record is logged, so that if something goes wrong you can say who opened what.
• Backups exist and have been restored at least once, so you know they work.

4. Breach notification

If a personal data breach happens, you must inform the Data Protection Board and each affected client. The rules set the form and timing; the expectation is prompt notice to the individuals with what happened, the likely consequences and what you are doing about it, and a fuller report to the Board within a fixed window. Write down now who you would tell, in what order, and where the contact details are, so the first hour of a bad day is not spent searching.

5. Keep it only as long as you need it

Once the purpose is served and the client has not asked you to keep it, personal data must be erased, and your processors must erase it too. This collides with a professional reality: clinical records are kept for years, and rightly. The Act allows retention where another law requires it or where the purpose continues. So the answer is a written retention policy: session notes and assessments for a fixed period after care ends, invoices for the period tax law requires, contact details until the client leaves, and a rule for what happens at the end of each period. India has no single statutory period for psychologists' records; many practices use seven years for clinical records and eight for financial ones. Pick a period, write down why, and confirm it with your regulator or counsel.

6. Rights you must be able to answer

A client can ask for a summary of what you hold about them and how it has been processed, ask for correction or erasure, nominate someone to exercise their rights if they cannot, and complain. You must have a way to receive such a request and answer it within the time the rules set. Erasure is where practices get nervous: a signed clinical note that your professional duty requires you to keep does not have to be deleted because a client asks, but you must be able to explain that, in writing, and to record the request and your answer.

7. A named contact, and a notice on your site

You must publish the contact details of a person who answers questions about how you process data, and a grievance route. For a solo practice that is you, with an email address that you check. Put it in the same privacy notice your clients see when they book.

What the Act does not ask

It does not require encryption of a specific kind, a certification, a consultant, or a registration for a small practice. It does not require you to stop using email or SMS. It does not turn a scheduling mistake into a fine. Penalties exist, and the upper bounds are large, but they are aimed at fiduciaries who ignore security or fail to notify a breach, and the Board is expected to weigh the nature and gravity of a failure, the harm caused and the steps taken to mitigate it. A practice that can show its consent records, its access log and its retention policy is in a different position from one that cannot.

The checklist

Do these in order. A solo practice can finish in a week; a clinic in two.

1. Write your privacy notice. One page, plain language: what you collect, why, how long, who else sees it, how to withdraw, how to complain, and your contact. Link it from wherever clients book.
2. Fix your consent moment. Before a client confirms a first appointment, show the notice and the consent wording and record the version and the time they agreed. Do the same, on paper if you must, for existing clients at their next session.
3. Add guardian consent for minors. Capture the guardian's name, relationship and consent before the first session, and keep it with the record.
4. Move clinical notes out of chat apps and photo galleries. Into one system with a login, where only the treating clinician can open them.
5. Turn on an access log. If your system cannot tell you who opened a record and when, that is the thing to change first.
6. Write a retention policy. Four lines: notes, assessments, invoices, contact details, each with a period and a reason.
7. Write a breach plan. Half a page: who you tell, in what order, with what information, and where the contact details live.
8. List your processors. Every service that touches client data: hosting, email, payments, backups. For each, note where the data lives and confirm you have terms that bind them to your instructions and to deleting data when you say so.
9. Set up a way to answer requests. An email address, a template reply, and a log of requests and what you did.
10. Put a date in your calendar to review all of it once a year, and when the rules' timetable moves.

Where software helps, and where it does not

Software cannot make you compliant, because the duties are yours. It can make the checklist mechanical rather than heroic. Psyledger was built around this list: consent wording shown at booking and versioned per client, guardian consent for minors, notes private to the treating clinician, an append-only access log, retention rules per record type, a request queue with the statutory clock, and data held in India. It is a processor, and it says so in its own terms. What it cannot do is write your notice for you, decide your retention periods, or pick up the phone on the day of a breach. Those stay with you, as the Act intends.

Sources: the Digital Personal Data Protection Act, 2023 (sections on notice, consent, children, security safeguards, breach, retention and the rights of data principals); the DPDP Rules, 2025 as notified; the Rehabilitation Council of India's professional conduct norms on confidentiality and records. This guide describes the law in general terms and is not legal advice for any particular practice.