Quick answer
Under the Digital Personal Data Protection Act, 2023, a diagnostic lab is a Data Fiduciary for its patients’ data. The DPDP Rules, 2025 (notified 13 November 2025) bring most duties into force around May 2027: clear notices, reasonable security safeguards, one-year access logs, breach reports to the Data Protection Board within 72 hours, and a grievance contact. Penalties reach ₹250 crore.
Key takeaways
- Your lab is the Data Fiduciary; your software vendor is a Data Processor.
- Most duties apply about 18 months after 13 November 2025, i.e. around May 2027.
- Report breaches to the Board within 72 hours and tell patients without delay.
- Keep access logs for at least one year.
- Penalties go up to ₹250 crore for weak security.
What the DPDP Act means for a lab
The Digital Personal Data Protection Act, 2023 is India’s general privacy law. It covers any digital personal data, and a lab handles plenty: names, phone numbers, addresses, ages, test orders and results. Under the Act your lab is a Data Fiduciary: you decide why and how patient data is processed. Your software or cloud vendor is a Data Processor acting on your behalf, but the legal responsibility stays with you.
The DPDP Rules, 2025, notified on 13 November 2025, set out how the Act works in practice. They come into force in stages.
Timeline: what applies when
| When | What comes into force |
|---|---|
| 13 Nov 2025 | Data Protection Board and its procedures |
| 13 Nov 2026 | Registration and duties of Consent Managers |
| About 13 May 2027 (18 months) | Most duties for labs: notices, consent, security safeguards, breach reporting, retention and erasure, grievance handling |
Your main duties as a lab
- Notice and consent. Before collecting data, give a notice in clear language that lists the data, the purpose, how to withdraw consent and how to complain to the Board. Data needed for medical treatment or a medical emergency can also be processed under the Act’s “legitimate uses”.
- Reasonable security safeguards. The Rules name measures such as encryption, masking or tokens, access control, access logs, monitoring and backups.
- Logs. Keep logs and related personal data for at least one year, to help investigate any breach.
- Breach reporting. Tell affected patients without delay, and give the Data Protection Board a detailed report within 72 hours of becoming aware.
- Children’s data. Normally needs verifiable parental consent, but the Rules exempt clinical establishments for health services to the extent necessary.
- Retention. Erase data once the purpose is served, unless another law requires you to keep it. Medical records rules, NABL and court cases may require longer retention.
- Grievances. Publish a contact for privacy requests and respond to them.
Penalties
| Failure | Maximum penalty |
|---|---|
| Not taking reasonable security safeguards to prevent a breach | ₹250 crore |
| Not notifying the Board and patients of a breach | ₹200 crore |
| Breaking the rules on children’s data | ₹200 crore |
| Other breaches of the Act or Rules | ₹50 crore |
Where labs leak data in practice
- Reports on personal WhatsApp. Staff send PDFs from personal phones, which stay in galleries and chats.
- Shared logins. One password for the whole front desk means you can’t tell who opened a record.
- Guessable report links. Links that use serial numbers let anyone change a digit and see someone else’s report.
- Printouts and registers. Paper registers and uncollected reports left at the counter.
- Unencrypted backups. A pen drive or laptop with the full database.
See our guide to lab data security best practices for the technical side.
Check your readiness
DPDP readiness check for your lab
Tick what’s already true today.
Your readiness
0/10
Start now. Most of these are process changes that take months to settle in.
A self-check, not legal advice. The Rules’ main duties apply from May 2027.
Frequently asked questions
Yes. Any lab that processes patients’ personal data digitally is a Data Fiduciary under the Digital Personal Data Protection Act, 2023, and must follow its duties on notice, consent, security, breach reporting, retention and grievances.
The DPDP Rules, 2025 were notified on 13 November 2025. Most duties that matter to labs, including notices, security safeguards and breach reporting, apply 18 months later, around 13 May 2027. Consent Manager provisions apply from 13 November 2026.
Up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to notify the Data Protection Board and affected people of a breach. Other breaches can attract up to ₹50 crore.
Under the DPDP Rules, 2025, affected individuals must be told without delay, and a detailed report must reach the Data Protection Board within 72 hours of becoming aware of the breach.
Your vendor is a Data Processor. The lab, as Data Fiduciary, stays responsible for compliance, so you need a written agreement setting out how the vendor protects, stores and deletes data, and how it reports breaches to you.
The Act doesn’t ban any channel, but you must protect the data with reasonable safeguards. Sending reports from personal phones is hard to control and audit; a business account or secure link with access control is safer.
Get your lab DPDP-ready
See role-based access, audit trails and secure report delivery in ClinikPe, and get our data processing terms for your records.
No setup, migration or training fees · Free trial on cloud plans
Sources
- Digital Personal Data Protection Act, 2023 (MeitY)
- EY: DPDP Rules notified by MeitY (Nov 2025)
- Cyril Amarchand Mangaldas: DPDP Rules client alert (Nov 2025)
- Storyboard18: Govt notifies final DPDP Rules
Written by the ClinikPe lab operations team in Kolkata. General information, not legal, tax or medical advice; check the sources and your state rules before acting.
