Every day, a diagnostic laboratory handles some of the most intimate information a person can share: name, phone number, address, medical history, prescriptions, and test results. Until recently, that data sat in a legal grey zone in India. It does not any more. The Digital Personal Data Protection (DPDP) Act, 2023 is now an operational law with notified Rules, an enforcement Board, and penalties that run into hundreds of crores of rupees.
If you run or manage a diagnostic lab, pathology centre, or radiology practice in India, this law applies to you. The good news is that most of what it asks for is what a well-run, digitally organised lab should already be doing. Here is a plain-language guide to what the DPDP Act means for labs, and how to get ready before the compliance deadlines arrive.
What the DPDP Act Is, in Plain Terms
Parliament enacted the DPDP Act on 11 August 2023. It is India’s first comprehensive data protection law, built on what the Ministry of Electronics and Information Technology (MeitY) describes as the SARAL approach: Simple, Accessible, Rational and Actionable. The law was given full operational effect when the government notified the DPDP Rules, 2025 on 14 November 2025.
The framework has a phased commencement schedule, published in the official gazette:
| Milestone | What comes into force |
|---|---|
| 14 November 2025 (Rules notified) | Setup provisions, including the Data Protection Board of India as a digital office |
| One year after notification (November 2026) | Provisions relating to Consent Managers |
| Eighteen months after notification (May 2027) | The core obligations for data fiduciaries: consent, notices, security safeguards, breach reporting, children’s data, and data principal rights |
That last row is the one labs should circle on their calendars. The full set of day-to-day obligations, from consent notices to breach reporting, takes effect around May 2027, which means the practical window to prepare is roughly the next six months, not years away.
Why Your Lab Is a “Data Fiduciary”
The Act assigns roles to everyone who touches personal data:
- Data Principal: the individual the data belongs to. In your lab, that is the patient (and for a child patient, the parent or lawful guardian).
- Data Fiduciary: the entity that decides why and how personal data is processed. A diagnostic lab clearly qualifies: you decide to collect a patient’s phone number and demographics so you can register samples, generate reports, and deliver results. That decision-making role makes you the data fiduciary, regardless of your lab’s size.
- Data Processor: an entity that processes data on your behalf. Your LIMS vendor, cloud hosting provider, or SMS/WhatsApp gateway typically acts as your data processor, not your co-fiduciary.
This distinction matters because the heavy obligations in the Act sit on the fiduciary, namely you. It also means outsourcing IT does not outsource accountability. If your cloud-hosted LIMS leaks patient data, the Board will come asking the lab first, not the vendor. Your contracts with vendors should reflect that reality, requiring them to follow your security instructions and assist with breach reporting.
Note the word “digital” in the Act’s title. It covers personal data collected in digital form and data collected on paper that is later digitised. Paper registration forms that get typed into your LIMS are inside the scope once they are digitised.
The Act’s Core Principles, Translated for Lab Workflows
MeitY summarises the law as resting on seven core principles. Here is what each one looks like in a laboratory setting:
| Principle | What it means in your lab |
|---|---|
| Consent and transparency | Patients must know what you collect, why, and how to say no |
| Purpose limitation | A phone number collected for report delivery cannot quietly become a marketing list without fresh consent |
| Data minimisation | Collect what the sample and report genuinely require, nothing more |
| Accuracy | Wrong patient demographics must be correctable quickly; a mismatched report is both a clinical and a compliance risk |
| Storage limitation | Keep records for the legally required period, then dispose of them |
| Security safeguards | Encrypt, restrict access, and monitor who touches patient data |
| Accountability | Be able to demonstrate, with logs and records, that you did all of the above |
Consent and Notices at the Front Desk
Consent under the Act must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. A pre-ticked box or a line buried in fine print does not count. Patients also have the right to withdraw consent at any time, and withdrawing must be as easy as giving it.
Before collecting data, the lab must give a notice describing the personal data being collected, the purpose, the way patients can exercise their rights, and how to complain. The Rules require this as an itemised notice in clear, simple language, available in English or any of the 22 languages listed in the Eighth Schedule of the Constitution, so a notice in the language your walk-in patients actually read is encouraged.
There is a sensible human exception built in. No consent is needed when processing is necessary to respond to a medical emergency, an epidemic, or a threat to the life of the patient. A lab running urgent samples at 2 AM does not need to pause for a signature.
Children’s Data: A Special Duty for Pediatric Labs
The Act treats anyone under 18 as a child. Processing a child’s personal data requires verifiable consent from the parent or lawful guardian, and the Act prohibits tracking, behavioural monitoring, and targeted advertising directed at children.
For labs, this touches some very common workflows: pediatric blood draws, newborn screening, and school health camps. If a 16-year-old walks in for a test, the registration system should be able to flag the age, capture verifiable parental consent, and keep the consent artefact on record. The Rules do provide limited class-based exemptions for certain fiduciaries and purposes, so it is worth checking whether your workflows qualify, but the safest default is to build the guardian-consent step in.
Security Safeguards the Rules Now Spell Out
The Act requires “reasonable security safeguards”, and the Rules translate that into concrete measures: encryption of personal data, masking or tokenisation of identifiers, access controls, and monitoring, with processing logs retained for at least one year.
Mapped to lab systems, the practical list looks like this:
- Encryption: patient records and reports encrypted at rest and in transit; online report links that expire rather than permanent public URLs.
- Access control: role-based access in your LIMS, so a billing clerk cannot browse pathology results and a phlebotomist cannot export the patient database.
- Audit logs: a record of who viewed or modified which record, retained and reviewable. Modern LIMS software already maintains these trails; the Rules make them a legal requirement.
- Masking and tokenisation: masking patient identifiers in dashboards, exports, and third-party integrations wherever the full detail is not needed.
Whether you host on the cloud or on your own server is not what the law judges; both can comply or fail. What matters is that the safeguards above exist and are demonstrable. If you are weighing cloud vs on-premise LIMS, add “who configures encryption, backups, and access control correctly” to your evaluation criteria, not just price.
If Data Leaks: Breach Reporting Duties
When a personal data breach occurs, such as a leaked patient list, an exposed report link, a stolen backup, or a misdirected WhatsApp message containing another patient’s report, the lab must intimate every affected patient without delay, in plain language, explaining what happened, the likely consequences, and the mitigation steps, along with a contact for help. A detailed report must also go to the Data Protection Board of India within 72 hours of the lab becoming aware, covering the causes, the data affected, and the remediation, though the Board can allow more time in specific cases.
Labs already live under a second, faster clock: CERT-In’s 2022 directions require reporting certain cyber security incidents to CERT-In within six hours of noticing them. A breach at a lab of any size can therefore trigger two parallel reporting duties, which is why a written incident runbook, tested at least once, is worth more than any policy document.
Patient Rights Your Lab Must Answer
Patients gain enforceable rights over their data, and the Rules require fiduciaries to act on their requests within 90 days:
- Access and information: a summary of what personal data you hold and what you are doing with it.
- Correction and updating: fixing misspelled names, wrong ages, or outdated phone numbers.
- Erasure: deletion of data when the purpose is served. Labs get a legitimate relief here: erasure is not required where retention is mandated by other laws, such as the record-keeping requirements that come with NABL accreditation and ISO 15189-aligned document control. Your retention policy should state the legal basis for each record class.
- Nomination: a patient can nominate another person to exercise these rights on their behalf, which matters for elderly or seriously ill patients.
- Grievance redressal: a working channel to raise complaints, and the Rules require you to publish a contact point (a designated officer or Data Protection Officer) for data-related questions.
What Non-Compliance Can Cost
The penalties are graded by severity, per the government’s own summary of the Act:
| Violation | Maximum penalty |
|---|---|
| Failure to maintain reasonable security safeguards | Up to ₹250 crore |
| Failure to notify a personal data breach (to the Board or affected individuals), and violations of children’s data obligations | Up to ₹200 crore |
| Any other violation of the Act or Rules | Up to ₹50 crore |
Questionable small lapses, a missing notice, an unactioned correction request, fall in that last band, and the Board considers the nature and gravity of the violation. But the direction of travel is clear: patient data handled casually now carries real financial risk.
A Practical Readiness Checklist for Labs
- Map your data flows: list every place patient data enters, lives, and leaves the lab: registration desk, LIMS, report PDFs, WhatsApp and SMS gateways, backup drives, and third-party portals.
- Rewrite your consent and notice text: itemised, plain-language, and tied to the purposes you actually use, especially for online report delivery.
- Audit access: review LIMS user roles monthly and remove dormant accounts. Turn on audit logs if they are off.
- Fix your vendor contracts: name your LIMS, cloud, and gateway providers as data processors with explicit security obligations.
- Build a children’s workflow: age flag at registration plus verifiable guardian consent for under-18 patients.
- Publish a data contact: designate a person (or DPO) and display the contact for data-related queries.
- Write the breach runbook: who decides it is a breach, who calls the patients, who files to the Board within 72 hours, who reports to CERT-In within 6.
- Set the internal deadline: aim to be fully ready by early 2027, before the May 2027 commencement of the core obligations, not after.
The Bottom Line for Laboratories
The DPDP Act does not ask labs to become lawyers. It asks them to do concretely what good laboratory practice already implies: know what patient data you hold, tell patients the truth about it, collect only what you need, lock it down, fix it on request, and speak up quickly when something goes wrong. A modern LIMS that enforces role-based access, audit trails, encrypted deliveries, and consent capture turns most of that list into configuration rather than effort.
If you are reviewing your lab’s systems against these requirements, IdLabNet, IdeativeMind’s LIMS for diagnostic laboratories, is built around exactly these controls, and the IdeativeMind team can help you map your current setup to the DPDP obligations.
References
- Digital Personal Data Protection Act, 2023, Ministry of Electronics and IT: meity.gov.in (Act PDF)
- PIB Backgrounder, “DPDP Rules, 2025 Notified” (November 2025): pib.gov.in
- CERT-In Directions, 2022: cert-in.org.in
By
