DPDP Act and Aesthetic Clinics: Why It Matters and How Zynva Helps

October 27, 2026 · Zynva Enterprise

Your clinic holds some of the most personal data a person can share: their skin and medical history, the treatments they've had, their phone number, and — in aesthetics especially — before-and-after photos of their face and body.

Until now, many clinics have kept this information in WhatsApp chats, Excel sheets, paper files, and a receptionist's phone. India's Digital Personal Data Protection (DPDP) Act, 2023 changes that. Patient data is no longer just a record you keep — it's something you are legally accountable for.

Here's what the law says, why it matters for aesthetic and cosmetic clinics, and how the right software makes compliance part of your daily routine instead of a headache.

What is the DPDP Act?

The DPDP Act is India's first comprehensive data protection law. It applies to organisations that handle digital personal data of people in India — including hospitals, small clinics, dermatology practices, salons offering clinical treatments, and independent doctors.

Under the law, your clinic is a Data Fiduciary: you decide why and how patient data is collected and used, so you carry the responsibility for protecting it. Your patients are Data Principals, and the law gives them clear rights over their own information.

The Act doesn't create a separate "sensitive data" category for health information. However, because medical data carries a high risk of harm, healthcare providers should apply strong privacy and security safeguards.

The timeline: What's live and what's coming

The government notified the DPDP Rules, 2025, on November 13, 2025, starting a phased rollout.

• November 13, 2025: Definitions and the Data Protection Board of India came into force.
• November 13, 2026: Consent Manager provisions begin, and the Board's enforcement machinery is in place.
• May 13, 2027: The core obligations apply in full, including consent notices, security safeguards, breach notification, patient rights, and data retention.

The government has also discussed shortening the 18-month window to 12 months. As of October 2026, that change hasn't been formally notified, but it's a clear signal: don't plan to start in April 2027.

Clinics that begin now will be ready; clinics that wait may find themselves scrambling.

What the law asks of your clinic

In plain terms, the DPDP Act expects every clinic to:

1. Take clear, informed consent

Before collecting data, tell the patient what you're collecting and why, in simple language. Consent must be free, specific, and unambiguous — and patients must be able to withdraw it as easily as they gave it.

2. Use data only for the stated purpose

Data collected for treatment can't automatically be used for promotional WhatsApp campaigns. Marketing and other secondary uses need an appropriate separate legal basis, including separate consent where required.

3. Collect only what you need

Avoid collecting unnecessary information "just in case." Keep intake forms focused on information required for treatment, administration, and other clearly stated purposes.

4. Keep data secure

The law requires reasonable security safeguards. These may include controlled access, protection against data leaks, and records that help trace who accessed patient information.

5. Report breaches

If patient data is leaked or accessed without authorisation, applicable breach notification obligations must be followed. Under the DPDP Rules, the affected individuals must be informed without delay, and the Board must receive an initial notification without delay, followed by detailed information within the prescribed 72-hour period, subject to applicable requirements.

6. Respect patient rights

Patients have rights under the law, including the ability to request information about their personal data, seek corrections or erasure where applicable, and raise grievances. Your clinic needs a process for receiving and responding to these requests.

7. Don't keep data forever

When the purpose has been served and there is no legal reason to retain the information, personal data should be erased in accordance with applicable retention requirements.

Why this matters so much for aesthetic clinics

Aesthetic clinics face particular privacy risks because their work often involves identifiable photographs, detailed treatment histories, and ongoing patient communication.

Photos are personal and powerful

Before-and-after images can identify a patient instantly. Posting them on Instagram, sharing them in a staff WhatsApp group, or storing them in a phone gallery without appropriate safeguards and consent can put patient privacy at risk.

Marketing runs on patient data

Offers, festive campaigns, and follow-up reminders all use patient contact details. Under the DPDP framework, promotional communications must follow applicable consent and notice requirements. Treatment-related communication should not automatically be treated as permission to send marketing messages.

Data is scattered

Records spread across phones, spreadsheets, and paper files are difficult to secure, audit, manage, or erase when required. Centralising records can make privacy management much easier.

Trust is the business

Aesthetic patients choose clinics they trust with their appearance and privacy. A leak of photographs or treatment details can damage a reputation built over years.

The penalties are serious

The DPDP Act's Schedule provides for financial penalties of up to ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches, and up to ₹50 crore for certain other specified contraventions.

The applicable penalty depends on the nature of the contravention and the statutory factors considered by the Data Protection Board.

How Zynva helps your clinic get DPDP-ready

Compliance isn't a policy document you sign once — it's built into how your clinic works every day. That's where clinic software can make a meaningful difference.

Zynva is built for aesthetic and cosmetic clinics, helping you move from scattered records to a more organised, controlled system.

One secure home for patient data

Patient profiles, treatment history, photographs, and billing records can be managed in one system instead of being scattered across personal phones and spreadsheets. This helps your clinic organise information and manage access more consistently.

Consent built into the workflow

Capture treatment consent and marketing consent separately at intake, with a record of when each was given. Clear consent workflows help staff understand which uses of patient information are permitted.

Role-based access

Your doctor, therapist, and front desk team have different responsibilities. Role-based access helps limit access to the information each role needs to perform its work.

Reminders that respect consent

Zynva's scheduled WhatsApp reminders help keep patients informed about appointments and follow-ups. Promotional messages should be sent only in accordance with applicable consent requirements and the patient's recorded preferences.

Clean digital billing

Bills can be generated as PDFs from the system, reducing reliance on paper records and unofficial copies. Digital records also make it easier to organise billing information.

Easier patient requests

When a patient asks what personal data your clinic holds, requests a correction, or asks for erasure, having records organised in one place can make it easier to locate information and respond appropriately.

Important: Software alone doesn't make a clinic compliant. Your clinic still needs clear policies, trained staff, appropriate security configurations, and a process for handling breaches and patient requests. Confirm that the features and controls you use meet your specific legal obligations.

The right system can help turn many privacy responsibilities into everyday habits.

A quick DPDP checklist for your clinic

Use this checklist to start preparing your clinic:

List every place patient data lives today: phones, WhatsApp, spreadsheets, paper files, and cloud drives.

Move records into an appropriately secured clinic management system.

Update intake forms with a clear privacy notice and appropriate consent mechanisms.

Obtain appropriate consent before using patient photographs for promotional purposes.

Restrict staff access according to job responsibilities.

Stop sharing patient data through unauthorised personal chats and devices.

Establish a data retention policy and a process for secure erasure when required.

Assign responsibility for handling patient data requests and grievances.

Prepare a breach response plan and establish a process for meeting applicable notification deadlines.

Train staff on patient confidentiality, data handling, and consent.

The bottom line

The DPDP Act isn't just a legal requirement — it's an opportunity to show patients that your clinic takes their privacy as seriously as their care.

With the core obligations scheduled to apply from May 2027 under the notified timeline, the best time to start preparing is now.

Want to see how Zynva can help your clinic prepare?

Visit zynva.in to book a demo.

Disclaimer: This article is for general informational purposes only and does not constitute legal advice. The applicability and timing of specific obligations may depend on the relevant legal provisions and notifications. Consult a qualified legal professional for guidance specific to your clinic.

References

• DPDP Rules 2025 timeline — ProtectComply
• Is the 18-month window being cut to 12? — dpdprules.org
• Data privacy compliance in healthcare — KS&K
• What November 13, 2026 starts — The Privacy Labs
• DPDP Act timelines and penalties — Uniqus