On this page
- What the National Dental Commission Public Notice mandates on every prescription
- How the NDC prescription directive intersects with the DPDP Act and Rules
- Why pharmaceutical-sponsored tools and unbundled clinic consent matter
- Our view: a six-point compliance checklist for dental clinics and healthcare practices
- Common questions
- In the news
- Sources
On 23 October 2026, the Ethics and Dental Registration Board of the National Dental Commission, under the Ministry of Health and Family Welfare, Government of India, issued Public Notice F.No.NDC/EDRB/Public-Notice/2026/M-2749 directing all practising dentists across India to include nine mandatory particulars on every paper and electronic prescription, while explicitly advising dentists not to use prescription pads supplied, printed or sponsored by pharmaceutical companies. As dental clinics, multi-chair chains, hospital dental departments and practice-management software platforms update their physical letterheads and digital templates, those same prescription records also fall squarely within the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 when substantive Data Fiduciary obligations take effect on 13 May 2027.
What the National Dental Commission Public Notice mandates on every prescription
Signed by Lt. Gen. (Retd.) Tapas Kumar Bandyopadhyay, Member of the Ethics and Dental Registration Board at the National Dental Commission in New Delhi, the 23 October 2026 advisory directs that every prescription issued by a practising dentist—whether on paper or in electronic form—must carry nine specific particulars to ensure professional accountability, transparency and patient safety:
- Name of the Dentist: Exactly as recorded with the concerned State Dental Council.
- Active Registration Number: As allotted by the concerned State Dental Council.
- Recognised Dental Qualification(s): As recognised by the National Dental Commission or the erstwhile Dental Council of India, including dental specialty where applicable.
- Address of Practice: Complete postal address of the dentist's clinic or place of practice, including the PIN code.
- Emergency Contact Number: A functional contact number for urgent clinical communication.
- Patient's Relevant Particulars: The patient's Name, Age and Gender recorded on the prescription.
- Date of Prescription: Documented clearly during each patient attendance or visit.
- Dentist's Signature: A handwritten signature on paper pads or a legally valid digital signature on electronic prescriptions.
- Mandatory Stamping Requirement: Where the dentist's name, recognised dental qualifications and valid registration number are not pre-printed on the prescription pad, the prescription must bear a clear, legible stamp of the treating dentist containing all three particulars.
Alongside these nine particulars, Paragraph 3 of the Public Notice directs practising dentists not to use prescription pads supplied, printed or sponsored by pharmaceutical companies, requiring all prescriptions to be issued strictly on compliant clinic letterheads or electronic templates.
How the NDC prescription directive intersects with the DPDP Act and Rules
Every time a dental clinic records a patient's name, age, gender, mobile number, clinical diagnosis, dental X-ray or electronic prescription, the clinic or hospital acts as a Data Fiduciary processing digital personal data—or personal data collected on paper that is subsequently digitised into a clinic computer, billing ledger, WhatsApp message or cloud practice-management portal. The National Dental Commission's ban on pharmaceutical-sponsored pads and its standardisation of electronic prescription templates align directly with core data protection duties taking effect on 13 May 2027:
| NDC Public Notice M-2749 requirement | Clinical & personal data involved | Corresponding DPDP Act and Rules obligation from 13 May 2027 |
|---|---|---|
| Patient's Name, Age, Gender and Date of Prescription on paper or electronic pads | Patient identity, demographic details, visit timestamps, clinical notes and prescribed medication | Provide a standalone, plain-language privacy notice at clinic registration separating core treatment records from optional promotional outreach |
| Prohibition on prescription pads supplied, printed or sponsored by pharmaceutical companies | Prescription records, medication patterns, patient contact numbers and clinic prescribing logs | Never share identifiable patient prescription data with pharmaceutical representatives, marketing agencies or third-party sponsors without free, specific and unbundled consent |
| Electronic prescription templates and legally valid digital signatures | Cloud dental software databases, PDF e-prescriptions sent over WhatsApp or email, digital signature tokens | Engage practice-management software, cloud EHR and messaging gateway vendors only under a written Data Processor contract mandating reasonable security safeguards |
| Dentist's active registration number, qualification, clinic PIN code and emergency contact number | Verified practitioner identity, clinic postal address and urgent patient contact channel | Publish the business contact details of a designated privacy officer or person able to answer patient data queries and resolve grievances within 90 days |
| Medical emergencies and urgent dental care communications | Patient health history, allergy alerts and urgent prescription records | Permitted under the medical emergency and healthcare legitimate uses where strictly necessary to respond to a medical emergency or provide health treatment |
| Clinic prescription archives, audit trails and software access logs | Electronic prescription tables, chairside user logins, pharmacy dispatch records and backup copies | Protect stored records with encryption and role-based access controls, retain traffic and processing logs for at least one year, and report any personal data breach within 72 hours |
Why pharmaceutical-sponsored tools and unbundled clinic consent matter
In Indian outpatient and dental practice, pharmaceutical sponsorship has historically extended beyond printed paper pads to free or discounted clinic software, patient reminder portals and camp-registration forms. When a third-party sponsor supplies a digital tool or collects carbon copies of prescriptions, patient personal data can be siphoned into external marketing databases without the patient's knowledge. Under the DPDP Act, a dental clinic remains legally responsible as the Data Fiduciary for any processing carried out on its behalf, and bundling treatment intake with third-party promotional profiling or WhatsApp marketing is invalid.
Where a dental clinic treats patients under 18 years of age—such as paediatric dentistry or orthodontic care—the clinic must obtain verifiable consent from the parent or lawful guardian before processing the child's personal data outside statutory healthcare exemptions, and must ensure its patient portal or appointment app performs no behavioural tracking or targeted advertising aimed at minors.
Our view: a six-point compliance checklist for dental clinics and healthcare practices
In our view, independent dental clinics, multi-specialty dental chains, hospital outpatient departments and dental software vendors should combine immediate compliance with NDC Public Notice M-2749 and 13 May 2027 DPDP readiness in six practical steps:
- Audit and replace all physical prescription pads, rubber stamps and electronic prescription PDF templates so all nine NDC mandatory particulars—including State Dental Council registration number, recognised qualifications, PIN-coded clinic address and emergency contact number—appear legibly on every prescription.
- Remove all pharmaceutical-company-supplied prescription pads, branded stationery and sponsor-funded digital prescription widgets from clinics and reception desks.
- Place a standalone privacy and consent notice at the clinic reception desk and online booking page, with English and Eighth Schedule language availability, separating clinical record-keeping from optional recall reminders or cosmetic dentistry promotions.
- Sign written Data Processor agreements with your dental practice-management software provider, cloud radiography host, diagnostic lab partner and WhatsApp Business API vendor.
- Enable encryption, individual clinician logins and a minimum one-year security and access log retention policy across all electronic prescription and billing systems.
- Designate a clinic contact point to handle patient requests for access, correction or erasure of non-statutory marketing records—while retaining mandatory clinical and prescription records required by medical and dental regulations—within the 90-day grievance timeline.
Common questions
What are the nine mandatory particulars required on every dental prescription under the National Dental Commission Public Notice?
Every paper or electronic prescription must include the dentist’s name, active State Dental Council registration number, recognised dental qualifications, complete clinic address with PIN code, emergency contact number, patient’s name, age and gender, date of prescription, handwritten or valid digital signature, and a clear stamp if practitioner details are not pre-printed.
Why does the National Dental Commission prohibit pharmaceutical-sponsored prescription pads, and how does this relate to the DPDP Act?
The advisory directs dentists not to use prescription pads supplied, printed or sponsored by pharmaceutical companies to protect professional independence and patient safety. Under the DPDP Act, a dental clinic is a Data Fiduciary and must never leak or share identifiable patient prescription data with pharmaceutical sponsors or marketing agencies without free, specific and unbundled consent.
Does a dental clinic need a Data Processor contract with its electronic prescription software and WhatsApp reminder vendor?
Yes. Any cloud dental practice-management platform, electronic health record vendor, diagnostic laboratory portal or messaging gateway that processes patient prescriptions on the clinic’s behalf is a Data Processor and may be engaged only under a valid written contract mandating reasonable security safeguards.
How long must dental clinics retain electronic prescription security logs and how fast must patient grievances be answered?
From 13 May 2027, clinics and their software processors must retain personal data, associated traffic data and processing logs for a minimum of one year for security investigation purposes, report any personal data breach to the Board within 72 hours, and resolve patient privacy grievances within 90 days.
Next steps
- Check whether the DPDP Act applies to your business, free, in a few clicks
- How-to 09: Control your vendors, in the toolkit
- How-to 05: Ask properly, in the toolkit
- How-to 04: Set the rules, in the toolkit
- The free duties list, every duty in plain words
In the news
National Dental Commission Issues Public Advisory Cautioning Dentists Against Unethical Social Media Advertising and Patient Reels
The National Dental Commission (NDC) issued a public advisory warning dental practitioners and clinics against soliciting patients through promotional social media reels, before-and-after clinical photographs, paid influencer endorsements and commercial discounts.
DPDP Act & Rules takeaway: Posting identifiable patient dental photographs, X-rays or video testimonials on Instagram, YouTube or clinic websites violates both NDC ethical regulations and Section 6 of the DPDP Act unless backed by unbundled, revocable written consent.
Official Regulatory Notice Exhibit (NDC/EDRB Social Media & Patient Publicity Advisory (Oct 2026))
View statutory briefing illustration
Source & Courtesy Reference: Medical Dialogues / National Dental Commission (original report)NMC Introduces New Ethical Rules for Healthcare Advertising: Compliance Boundaries for Hospitals and Doctors in India
Examines the National Medical Commission's October 2026 ethical guidelines regulating hospital and practitioner public communication alongside NMC's directive permitting remote authentication of medical records via valid digital signatures.
DPDP Act & Rules takeaway: Hospitals and corporate healthcare chains must separate factual department listings from patient-targeted digital remarketing, which requires standalone DPDP Section 6 consent and prohibits health-condition ad retargeting.
Official Regulatory Notice Exhibit (NMC/EMRB Ethical Communication & Digital Record Authentication Guidelines (Oct 2026))
View statutory briefing illustration
Source & Courtesy Reference: Medical Dialogues / National Medical Commission (original report) The Indian PractitionerPublic Notice F.No.NDC/EDRB/Public-Notice/2026/M-2749: Advisory for Mandatory Particulars on Prescriptions Issued by Practising Dentists
The Ethics and Dental Registration Board (EDRB) of the National Dental Commission directed all practising dentists to include 9 mandatory particulars on every paper and electronic prescription and banned pharmaceutical-sponsored prescription pads.
DPDP Act & Rules takeaway: Maps to DPDP Act Section 5, Section 6, Section 8(2) and Rule 6: clinics must give standalone privacy notices, prohibit unauthorised pharma data sharing, sign Data Processor contracts with e-prescription vendors and keep 1-year security logs.
Official Regulatory Notice Exhibit (F.No.NDC/EDRB/Public-Notice/2026/M-2749)
View statutory briefing illustration
Source & Courtesy Reference: National Dental Commission (EDRB) / DCI (original report) Medical DialoguesNational Dental Commission mandates nine details for dental prescriptions, warns against pharma-sponsored pads
Medical Dialogues reported on the National Dental Commission EDRB public notice directing dentists to include nine mandatory particulars on paper and digital prescriptions and avoid pharmaceutical-sponsored pads.
DPDP Act & Rules takeaway: Directly triggers DPDP Act Data Fiduciary duties for dental clinics on patient intake notices, third-party pharma data isolation, and Data Processor contracts for e-prescription software.
View statutory briefing illustration
Source & Courtesy Reference: Medical Dialogues (original report)National Dental Commission directs dentists to include mandatory details on paper and e-prescriptions
Coverage of the National Dental Commission directive standardising practitioner registration, qualification, clinic PIN address, emergency contact and digital signature fields across dental prescriptions.
DPDP Act & Rules takeaway: Electronic prescription templates and clinic management apps must implement DPDP Rule 6 encryption, role-based access and minimum 1-year log retention from 13 May 2027.
View statutory briefing illustration
Source & Courtesy Reference: Docthub Healthcare News (original report)NMC Public Notices (Oct 2026): Remote Authentication of Medical Records via Digital Signatures & Ethical Hospital Communication Guidelines
The National Medical Commission issued October 2026 directives clarifying remote authentication of medical records using digital/electronic signatures and guidelines on ethical public communication by hospitals and registered medical practitioners.
DPDP Act & Rules takeaway: Hospital and clinic electronic health record systems using digital signatures must enforce DPDP Rule 6 access controls, 1-year audit logs, and unbundled patient consent before any promotional communication.
Official Regulatory Notice Exhibit (NMC/Whats-New/Oct-2026/1874)
View statutory briefing illustration
Source & Courtesy Reference: National Medical Commission (NMC) (original report) NMC Official Portal
Videos
Sources
Every section, rule and date above was checked against the official text on 27 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
- Section 3(a)Applies to digital personal data and personal data collected in non-digital form and subsequently digitised
- Section 5(1)Standalone privacy notice before or with every request for consent
- Section 6(1)Free, specific, informed, unconditional and unambiguous consent
- Section 7(f)Legitimate use for responding to a medical emergency involving a threat to life or immediate threat to health
- Section 7(g)Legitimate use for taking measures to provide medical treatment or health services during an epidemic or public health threat
- Section 8(2)Engaging a Data Processor only under a valid contract
- Section 8(5)Duty to protect personal data by taking reasonable security safeguards
- Section 8(6)Duty to notify the Board and each affected individual of a personal data breach
- Section 9(1)Verifiable parental consent and ban on tracking or targeted advertising for children under 18
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- Rule 3Standalone, plain-language consent notice requirements
- Rule 6(1)Encryption, access control, visibility logs, backups, one-year logs and processor contracts
- Rule 7(2)Detailed breach report to the Data Protection Board within 72 hours
- Rule 8(3)Minimum one-year retention of personal data, traffic data and logs
- Rule 14(3)Maximum 90-day period to respond to grievances
Notifications
- G.S.R. 843(E), clause (c)Substantive Data Fiduciary duties in force from 13 May 2027
A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.
