Digital marketing for doctors in Bangalore: what the DPDP Act requires before you re-contact a patient

Digital marketing for doctors in Bangalore: what the DPDP Act requires before you re-contact a patient

Not yet in full legal force, but close enough that a Bangalore clinic should not wait to act on it. India's Digital Personal Data Protection Act, 2023 makes consent the basis for using a patient's phone number or email to contact them again, whether that is a WhatsApp appointment reminder, a newsletter, or a remarketing list rebuilt from an old enquiry form. The government's own phased rollout, set out when it notified the DPDP Rules in November 2025, does not bring the actual notice-and-consent obligations into force until 14 May 2027, which is exactly why most clinics have not built the habit yet.

What the Act says about health data

The assumption most clinics carry over from talking about GDPR is that health information gets a stricter, separate category of protection. India's law does not work that way. The Digital Personal Data Protection Act, 2023 does not distinguish between ordinary personal data and sensitive personal data the way the European regulation does. A patient's phone number sits under the same consent requirement as anyone else's phone number. That is not a loophole a clinic can lean on, though, because the number was still collected for one purpose, booking an appointment, and using it for a second purpose, a marketing broadcast, is the part the law is built to catch.

The phased timeline, and where late 2026 sits on it

The DPDP Rules were notified on 13 November 2025 and published in the Gazette the following day, and the government attached three separate commencement dates to different parts of them rather than switching the whole law on at once. Provisions covering the Act's basic commencement and the establishment of the Data Protection Board took effect immediately, on 14 November 2025. Registration of Consent Managers and the Board's enforcement powers follow twelve months later, on 14 November 2026. The substantial part, the actual notice-and-consent requirements, breach reporting, and security safeguard obligations, only come into force eighteen months out, on 14 May 2027, as the law firm Shardul Amarchand Mangaldas laid out in its breakdown of the enforcement schedule. A Bangalore clinic reading that timeline in late 2026 is sitting in the gap: the law exists, the enforcement body exists, and the specific rule that would penalise a sloppy consent process has not taken effect yet.

What a consent notice has to contain once it does apply

That gap is not an argument for waiting. The notice a data fiduciary, which is what a clinic becomes the moment it holds a patient's contact details, has to give under the Rules must be clear and specific: the purpose of processing, the categories of data being collected, how long it will be kept, and a working way to withdraw consent. Building that structure now, while nobody is checking, costs far less than retrofitting it under a live deadline in 2027 with a backlog of patient contacts that were never asked a clean question in the first place.

Why a clinic's list is a sharper case than a retailer's

A shop collecting a customer's number for a loyalty programme and a clinic collecting a patient's number for an appointment are legally similar cases with a very different feel to them, and that feel matters for how carefully the consent should be worded. Neospinex, the spine and neurosurgery practice in North Bangalore, and Chitra's Lifeline Clinic in Yelahanka New Town are the kind of practices where this distinction is not academic: a patient calling to book a spine consultation has not automatically agreed to a promotional message about a dermatology service months later, even if both numbers sit in the same clinic database. Treating appointment-logistics consent and marketing consent as one and the same is the mistake the coming rules are aimed at.

What to set up before the deadline, not after

The practical fix is smaller than it sounds. Ask once, at the point of first contact, whether a patient wants appointment reminders only or is also fine hearing about other services, and keep those as two separate yes-or-no answers rather than one blanket agreement. Note when and how each consent was given, even something as simple as a timestamped tick box on the booking form, because that record is what a clinic would need to show if ever asked. Make the opt-out at least as easy as the opt-in was, one reply or one tap, not a phone call during clinic hours. None of this needs new software. It needs the booking form and the WhatsApp Business setup to stop assuming that one number means one blanket permission, which is the same discipline our piece on WhatsApp Business reminders for Bangalore clinics argued for from the ethics side. Studio Happens builds this consent structure into the marketing setup we run for Bangalore doctors and clinics, so the patient list a clinic is remarketing to in 2027 is one it can defend.

Frequently asked questions

Does the DPDP Act give patient health data special protection?

No. Unlike the EU's GDPR, India's DPDP Act, 2023 does not create a separate category for sensitive personal data. A patient's contact details are covered by the same consent rule as any other person's, which still requires a valid, purpose-specific basis for using them.

Is the DPDP Act already enforceable against a Bangalore clinic?

Partially. The Act and Data Protection Board commenced on 14 November 2025, but the core notice-and-consent, breach-reporting, and security obligations are scheduled to take effect only on 14 May 2027 under the phased Rules.

Can a clinic use appointment booking numbers for marketing messages?

Not on the same consent that covered the booking. Using a number collected for appointment logistics to send unrelated promotional content needs its own, separately recorded consent, since the two count as different purposes under the law.

What should a clinic do now if the deadline is still over a year away?

Split appointment-only consent from marketing consent on every booking form and WhatsApp opt-in, record when each was given, and make opting out simple. Building the habit before enforcement starts is cheaper than fixing a backlog after it does.

Studio Happens, Bangalore's go-to affordable digital marketing partner, can help you get started today.