Is a therapist a data fiduciary under the DPDP Act?

Yes, when you decide why and how your clients' personal data is processed (section 2(i)). In a clinic, the clinic usually decides and is the fiduciary, and its software providers are processors.

Do I need consent to keep session notes?

Plan on it. The Act's uses without consent cover medical emergencies and public health threats, not routine therapy. Consent has to be specific and informed, so explain what you keep and why before you start.

How long should I keep therapy notes?

The DPDP Act sets no single period for therapy notes: it asks you to erase data once the purpose is served unless another law requires you to keep it, and the 2025 Rules ask you to keep data and logs for at least one year. Check with your professional council and your lawyer, and write the period you choose into your intake information.

Do the duties apply to a solo practice?

Yes. The Act does not exempt small practices from the security, breach or erasure duties. Extra duties apply only to the "significant" data fiduciaries the government names.

Guide

Storing client notes under the DPDP Act

Published 20 October 2026Updated 23 October 2026

How should therapists in India store client notes under the DPDP Act?

Treat client notes as personal data you are answerable for: collect only what therapy needs, keep notes where only the people treating the client can open them, protect them with encryption, access control and logs, and erase them once they are no longer needed unless a law says to keep them. Most of the DPDP Act's duties start on 13 May 2027, but for mental health care the Mental Healthcare Act 2017 already requires confidentiality, including for digital records.

What the DPDP Act asks of a therapist

Under the Digital Personal Data Protection Act, 2023, whoever decides why and how personal data is processed is the data fiduciary (section 2(i)). For a solo therapist that is you; in a clinic it is usually the clinic. Software that stores notes for you is a data processor (section 2(k)), and you may engage one "only under a valid contract" (section 8(2)). You stay responsible for what your processor does (section 8(1)).

Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and limited to the data the purpose needs (section 6(1)).
You must protect the data "by taking reasonable security safeguards to prevent personal data breach" (section 8(5)).
If a breach happens, you tell the Data Protection Board and each person affected (section 8(6)).
Unless a law requires you to keep it, you erase the data once consent is withdrawn or the purpose is no longer served, whichever is earlier, and make your processor erase it too (section 8(7)).
A child is anyone under 18, and their data needs verifiable consent from a parent (sections 2(f) and 9(1)). The 2025 Rules exempt a healthcare professional or clinical establishment from this when the processing is limited to providing health services to the child, to the extent needed to protect the child's health.

The Act has no separate category for health data. Its "legitimate uses" without consent cover medical emergencies and public health threats (section 7), not routine therapy, so plan on consent. The penalty for failing to take reasonable security safeguards can reach two hundred and fifty crore rupees (Schedule, item 1).

When the duties start

The DPDP Rules, 2025 were notified on 13 November 2025. Rule 1 brings the security, breach and retention rules (Rules 3 and 5 to 16) into force eighteen months after publication, which is 13 May 2027. The Act's main duties to data fiduciaries follow the same eighteen-month timeline. Until then, section 43A of the IT Act and its 2011 rules on sensitive personal data still apply; the DPDP Act removes them only when its section 44(2) starts.

Use the time to set up good habits rather than waiting, and check the current position with your lawyer if you run a larger practice.

What the security rule lists

Rule 6 sets the minimum safeguards a data fiduciary must take:

"encryption, obfuscation, masking or the use of virtual tokens" for the data,
access controls over who can open it,
"appropriate logs, monitoring and review" of access,
backups so that work can continue after an incident,
keeping those logs for a period of one year, and
a clause in your contract with any processor that requires the same safeguards.

Rule 7 asks you to tell affected people about a breach without delay, and to send the Board a detailed report "within seventy-two hours of becoming aware of the breach". Rule 8(3) asks you to keep personal data, traffic data and logs for at least one year from the processing, unless another law requires longer.

Mental health records: confidentiality already applies

For mental health care, the Mental Healthcare Act, 2017 gives a person with mental illness "the right to confidentiality in respect of his mental health, mental healthcare, treatment and physical healthcare" (section 23(1)), and section 24(2) says this "shall also apply to all information stored in electronic or digital format in real or virtual space". Section 25 gives the person a right to access their basic medical records; the professional may withhold specific information that would cause serious mental harm or a likelihood of harm to others, and must then tell the person they can apply to the Mental Health Review Board.

A practical checklist

Write down what you collect about clients and why. Leave out anything therapy does not need.
Explain in plain words, at intake, what you keep, who can see it and how long you keep it, and record the client's consent.
Keep notes in one place where each person sees only what their role needs. Avoid shared drive links, photos of notes on your phone and notes sent over chat.
Lock your devices, use strong, unique passwords and turn on two-step sign-in wherever your tools offer it.
Sign a data processing agreement with any software that stores client data, and check it covers security safeguards and erasure.
Decide in advance who you will tell, and how, if something goes wrong, so a report can reach the Board within 72 hours.
Set a retention period, erase notes when it ends unless a law requires you to keep them, and keep invoices for as long as tax law asks.
Have a way to answer a client who asks to see their records.

How Bliss helps

Every Bliss workspace accepts a Data Processing Addendum that names the clinic as the data fiduciary and Bliss as its processor.

Session notes open only for the therapist who wrote them, their supervisor, and clinic owners and admins. The front desk never can, and each note keeps a history of who opened or changed it, without holding what it says.

Client documents are kept in a private bucket in Oracle Cloud's Mumbai region and open only through links that expire within minutes.

Clinics can export their data, and an owner can permanently erase an archived client's personal and clinical data.

Questions people ask

Is a therapist a data fiduciary under the DPDP Act?: Yes, when you decide why and how your clients' personal data is processed (section 2(i)). In a clinic, the clinic usually decides and is the fiduciary, and its software providers are processors.
Do I need consent to keep session notes?: Plan on it. The Act's uses without consent cover medical emergencies and public health threats, not routine therapy. Consent has to be specific and informed, so explain what you keep and why before you start.
How long should I keep therapy notes?: The DPDP Act sets no single period for therapy notes: it asks you to erase data once the purpose is served unless another law requires you to keep it, and the 2025 Rules ask you to keep data and logs for at least one year. Check with your professional council and your lawyer, and write the period you choose into your intake information.
Do the duties apply to a solo practice?: Yes. The Act does not exempt small practices from the security, breach or erasure duties. Extra duties apply only to the "significant" data fiduciaries the government names.