Clinics and diagnostic labs: protecting patient data under the DPDP Act

क्लिनिक और लैब: DPDP एक्ट के तहत मरीज़ों के डेटा की सुरक्षा

20 October 2026 · 4 min read · Satya Shield

A clinic or diagnostic lab handles some of the most sensitive personal data there is: symptoms, prescriptions, medical history and test results, along with names, phone numbers and addresses. Under the Digital Personal Data Protection Act, 2023, your clinic is a Data Fiduciary for this data, and from 13 May 2027 most of the Act's duties apply in full.

The good news: most of what the law asks is good practice you may already partly follow. Here is where clinics and labs usually have gaps.

Where patient data leaks in a typical clinic

• Reports on WhatsApp: sent to the wrong number, or to a family member without the patient's say-so.
• Shared logins: one password for the lab software, used by everyone at the front desk.
• Paper files: forms left on the counter, or old reports sold as scrap paper.
• Staff phones: photos of reports and prescriptions on personal phones.
• Vendors: lab software, appointment apps and payment providers that store patient data with no data protection terms in the contract.

What to put in place

A clear notice and consent at registration

Tell patients what you collect and why, at the point of registration: at the counter, on the form and on your website. Take consent for using their data to provide care and send reports. Keep optional uses (health package offers, reminders) on separate, unticked checkboxes.

The Act also lets you use data without consent in some situations, such as responding to a medical emergency that threatens someone's life or health. Your notice can say so.

Children: parental consent, with a health-care exception

For patients under 18, the Act generally requires verifiable consent from a parent or guardian. The DPDP Rules include exemptions for clinical establishments and health-care professionals, to the extent needed to provide health services to the child. Ask your advocate exactly how this applies to your clinic, and keep using a parent consent form where it does.

Security that matches the sensitivity

• A separate login for every staff member, with access only to what they need.
• Two-step login on email, lab software and the clinic's WhatsApp Business account.
• Automatic backups stored separately, and tested.
• Locked cupboards and a shredder for paper records.
• A rule that reports are never photographed on personal phones.

A breach plan you can follow at 9 pm

If a lab laptop is stolen or reports go to the wrong person, someone needs to know what to do: contain the problem, record what happened, inform the Data Protection Board of India (a detailed report within 72 hours under the Rules), and tell affected patients in plain language. For cyber incidents like hacking, CERT-In also expects a report within 6 hours.

Retention

Medical record-keeping rules and tax laws may require you to keep some records for set periods. Write down how long you keep each type (patient records, bills, consent forms, marketing lists) and delete the rest safely.

A five-minute self-check

1. Do patients see a privacy notice before they give their details?
2. Are optional offers on a separate, unticked checkbox?
3. Does every staff member have their own login?
4. Is two-step login on for email and lab software?
5. Do you know who to call, and what to do, if data leaks tonight?

If you answered "no" to any of these, take our free DPDP risk check. It takes 3 minutes and shows your top three fixes.

This article is general information to help small businesses understand the law. It is not legal advice. Official texts: DPDP Act, 2023 and DPDP Rules, 2025.