Quick Answer
Diagnostic laboratories collect and process sensitive health data including test results, medical history, and patient identifiers. Under the DPDP Act 2023, this data requires explicit consent and strict purpose limitation — test results cannot be shared with third parties without patient consent. Labs operating chains across multiple states must implement a centralised consent management system to meet DPDP Act requirements.
Quick AnswerDiagnostic labs must obtain explicit patient consent before processing test results, restrict access to reports to the patient and referring physician only, implement secure report delivery, and delete data per defined retention schedules.
DPDP Compliance Checklist
- Obtain explicit patient consent at registration — separate consent for diagnostic use vs health research
- Implement secure report delivery — WhatsApp PDFs without password protection are non-compliant
- Restrict access to patient reports: only patient, referring doctor, and lab technician
- Implement data retention schedule — retain reports for 7 years, delete after expiry
- Review phlebotomy app and LIMS (Lab Information Management System) for DPDP compliance
- Train front desk and phlebotomists on patient data confidentiality
- Implement patient right-to-deletion for data beyond retention period
- Review sharing reports with insurance companies — only with explicit patient consent
- Publish privacy notice in registration forms and on website
- Conduct annual DPDP and health data security assessment
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Is lab test data sensitive under DPDP?+
Yes. Health data including diagnostic results is classified as sensitive personal data under DPDP Act 2023, requiring stronger consent and security obligations.
Can labs share patient data with health research studies?+
Only with explicit patient consent specifying the research purpose. Anonymised or aggregate data shared for public health research may be permissible without consent.
How should labs handle minor patients?+
Lab results for patients under 18 require parental consent for collection and access. Only parents or guardians should be able to access a minor's results.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
