DPDP Act 2023 and Children's Health Data: A Clinic's Guide
Short answer: Under India's Digital Personal Data Protection (DPDP) Act 2023, anyone under 18 is a child, and a clinic must obtain verifiable consent from a parent or lawful guardian before processing a child's personal data, except where processing is needed to provide healthcare. Clinics must also use reasonable security safeguards, collect only what they need, report personal data breaches, and let parents access and correct records. Choosing software with access controls, audit trails and data export covers much of the practical burden.
A pediatric clinic handles nothing but children's data, which puts it squarely in the part of the DPDP Act with the strictest rules. This is a practical summary for clinic owners, not legal advice; confirm specifics with a lawyer as the DPDP Rules are phased in.
In this guide
- Five duties that matter for a pediatric practice
- Where paper and Excel clinics are most exposed
- Frequently asked questions
Five duties that matter for a pediatric practice
1. Parental consent
For a patient under 18, consent comes from the parent or guardian. Record who gave it and when. Healthcare delivery has specific exemptions, but routine marketing messages to parents do not.
2. Purpose limitation
Data collected to treat a child should be used for that. Using the list to promote a new service needs separate consent.
3. Reasonable security safeguards
Password-protected, role-based access; no shared logins; no patient data in personal WhatsApp groups or unencrypted spreadsheets on a front-desk PC.
4. Breach notification
A personal data breach must be reported to the Data Protection Board and affected individuals. You can't report what you can't detect, so logs matter.
5. Access and correction
Parents can ask to see and correct their child's data. A parent portal makes this routine instead of a front-desk request.
Where paper and Excel clinics are most exposed
- Registers left open at reception
- Excel files emailed between staff or copied to pen drives
- Prescriptions photographed on personal phones
- No record of who viewed or changed what
Teen patients add a layer of nuance around what parents should see; we cover that in parent portals and teen privacy.
PediaNex keeps records in access-controlled cloud storage with clinic-only visibility and parent-only portal access.
Book a walkthroughFrequently asked questions
Who counts as a child under the DPDP Act?
Under the Digital Personal Data Protection Act 2023, a child is any individual who has not completed 18 years of age.
Does a pediatric clinic need parental consent to store records?
Processing a child's personal data generally requires verifiable consent from a parent or lawful guardian, with certain exemptions for providing healthcare; clinics should still record consent at registration.
Is keeping patient data in Excel compliant with DPDP?
Excel files are hard to secure: they get copied and emailed, have no access control and no audit trail, which makes meeting the Act's reasonable security safeguard duty difficult.
Does the DPDP Act apply to small clinics?
Yes. The Act applies to any entity processing digital personal data in India, regardless of size.
See access-controlled pediatric records in action.
Twenty minutes, real workflow, no script. Or start the 15-day free trial.
Book a walkthrough or chat with us on WhatsApp →