DPDP Act and Patient Photos: A Guide for Aesthetic Clinics

Every aesthetic and dermatology clinic in India holds some of the most personal data there is: photographs and scans of patients' faces and bodies, often linked to their names, phone numbers and treatment history. India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025 put clear obligations around that data.

This guide explains what they mean in practice. It is general information, not legal advice; take advice specific to your clinic.

The timeline

• August 2023: the DPDP Act received assent.
• 13-14 November 2025: the DPDP Rules, 2025 were notified, with a phased rollout. Provisions setting up the Data Protection Board took effect immediately.
• November 2026: provisions on registration of consent managers come into force.
• May 2027: most substantive obligations apply, including notice and consent, security safeguards, breach reporting, data principal rights and retention rules.

That gives clinics a short runway. Systems, forms and vendor contracts take time to change, so starting now is sensible.

Key roles

• Data principal: the patient whose data it is (or a parent or guardian for a child).
• Data fiduciary: the entity that decides why and how data is processed. For patient images, that is usually the clinic.
• Data processor: an entity that processes data on the fiduciary's behalf, such as an imaging, EMR or cloud provider.

The fiduciary carries primary responsibility, including for what its processors do.

What it means for patient images

1. Clear notice and specific consent

Before capturing images, tell the patient in clear language what you will capture, why, how it will be stored, who will see it and how they can withdraw consent or ask for deletion. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Keep a record.

Use separate consent for marketing or social media use. See patient consent for clinical photography.

2. Purpose limitation

Use images only for the purpose the patient agreed to. Clinical documentation consent does not cover marketing, training sales staff or sharing with third parties.

3. Reasonable security safeguards

The Act requires reasonable security safeguards to prevent breaches, and failure to take them attracts the highest penalty band in the Act, up to ₹250 crore. In practice, that means:

• encryption in transit and at rest,
• role-based access with logging,
• no patient images on personal phones or messaging apps; see stop storing patient photos on staff phones,
• separation of images from identifying details where possible,
• written contracts with processors.

4. Breach reporting

If a personal data breach occurs, the Rules require intimation to the Data Protection Board and to affected patients, with a detailed report to the Board within 72 hours of becoming aware. You need to know where your images are to know whether they have been breached.

5. Patient rights

Patients can ask to access, correct or erase their data, and to withdraw consent. You need a simple way to find all images of a patient and act on such requests, while respecting any medical record retention obligations that apply to you.

6. Children's data

For patients under 18, verifiable consent from a parent or guardian is required. This matters for teenage acne and dermatology patients.

7. Retention

Do not keep data longer than needed for the purpose, subject to legal retention requirements. Set and document a retention policy.

A clinic checklist

1. Map where patient images live today: devices, drives, apps, vendors.
2. Move all images into one secure system linked to the patient record.
3. Rewrite consent forms with separate clinical and marketing consent.
4. Set role-based access and turn on access logs.
5. Sign data processing agreements with every vendor that touches images.
6. Write a breach response plan, including who reports and how.
7. Create a process for access, correction and deletion requests.
8. Train every staff member who handles images.
9. Review annually.

Questions to ask your imaging vendor

• Where is data stored and processed? In India or abroad?
• Is data encrypted in transit and at rest?
• Is consent recorded with each capture?
• Are images stored separately from names?
• Is every view logged, with role-based access?
• Is patient data used to train the vendor's models?
• How are deletion requests handled?
• Will you sign a data processing agreement?

How Edebo approaches this

Edebo was built for the DPDP Act from the start: consent is recorded with every scan; data is encrypted with TLS 1.3 in transit and AES-256 at rest; scans are kept apart from names; access is role-based and every view is logged; data is stored and processed in India; scans are never used to train our models; and data is deleted on request. For the wider question of choosing a system, see 3D imaging rig vs smartphone.

Sources

• Press Information Bureau, DPDP Rules, 2025 notified (November 2025). pib.gov.in

Frequently asked questions

Does the DPDP Act apply to clinic patient photos?

Yes. Clinical photos and 3D scans of identifiable patients stored digitally are personal data. The clinic that decides how they are used is a data fiduciary under the DPDP Act, 2023.

When do DPDP obligations take effect for clinics?

The DPDP Rules were notified in November 2025 with phased implementation. Most core obligations, including notice and consent, security safeguards, breach reporting and data principal rights, apply from May 2027.

Is my imaging software vendor responsible under the DPDP Act?

A vendor that processes data on the clinic's behalf is a data processor. The clinic, as data fiduciary, remains responsible for compliance and should have a written contract setting out the processor's obligations.

Edebo is a measurement and visualisation tool, not a diagnostic device. Clinical decisions remain with the treating practitioner.