Skip to content
Garbha.ai
Compliance Hub · DPDP

DPDP guide for IVF clinics

A plain-language summary of what the Digital Personal Data Protection Act 2023 and DPDP Rules 2025 require of clinics, and by when — with a source for every point.

Educational information, not legal advice. Last reviewed: .

To report a breach to the Board
72 hours
To answer rights requests
90 days
Minimum log retention
1 year
Maximum penalty (security failure)
₹250 crore
Timeline

When the duties apply

An IVF clinic that collects patient data is a Data Fiduciary under the DPDP Act.

  1. 1

    14 Nov 2025

    DPDP Rules notified; Data Protection Board set up.

    Source: PIB — DPDP Rules notified (opens in a new tab)

  2. 2

    ~Nov 2026 (12 months)

    Consent Manager registration opens.

    Source: Privacy World — Rules summary (timeline, security, 72 hours) (opens in a new tab)

  3. 3

    ~May 2027 (18 months)

    Main duties apply: notices, consent, security safeguards, breach reporting, rights requests.

    Source: Privacy World — Rules summary (timeline, security, 72 hours) (opens in a new tab)

Rights and accountability

Someone to contact, and answers to requests on time.

Security and breaches

Protect the data, keep logs, and act fast when something goes wrong.

Records and retention: ART vs DPDP

ART's 10-year record rule and DPDP's storage limitation must be reconciled — keep ART records 10 years, delete other data when its purpose ends.

Penalties

Up to ₹250 crore (security failure); up to ₹200 crore (breach not reported, or children's data); up to ₹50 crore (other)

Source: PIB — DPDP Rules 2025 (opens in a new tab)

FAQ

Common questions

Each answer is the requirement as stated in the guide above.

What does the DPDP Act and Rules say about notice?

Standalone, clear notice: itemised data collected, purpose, and a link to withdraw consent, exercise rights and complain to the Board.

What does the DPDP Act and Rules say about consent?

Free, specific, recorded; can be withdrawn at any time.

What does the DPDP Act and Rules say about processors?

Use vendors that process personal data only under a valid contract (Act Sec 8(2)).

What does the DPDP Act and Rules say about contact?

Display contact details of a designated officer or Data Protection Officer (Act Sec 8(9)).

What does the DPDP Act and Rules say about rights requests?

Respond to access, correction and erasure requests within 90 days.

What does the DPDP Act and Rules say about security?

Reasonable safeguards: encryption or masking, access control, access logging and monitoring, backups, ways to detect and investigate unauthorised access.

What does the DPDP Act and Rules say about logs?

Keep logs for at least one year.

What does the DPDP Act and Rules say about breach?

Inform affected people without delay in plain language; report to the Data Protection Board within 72 hours.

What does the DPDP Act and Rules say about children?

Verifiable parental consent for under-18s, with exemptions including healthcare.

What does the DPDP Act and Rules say about penalties?

Up to ₹250 crore (security failure); up to ₹200 crore (breach not reported, or children's data); up to ₹50 crore (other).

Sources

Read the law yourself

Your next step

Need help closing the gaps?

Talk to the Garbha.ai team about how your clinic handles records, consent and data.

Talk to Garbha Back to Compliance Hub
Also readART Act guide

Educational information, not legal advice. Last reviewed: .

Compliance Hub