Eight case-study modules, plus a free bonus module · ten quizzes · about six and a half hours · Rs. 9,999
13 May 2027: Is Your Clinic Ready for India’s Data Protection Law?
What already applies to your patients’ data today, what the new law starts on 13 May 2027, and the documents to have ready.
In short
Who it is for. Doctors who own or run a clinic, polyclinic, nursing home or small hospital in India, and the practice managers who keep its records.
What you learn. Which data rules bind your clinic today, what the DPDP Act and Rules switch on from 13 May 2027, and how to get ready: notices and consent, children, vendors, security, breaches, patients’ rights and the whole house.
What you get. Eight case-study modules, demonstration templates printed in full, ten scored quizzes, a free bonus module that plans backwards to 13 May 2027, and a certificate of completion. One payment, twelve months of access.
Module one and its quiz open without payment and without a card. The course is general education, not advice on any patient, clinic or live matter.
From 13 May 2027 the main duties of the Digital Personal Data Protection Act, 2023 and its Rules of 2025 apply to clinics, nursing homes and small hospitals that keep patients’ personal data in digital form, or digitise it later. Until then, the IT Act and the SPDI Rules of 2011 already apply to that data. This course follows one fictional clinic, Aamrai, and the care home it grows into, as it gets its patients’ data wrong and puts it right: the three dates and what each switches on; the notice and the consent at the desk; children, newborns and patients who cannot consent; records software, laboratories, booking apps and AI tools; security, retention and erasure; a breach, from the first hour to the 72-hour report the Rules ask for from 13 May 2027; patients’ rights and the grievance desk; and the whole house, staff, visiting consultants and cameras included. Each module ends with demonstration templates for learning, printed in full, to adapt in your own clinic with your own lawyer. The stories are built around real-life situations; names are illustrative. Where the law is not settled, the course says so and gives the safe course. It is general education, not advice on any patient, clinic or live matter, and finishing it does not make a clinic compliant with any law.
Prepared and taught by Dr. Rupal V. Rana, MBBS, DCH, LLB, LLM, Medicolegal Consultant and Founder, DoctorLawyer™, in consultation with a High Court advocate.
8case-study modules
10scored quizzes
45applied questions
51demonstration templates
6.7hours in total
12months of access
Module one freePrintable handout with every moduleCertificate of completion, see a sample
Rs. 9,999
One payment, no subscription and no renewal. Twelve months of access to all eight modules, every quiz, the final quiz and the certificate. A change of price never applies to a course you have already paid for.
Two ways in: enrol now below, or read module one and its quiz first, free and with no card. Either is fine, and one does not cost you the other.
Read module one first, freeNo card, nothing charged
Read module one before you buy
Not ready to decide? Module one and its quiz open without payment, so you can see the writing, the depth and the way the questions work first. No card, nothing charged, and nothing charged later unless you choose to buy.
What you will be able to do when you have finished
Not what you will have heard about. What you will be able to do, on a Tuesday, with the thing in your hand.
Give the three dates that matter, say what each one switches on, and name the rules that already bind your clinic today.
Write a patient notice and consent that a patient can follow at the desk, and plan for the patients you already have.
Handle children, newborns, adolescents who come alone and adults with a guardian, without delaying care.
Check and contract with your records software, laboratories, booking apps, AI tools and agencies, and know where your data sits.
Set access, logs, devices, retention and erasure rules, and answer a request to delete.
Run the first hour of a breach, tell patients, and prepare the report the Rules ask for from 13 May 2027.
Answer a patient’s request, a complaint, a relative, an insurer or the police in the right order.
Give everyone in a nursing home or small hospital a written part, and score your own clinic with a 25-point whole-house audit.
How much of your time this takes
About six and a half hours in total, and none of it has to be done in one sitting. The course remembers where you are, on whichever device you open it on, one device at a time.
Eight case studies, 32,886 words
about 183 minutes
51 demonstration templates, 19,387 words, to read now and adapt later
about 97 minutes
Ten quizzes, 45 questions, with the authority explained on every answer
about 75 minutes
The short cases and the authorities
about 31 minutes
The free bonus module: the countdown to 13 May 2027
about 16 minutes
Everything, 65,312 words
about 6 hours 42 minutes
Each module follows one fictional clinic through a decision, and the reading paths at the top of each module show which chapters matter most for your kind of practice.
How the course runsStart to certificate
1
Eight case-study modules. About twenty three minutes each, read in any order, at your own pace, on a phone or a laptop. Every legal proposition carries the case, section or regulation it rests on, so you can check it. Each module also leaves you a document you can use: a three dates card, a role sheet for who is answerable, a privacy policy for use until 13 May 2027, a data map, a 20-point clinic privacy audit, a planning calendar and an interim patient consent form; later modules add the notice and consent for 13 May 2027, children’s forms, a processor contract schedule, breach letters and a 72-hour drafting sheet, rights request and grievance templates, and whole-house rules for nursing homes.
2
A scored quiz at the end of each module. Five applied questions, not definitions: a situation, and what you would do. Four out of five to pass. Retake it as often as you like, and the authority is explained on every answer, right and wrong. Your best score is the one kept.
3
A final quiz across all eight modules. It opens once you have passed all eight module quizzes. Sixteen questions, two drawn from each module, twelve out of sixteen to pass. Your sixteen are not the same as anybody else’s. Retake it as often as you need.
4
A certificate of completion, issued once the eight module quizzes and the final quiz are all passed. It is signed by Dr. Rupal V. Rana, MBBS, DCH, LLB, LLM, and carries a number anyone you show it to can check on this site. It is a certificate of completion: not a diploma, not a certification, not recognised by any Medical Council, the National Medical Commission, any university or any Bar body, and it carries no continuing medical education credit.
The modules
01What changes on 13 May 2027, and what already appliesBy the end you will be able to give the three dates that matter and say what each one switches on; name the rules that already bind your clinic and explain why "nothing applies yet" is wrong; say which of your records the new Act reaches, including paper that is scanned later; explain the penalty figures as ceilings, and who carries them; and say what the Act takes away from patients on 13 May 2027 and which questions the law has not yet answered.Open first
02The notice and the consent, with the patient at the deskBy the end you will be able to say which two grounds s. 4 gives and why "treatment" is not a third; build a notice that a patient can follow on its own and that carries what s. 5 and r. 3 require; take a consent that meets s. 6(1) and keep the proof; handle withdrawal; plan for the patients and records you already have; and deal with online forms, software that stores data abroad, and emergencies.23 min
03Children, newborns and patients who cannot consentBy the end you will be able to say who consents, and who gets the notice, when the patient is a child; check a parent; read the Fourth Schedule exemption for clinics and say why a doctor should not lean on it; keep marketing, photographs and analytics away from children's data; and handle an adolescent who comes alone, a nursery, an adult who has a guardian, a video visit booked by someone else, and the months before 13 May 2027.23 min
04Your vendors: records software, labs, booking apps, AI tools and agenciesBy the end you will be able to say why a vendor's contract cannot move your responsibility to the vendor; tell a processor from a fiduciary in its own right, and know where that is still open; read a software vendor's terms for the clauses that matter; test roles, logs and the way out before you rely on a product; say what the law says about data stored abroad; and set rules for AI tools, including free pilots. Finishing this module does not make a clinic compliant: it gives you questions to put to your vendors, in writing.23 min
05Security, retention and erasureBy the end you will be able to say what "reasonable security safeguards" ask of a small clinic, paper and digital, today and from 13 May 2027; set roles, logs and device rules you can defend; decide how long each kind of record is kept and write down why; sort a deletion request; correct a record without altering it; and say which questions the law has not settled. Finishing this module does not make a clinic compliant: it gives you decisions to make and record.23 min
06Breach: the first hour, six hours and seventy-two hoursBy the end you will be able to say what counts as a personal data breach, including the small, human kinds; give the steps of the first hour and name who decides and who calls whom; say what the Rules require you to tell each patient and the Board, and when; explain why the clocks run from the clinic becoming aware and what that means for vendors and staff; place the CERT-In six-hour direction beside the Act, with its doubt; and explain the penalty figures as ceilings without promising that reporting protects anyone. Finishing this module does not make a clinic compliant: it gives you a plan you can practise.23 min
07Patients’ rights, the grievance desk and the BoardBy the end you will be able to say which patients have which rights over which data, and where they end; answer a request to see, correct or erase information; set up a grievance desk, with or without a website; act on a withdrawal that comes through a consent manager; handle a nomination; decide what to do when a relative, spouse, employer, insurer or police officer asks for records; and describe what happens at the Data Protection Board, promising no outcome. You will also have the finished wording for item 7 of the privacy notice. Finishing this module does not make a clinic compliant.23 min
08Nursing homes and small hospitals: staff, consultants and the whole houseBy the end you will be able to say who the Data Fiduciary is in a nursing home with visiting consultants and what to put in writing; explain what s. 7(i) does for staff data; say when a hospital must appoint a Data Protection Officer (only if notified); set up cameras, ward messaging and photographs you can explain to a patient; say why a recall list is not research; answer "can I be personally penalised?" by role; and audit the whole house. Finishing this module does not make a nursing home compliant: it completes the plan, and the free countdown module dates it.23 min
BThe countdown to 13 May 2027 Bonus, freeBy the end you will have a dated plan from November 2026 to 13 May 2027 that you can pin to the staff-room wall: which of the two dates matters to you, what to finish each month, which template in Modules 1 to 8 does each job, what to check in the last week, and what to do on the day. It is a plan to practise, not a promise. Finishing it does not make a clinic compliant, and the law or the dates may change: re-date the plan whenever you update it.Free bonus · 11 min
About the bonus module
The bonus module is included and costs nothing extra. It plans backwards from 13 May 2027: a wall chart, what to finish each month, which template does each job, the last week, the day itself and the first month after. It sits outside the eight: it is not in the final quiz and it is not needed for the certificate. It has its own scored quiz if you want one.
The small printEducation, not advice on your matter. Not clinical teaching. No outcome promised.
This is education, not advice on your matter. Nothing in the primer is advice about any particular patient, complaint, notice or case, and reading it does not create a relationship of adviser and client.
It is not clinical teaching. No module tells you how to treat anybody.
Nothing is promised as an outcome. No course prevents a complaint, and none of this guarantees how any forum will decide anything.
Where a matter needs a lawyer, we say so. Representation before any forum, and any formal legal opinion, is arranged separately with a High Court advocate and is charged separately.
The material is licensed to you alone. It may not be recorded, copied, shared, resold or circulated. Pages carry the name and email of the person they were issued to.
