DPDP Compliant Software for Therapists in India (2026)

By [author name], reviewed by [reviewer]. Last verified: [date]. This article is general information, not legal advice.

The short answer

No software is "DPDP compliant" on its own. Under India's Digital Personal Data Protection Act, 2023, you, the therapist or clinic, are the data fiduciary, the party responsible for client data. Software can make compliance much easier by giving you consent records, access controls, encryption, audit trails and deletion tools. It cannot do it for you. A good DPDP-ready practice platform helps you meet the law's duties; a poor one leaves you with gaps you may not see until something goes wrong.

Why this matters for therapists specifically

Your records are among the most sensitive things a person can hand over: diagnoses, trauma histories, family details, session notes. Three facts make this urgent:

• The Act covers digital personal data collected in India, including client names, phone numbers, appointment histories and notes held in apps, spreadsheets, WhatsApp and email. [VERIFY]
• Most obligations are expected to apply from May 2027, about 18 months after the Rules were notified in November 2025. [VERIFY the exact dates and the phase-in against the official notification.] That is not far off if you need to migrate data or change tools.
• Penalties can be large. Failing to maintain reasonable security safeguards can attract a penalty of up to ₹250 crore under the Act's schedule. [VERIFY] A solo practice is unlikely to see that figure, but it shows how seriously the law treats security failures.

Health data is not a separate "sensitive" category under the Act. All digital personal data is covered, and in practice therapy data deserves the highest care anyway. [VERIFY]

If you want the law explained first, read DPDP Act: what therapists need to know.

What the law expects of you (in plain language)

Duty	What it means in your practice	What software should help with
Notice and consent	Tell clients what data you collect and why, and get clear consent in plain language	Consent forms inside intake, timestamped consent records
Purpose limitation	Use data only for the purpose you stated	Role-based access; no reuse for marketing without consent
Data accuracy	Keep records correct and up to date	Easy client record edits with history
Security safeguards	Protect data from loss, theft and misuse	Encryption, strong login, access logs, backups
Breach notification	Tell the Data Protection Board and affected clients about a breach	Audit logs to find out what happened and when
Retention and erasure	Delete data when it is no longer needed or when consent is withdrawn	Deletion and export tools, retention settings
Clients' rights	Let clients access, correct and erase their data and nominate someone	A way to export a client's record and process requests
Children's data	Verifiable parental or guardian consent for anyone under 18	Guardian consent field in intake [VERIFY]
Grievance redressal	Publish contact details for complaints	A contact point shown in client forms

Counsellors working with children and adolescents should pay special attention to the children's data rule, since most of their clients fall under it. [VERIFY]

10 questions to ask any therapy software vendor

Use this as a checklist when comparing tools. A vendor that can't answer clearly is giving you an answer.

1. Where is my client data stored? The country and cloud provider should be stated. The Act allows transfers abroad except to countries the government restricts, but you should know where your data lives. [VERIFY]
2. Is data encrypted? Ask about encryption in transit (HTTPS) and at rest, and whether session notes get extra protection.
3. Who at the vendor can see my notes? Look for a clear answer on staff access, and whether it's logged.
4. Can I record and show client consent? Consent should be timestamped and tied to the client record.
5. Can I control who sees what? Role-based access matters for clinics: front desk, therapists and admins should see different things.
6. Is there an audit log? If something goes wrong, you need to know who opened which record and when.
7. Can I export and delete a client's data? You need this to answer access and erasure requests.
8. What happens to my data if I leave? Ask for export formats and the vendor's deletion timeline after you cancel.
9. How does the vendor handle a breach? Ask for the notification process and timeline, and whether they will support you in notifying clients.
10. Do they sign a data processing agreement? Because you remain responsible, a written agreement on how the vendor handles your clients' data is sensible.

Red flags

• "100% DPDP compliant" with no detail. Compliance depends on how you use the tool.
• No clear data location, or storage you can't verify.
• Notes sent through ordinary WhatsApp, email or shared Google Sheets. These are hard to secure, audit or delete cleanly.
• No way to export or delete a client's record.
• Shared logins for clinic staff.
• No privacy policy or grievance contact on the vendor's site.

Everyday tools: how they compare

Tool	Consent records	Access control	Audit trail	Delete on request
Paper files	Paper forms	Locked cupboard	None	Shredding
WhatsApp, email, spreadsheets	Messy	Weak	None	Hard
Generic calendar or booking tool	Limited	Limited	Limited	Partial
Purpose-built therapy practice software	Built in	Role-based	Yes	Yes

The gap between the rows is why purpose-built software helps. It isn't a guarantee, but it is far easier to defend.

How PsychDesk supports DPDP compliance

[CONFIRM every line below before publishing. Delete anything the team cannot prove.]

PsychDesk is practice management software built for therapists and clinics in India. It is built to support your DPDP compliance, in these ways:

• Consent: [CONFIRM: consent captured at intake and stored with a timestamp]
• Access control: [CONFIRM: role-based access across Basic, Standard and Clinic+ plans]
• Encryption and security: [CONFIRM: encryption in transit and at rest; describe exactly]
• Data location: [CONFIRM: where data is hosted]
• Export and deletion: [CONFIRM: how a client's record is exported or erased]
• Compliance statements: [CONFIRM: approved wording for HIPAA, GDPR and DPDP]

See clinical documentation and pricing. Plans: Basic ₹799/month (10 clients, 1 seat), Standard and Clinic+ on request, with a 30-day free trial. [CONFIRM current plan details.]

A 30-minute DPDP readiness plan for your practice

1. List where client data lives today (notebooks, phone, WhatsApp, email, laptop, apps). This takes 10 minutes and is usually surprising.
2. Pick one system of record and move client data there. Stop keeping copies in chats and spreadsheets.
3. Update your intake form with a clear purpose, consent line and a way to reach you about data requests.
4. Set access rules for anyone who works with you (receptionist, associate, supervisor).
5. Decide how long you keep records and write it down. Your professional council's guidance may set minimum retention periods. [VERIFY]
6. Write a one-page breach plan: who you'd tell, and how, within what time.
7. Review once a year, or whenever you change tools.