DPDP for Diagnostic Labs and Imaging Centres: Fiduciary or Processor, and Sharing Reports Safely

A diagnostic lab is an odd kind of data business. Almost nothing it holds is meant to stay with it. The sample goes to a machine, the result goes onto a report, and the report goes out the door: to the patient, to the referring doctor, to a hospital, to an insurer. The report is the product, and the product is personal health data in motion.

That is why DPDP for diagnostic labs is a different conversation from DPDP for a retailer or a SaaS company. Two questions decide most of your compliance position, and neither is answered by a generic checklist. First, who are you in each relationship: a Data Fiduciary, or a Data Processor working for someone else? Second, how does a report actually leave your building, and could you defend that route if someone asked?

This guide answers both for pathology labs, imaging and radiology centres, collection chains and their software vendors. It sits under our wider guide to DPDP compliance across healthcare providers, which covers hospitals and the health-law stack. Here we stay on the lab bench and the imaging suite.

1. Why Labs Have a Different DPDP Problem

Three features set a lab apart.

The data is health data, and the Act does not rank it. The DPDP Act has no formal "sensitive personal data" tier. A blood sugar value gets the same statutory treatment as an email address. What makes lab data heavy is everything around the Act: the sector laws we cover below, and the plain fact that a leaked HIV result or a leaked scan does damage an email address never could.

Handoffs are built into the business. Each sample generates a booking, an identity record, a barcode, a result, a report and often an invoice, and several parties touch that chain, each possibly in a different legal role.

The deliverable travels. Most Fiduciaries worry about data at rest. A lab has to worry about data in transit, every day, to people it cannot fully verify.

2. Is a Diagnostic Lab a Data Fiduciary or a Data Processor?

The answer comes from two definitions in the Act, and the whole analysis turns on one phrase.

Section 2(i) defines a Data Fiduciary as any person who, alone or in conjunction with other persons, determines the purpose and means of processing personal data. Section 2(k) defines a Data Processor as any person who processes personal data on behalf of a Data Fiduciary. Read together, the test is not "who referred the patient" and not "who pays the lab." It is who decides why the data is processed and how.

Here is how that plays out in the situations labs actually face. These are typical readings, not guarantees, because the answer depends on the real facts and the paperwork.

Situation	Typical position of the lab	Why
Patient walks in, books and pays directly	Data Fiduciary	The lab decides the purpose (testing and reporting) and the means
Hospital refers a patient to an external lab, which tests with its own methods and issues a report under its own signature	Usually its own Data Fiduciary for that testing, alongside the hospital as a Fiduciary for its own purposes	The lab exercises independent judgment over method, quality control and interpretation
Lab runs a defined test strictly to a hospital's instructions, with no independent judgment, and returns raw output	Likely a Data Processor	It acts on behalf of the hospital and decides nothing about purpose
In-house laboratory inside a hospital	Not a separate party at all	It is a department of the hospital's own legal entity
Imaging centre that reads scans and issues its own signed report	Usually a Data Fiduciary for the reporting	The radiologist's reading is the lab's own professional judgment
LIS, PACS or cloud software vendor	Data Processor	It processes only on the lab's instructions and has no purpose of its own

Two points make this more than an academic exercise.

First, the classification decides who answers for what. Under Section 8(1), a Data Fiduciary stays responsible for compliance, including for processing carried out on its behalf by a Processor. Under Section 8(2), a Fiduciary may only engage a Processor under a valid contract. If you are a Processor and nobody wrote that contract, both sides have a gap.

Second, do not lean on the idea that "joint" arrangements sort themselves out. Section 2(i) does contemplate Fiduciaries acting in conjunction with others, but the Act gives no Article 26-style mechanism for dividing duties between them. In practice, when a hospital and a lab each make their own decisions about the same patient's data, treat each as its own Fiduciary for its own purpose, with its own notice, its own legal basis and its own obligations. Write down who owns which decision.

3. Who Else Touches the Sample and the Report?

The lab itself is rarely the whole story. Consider an illustrative home-collection test at a diagnostic brand that operates through franchised collection points. A patient books through an app. A phlebotomist visits. The sample goes to a collection centre, then to a central lab. A software platform runs behind all of it.

Every link can carry a different answer:

• A multi-brand booking app that lets patients book across several labs is likely a Fiduciary in its own right for the booking and scheduling data.
• A franchised collection centre could be a Processor collecting on behalf of the central lab, or an independent Fiduciary for its own intake records. The franchise agreement should say which. This is the single most common gap we would expect to find in a diagnostic network, because franchise agreements were written long before DPDP existed.
• The central lab runs the test and signs the report. It is usually the primary Fiduciary.
• The software vendor is almost always a Processor and needs a Section 8(2) contract.

The fix is dull and effective: draw this chain once for your own business, write each party's role next to its name, and check that a contract exists for every Processor and that franchise agreements say what you now believe they say. A spreadsheet is a fine place to start.

4. What Is Your Legal Basis for Processing Lab Data?

For most commercial processing the answer is consent under Section 6. The Act's test is free, specific, informed, unconditional and unambiguous consent with a clear affirmative action, and our guide to DPDP consent management for businesses walks through all six pillars.

Labs have one useful alternative that deserves careful reading. Section 7(a) allows processing for the specified purpose for which a person has voluntarily provided their data, as long as they have not indicated that they do not consent. A patient who hands over a prescription and a sample to get a test done has voluntarily provided data for that purpose. For the core job of running the test and giving the report back to that patient, Section 7(a) is a natural fit.

Its limits matter as much as its existence. It covers the specified purpose only: testing and reporting to the patient, yes; sending the same data to a marketing platform, a research programme, a partner clinic or a TPA, no. Each of those is a different purpose with its own recipient and needs its own basis. And it falls away if the person has indicated they do not consent.

Two other health-related uses are narrower still: Section 7(f), responding to a medical emergency involving a threat to life or an immediate threat to health, and Section 7(g), providing treatment or health services during an epidemic or other public health threat. Neither is a general licence. An elective blood panel is not an emergency.

The sensible position for a lab: rely on Section 7(a) for the core testing-and-reporting service, collect separate, itemised consent for everything beyond it, and keep a record that shows which basis you used for which purpose.

5. Which Sector Laws Sit on Top of Lab and Imaging Data?

DPDP does not replace the laws that already govern diagnostics. For labs and imaging centres, three matter most. Our healthcare pillar maps the full stack for hospitals.

HIV testing. Under the HIV and AIDS (Prevention and Control) Act, 2017, no HIV test may be performed without the informed consent of the person or their representative, and that consent includes pre-test and post-test counselling (Section 5), with limited exceptions in Section 6. Section 7 says no testing or diagnostic centre, pathology laboratory or blood bank may conduct an HIV test unless it follows the prescribed guidelines. On the output side, Section 8 bars disclosure of HIV status without recorded informed consent, subject to the exceptions in Section 8(2), such as disclosure between healthcare providers involved in the person's care when necessary for that care. A general DPDP consent line on a lab booking form does none of this work.

Prenatal ultrasound. If an imaging centre performs prenatal diagnostic procedures, the PCPNDT Act, 1994 requires Form F records for each procedure on a pregnant woman, preserved for a minimum of two years, or until a case is finally disposed of if proceedings begin. That retention duty applies even if your DPDP erasure policy would otherwise delete the record sooner. DPDP's own erasure duty in Section 8(7) gives way where another law requires retention. Imaging centres should also make sure report templates and delivery channels never reveal foetal sex, which the Act prohibits.

Mental health records. The Mental Healthcare Act, 2017 gives a separate statutory right to confidentiality for mental health information, which toxicology and some psychiatric panels can touch.

The working rule: the stricter, more specific law controls its own corner, and your DPDP policy needs a written list of those corners.

6. How Should You Share Reports Safely?

Section 8(5) of the Act requires reasonable security safeguards to prevent a personal data breach, and Rule 6 of the DPDP Rules, 2025 sets out the minimum. Rule 6 is not a list of products. It is seven measures: securing data through encryption, obfuscation, masking or virtual tokens; controlling access to the computer resources involved; keeping visibility on access through logs, monitoring and review; being able to keep processing if something is compromised, which in practice means backups; retaining logs and personal data for one year unless another law requires otherwise; a security provision in every Processor contract; and technical and organisational measures behind all of it.

Hold that list up against how reports actually leave a lab.

Messaging apps to an unverified number. The channel is not the main problem. Nobody has confirmed the number belongs to the patient, the PDF can be forwarded without limit, and copies pile up on staff phones. A lab that defaults to this for every report will struggle to show it assessed the risk.

Plain email attachments. Exposed to a compromised mailbox, with no expiry.

Counter handover. Only as safe as your identity check. Handing a report to anyone holding a receipt number is a misdelivery waiting to happen.

Referring doctor access. A separate authorisation from the patient's relationship with the lab. Shared mailboxes and open drives are the usual weak point.

Password-protected PDFs. A real improvement, though a date of birth is the most guessable password there is.

An OTP-verified portal with expiring links. The safest common pattern: identity checked at the moment of access, a link that eventually dies, and an access log that gives you the audit trail Rule 6 expects.

Imaging centres face the same logic with the images themselves: a scan on a CD handed across the counter, or an unverified cloud link, carries the same risks as a PDF, with bigger files.

The target state is simple to state: a verified portal or tokenised link by default, messaging apps as a documented exception, an identity check at the counter, separate logins for referring doctors, access logs kept for at least a year, and the Rule 6 security clause in every Processor contract, the LIS vendor and courier included.

7. What Happens When a Report Goes to the Wrong Person?

Under the Act, a personal data breach includes accidental disclosure of personal data to someone not entitled to it. A report sent to the wrong number, the wrong email address or the wrong patient meets that definition. There is no size test. A single misdirected report is a breach, and under Section 8(6) and Rule 7 it triggers notification to both the Data Protection Board and the affected person, with the Board report in two stages, an initial alert without delay and a detailed report within 72 hours. Our guide to DPDP breach notification requirements covers the exact timelines and content.

Two lab-specific wrinkles are worth planning for:

• Processor breaches land on you. If your LIS vendor is compromised, you are the Fiduciary. Your vendor contract needs to oblige them to tell you quickly enough for you to meet your own timelines.
• The message is hard to write. Telling a patient their result went to a stranger needs a drafted template and escalation route before the day you need it.

The penalty exposure is real. Under the Schedule, failing to maintain reasonable security safeguards can attract up to ₹250 crore per instance, and failing to notify a breach up to ₹200 crore. Both can apply to the same incident. Our guides to the DPDP penalty and enforcement structure and the Data Protection Board's process explain how an inquiry actually runs.

8. What About Children's Samples?

Paediatric testing is routine. The Act treats anyone under 18 as a child and, under Section 9, requires verifiable consent from a parent or lawful guardian before processing a child's data, with outright bans on tracking, behavioural monitoring and targeted advertising aimed at children.

The Rules carve out a limited exemption for healthcare. Under Rule 12, read with the Fourth Schedule, a clinical establishment, mental health establishment or healthcare professional is exempt from the verifiable-consent requirement where processing is restricted to providing health services to the child, to the extent necessary to protect the child's health. An allied healthcare professional is exempt only to the extent of supporting a treatment and referral plan recommended for the child.

That covers what is necessary for the child's care, not marketing, research or a loyalty programme. Whether your lab or imaging centre qualifies as a "clinical establishment" or "allied healthcare professional" depends on how it is registered, so take advice on your own classification.

9. When Do These Obligations Actually Start?

Not yet, and that is the opportunity. The DPDP Rules, 2025 were notified on 13 November 2025. The Data Protection Board exists, but the operational obligations in this guide, consent, notice, security safeguards, breach notification and children's data, fall within an eighteen-month phased compliance window landing on 13 May 2027.

Treat that as a build window: a franchise network cannot renegotiate dozens of agreements in a fortnight. If your group is large enough to be notified as a Significant Data Fiduciary, a possibility we cover in our guide to Significant Data Fiduciary obligations, the load grows further: a resident Data Protection Officer, an independent auditor and annual impact assessments. The Act fixes no user or turnover threshold for that designation, so assess yourself against its statutory factors.

10. How to Build a Lab-Ready DPDP Programme

In a sensible order:

• Map the chain. Booking, collection, transport, testing, reporting, billing, storage. Write the DPDP role of every party next to its name.
• Fix the paper. Processor contracts with a Rule 6 security clause, and franchise agreements that state each collection centre's role.
• Choose your legal basis per purpose. Section 7(a) for the core testing service, itemised consent for sharing, marketing and research.
• Build a sector-law exceptions list. HIV consent and disclosure rules, PCPNDT's two-year Form F retention, mental health confidentiality.
• Redesign report delivery and logging. Verified delivery by default, ID checks at the counter, separate doctor access, logs kept for a year.
• Write the misdirected-report playbook. Who decides it is a breach, who drafts the patient notice, who files with the Board, and how fast.
• Run a test. Send a dummy report to a test patient and test doctor, revoke access, and check the logs show what happened.

This is where RuleExpert earns its place. Our Data Registry keeps a live map of what patient data you hold and where it moves, our Vendor Governance module tracks every Processor and the paperwork behind it, our Consent Manager module (internal consent-lifecycle software, not a registered Section 2(g) Consent Manager) handles itemised consent and withdrawal, and our Breach Management workflow gives you a documented route for the misdirected-report day. If you want to see how that maps onto your actual collection network and report channels, book a demo with RuleExpert and we will walk through your chain rather than a generic checklist.

11. Mistakes Labs and Imaging Centres Make

• Assuming "we only follow the doctor's order" makes you a Processor. If you choose the method, run quality control and sign the report, you are probably making your own decisions about the data.
• Leaving franchise agreements untouched. They were written before DPDP and rarely say who is Fiduciary and who is Processor.
• Stretching Section 7(a) to cover everything. It covers the purpose the patient provided the data for, not marketing, research or insurer sharing.
• Configuring auto-delete without a retention exceptions list. PCPNDT's Form F rule can collide with an automated erasure job.
• No Rule 6 clause in the LIS vendor contract. The vendor's weakness becomes your penalty.

12. Frequently Asked Questions

Is a diagnostic lab a Data Fiduciary or a Data Processor under the DPDP Act? It depends on who determines the purpose and means of processing. A lab that chooses its own methods, runs its own quality control and signs its own reports is usually a Data Fiduciary for that testing, even when a doctor referred the patient. A lab that only follows a Fiduciary's detailed instructions is more likely a Data Processor.

Is a hospital-referred external lab a Processor for the hospital? Not automatically. If the lab exercises independent professional judgment, it is typically its own Fiduciary for the testing, and the hospital is a separate Fiduciary for its own purposes. Document the arrangement.

Does the DPDP Act recognise joint Data Fiduciaries? Section 2(i) covers a person acting "alone or in conjunction with other persons", but the Act gives no GDPR-style framework for dividing duties between them. Record who owns which decision.

Can a lab process patient data without consent? For the core testing service, often yes. Section 7(a) covers the specified purpose a person voluntarily provided their data for, unless they have indicated they do not consent. Marketing, research and insurer sharing need their own basis.

Does a franchise collection centre count as a Data Processor? It can be a Processor for the central lab or an independent Fiduciary for its own intake records. The franchise agreement should say which.

What does Rule 6 require when sharing reports? Seven minimum measures: encryption, masking or tokens; access control; logging and monitoring; ability to keep processing after a compromise; one-year retention of logs and data unless another law says otherwise; security clauses in Processor contracts; and supporting technical and organisational measures.

Is sending reports by WhatsApp or email allowed under DPDP? The Act bans no channel. It requires reasonable security safeguards. Unverified numbers, no expiry and no access log make that hard to show, so verified, tokenised delivery is the safer default.

Does a misdirected lab report count as a data breach? Yes. Accidental disclosure to someone not entitled to the data meets the definition, with no minimum size. Notification to the Board and the affected person follows under Section 8(6) and Rule 7.

How does the PCPNDT Act affect a lab's data deletion policy? Imaging centres performing prenatal procedures must keep Form F records for at least two years, or until case disposal if proceedings begin. List that as an explicit exception to any erasure schedule.

When do DPDP obligations apply to diagnostic labs? The Rules' core operational provisions take effect on 13 May 2027, eighteen months after notification on 13 November 2025.