DPDP for diagnostic labs

A diagnostic lab that keeps personal data in digital form is covered by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (s.3). Typical work: Sample collection, test reports, home collection, reports to referring doctors.

Where personal data sits

Collection centre desk
Phones used on home collection visits
Lab software (samples, reports and billing)

What Fohrkast maps

Patient name
Mobile number
Date of birth or age
Address
Test results and reports
Details of child patients and their parents
Bills and payment details
Staff names, phone numbers and salary records

Each use of the data is recorded as a purpose:

Tests and reports. Collect the sample, run the test and share the report with the patient and the referring doctor.
Home sample collection. Visit the address given to collect the sample.
Bills and payments. Make the bill and record the payment.
Health check offers. Send offers for health check packages by SMS.

Which duties weigh most

Children's data. A child is anyone under 18 (s.2(f)). Before using a child's personal data, a parent's verified consent is needed (s.9(1), Rule 10). Penalty up to ₹200 crore (s.33, Schedule item 3).
People who act through a guardian. For an adult with a disability who acts through a lawful guardian, the guardian's consent comes first, after checking the appointment (s.9(1), Rule 11).
Decisions and sharing. Data used to make a decision about a person, or shared with another Data Fiduciary, must be complete, accurate and consistent (s.8(3)).
Security safeguards. Encryption or masking, control over who opens the systems that hold personal data, access logs, backups, and logs kept for one year (s.8(5), Rule 6(1)). Penalty up to ₹250 crore (s.33, Schedule item 1).
Breaches. Every personal data breach, with no size threshold: each affected person and the Board told without delay, and the detailed report to the Board within 72 hours (Rule 7). Penalty up to ₹200 crore (s.33, Schedule item 2).
Requests. A person can ask to see a summary of the data held (s.11), have it corrected or erased (s.12), raise a grievance (s.13) or name a nominee (s.14).
Vendors. A vendor that handles personal data for the business needs a valid contract with reasonable security safeguards; the business stays responsible (s.8(1), s.8(2)).

Sector rules

The sector regulator's rules for a diagnostic lab: not set.

A short case

Case: not set. Figures: not set. Customers: not set.

When do the duties start?

Date	What starts	Gazette reference
13 Nov 2026	Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4).	G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3)
13 May 2027	Nearly every duty on businesses, and the Board's penalties.	G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4)

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.

Privacy Check: a look at the website's notices, trackers and forms.
Plans and prices in INR.
Book a demo.

Not legal advice.