ConsentKit DPDP
Free readiness check Book a demo

For pathology labs, imaging centres and diagnostic chains

DPDP compliance for diagnostic labs

Your lab turns samples into some of the most sensitive data a person has, then sends it by WhatsApp, email and app to patients, doctors and employers. ConsentKit records who may receive each report and keeps the rest of your data flows within the DPDP Act.

Check your lab’s readiness See where DPDP applies
Reports to referring doctor
Tell the patient
Corporate health checks
Individual consent
Breach report
Within 72 hours
precisionlabs.inBook a home collection

Precision Labs asks for your consent

Choose who can receive your reports and how we contact you.

Withdraw consent anytime
Consent logRecording

    Where the DPDP Act touches a lab test

    From the booking call to the report on a phone, each hand-off is a data flow. Pick a stage to see what applies.

    What changes for your lab on 13 May 2027

    Labs share more data with more parties than most healthcare providers. Each sharing flow needs a basis.

    Tell patients who receives their reportSections 5 and 6

    Patients should know if reports go to their doctor, their employer, an insurer or a partner lab.

    A notice at booking with a clear list of recipients, saved with the order.

    Corporate health checks need individual consentSection 6

    An employer paying for the test does not make the employer entitled to the full report. Each employee decides.

    Per-employee consent for what goes to HR, with fitness-summary templates.

    Secure report deliverySection 8(5) and Rule 6

    Reports sent to wrong numbers are breaches. Use verification and access-controlled links.

    OTP-protected report links and delivery logs.

    Partner labs are your processorsSection 8

    Samples sent out for specialised tests carry patient data. You stay responsible for it.

    Processor contract checklist and a register of partner labs.

    Patients can request their dataSections 11 to 14

    Patients can ask for a summary, correction or erasure where the law allows.

    A request portal with identity checks and deadlines.

    Retention per record typeSection 8(7) and Rule 8

    Keep test records as long as regulations require; delete marketing lists and stale leads.

    Retention rules with a deletion log.

    What the healthcare exemptions cover

    The DPDP Act lets you process data without consent to respond to a medical emergency. The Rules also exempt clinical establishments and healthcare professionals from verifiable parental consent when treating a child, to the extent needed to protect the child’s health. Neither is a blanket exemption.

    Usually coveredEmergency care, treating a minor, records the law requires you to keep.
    Usually not coveredMarketing health packages, sharing with pharma or insurers beyond the claim, reviews and testimonials.

    This is general guidance, not legal advice. Confirm how it applies to you with your counsel.

    A plan for labs and collection networks

    Start where the most data leaves your lab: reports and field collection.

    1. Map report flows

      List every way reports leave the lab: WhatsApp, email, app, doctors, employers, insurers.

    2. Fix booking and reports

      Add notices at booking and OTP-protected report links.

    3. Field staff and partners

      Lock down collection apps and sign processor terms with partner labs.

    4. Corporate programmes

      Switch corporate health checks to individual consent before renewals.

    For every kind of lab

    Templates for your testing and collection model.

    Pathology chains

    Many collection centres and a central lab.

    Standalone labs

    Simple setup for one location.

    Imaging centres

    Large image files and radiologist reporting.

    Home collection services

    Field staff apps and address data.

    Genetic testing labs

    Highly sensitive results and research use.

    Hospital-attached labs

    Shared records with the hospital HIS.

    DPDP compliance for diagnostic labs near you

    Local guidance and onboarding in these cities, with support from our team in Kolkata.

    Related sectors

    HospitalsPatient records, insurer sharing, and access requests from patients and nominees.Clinics and doctorsAppointment booking, prescriptions and reminder messages.InsuranceProposal forms, claims data and sharing with brokers and TPAs.

    Questions labs are asking

    For the full picture, read our DPDP Act guide or compliance checklist.

    Can we send reports on WhatsApp?

    Yes, if the patient chose WhatsApp and you verify the number. Access-controlled links are safer than sending the PDF directly.

    Can we send reports to the referring doctor?

    Yes, when the patient knows and agrees. Include it in the booking notice as a named recipient.

    What can we share with an employer after a health camp?

    Only what each employee consents to. Many employers only need a fit or not-fit summary, not the full report.

    Are partner labs our responsibility?

    Yes. They are your processors. You need a contract that binds them to security and breach reporting.

    How long do we keep test records?

    As long as healthcare regulations and other laws require. Marketing and lead data should go when its purpose ends.

    Get your lab ready before May 2027

    The readiness check takes about ten minutes and gives you a gap report built for diagnostic labs.

    Check your lab’s readiness Book a demo