DPDP Act for Diagnostic Labs & Pathology Chains in India

Section 5 + Section 6

Granular consent per purpose — testing vs research vs marketing

One bundled "I agree" at registration does not cover research, anonymised studies or partner sharing. Each purpose needs its own captured consent under Section 6 with a withdraw path under Section 6(4).

Section 9 + POCSO

Verifiable parental consent for paediatric tests

Under-18 sample collection (paediatric oncology, school screenings) triggers verifiable parental consent. POCSO Section 23(2) adds a disclosure ban for offence victims — heightened protection beyond Section 9.

Section 8(7) + MCI Reg 1.3.2 + NDPS

Statutory retention override for MCI / NDPS records

MCI Regulations 2002 require 3-year minimum retention from last visit; NDPS Act 1985 needs 2 years for Schedule H/X prescriptions. DPDP erasure cannot override these — refusal must cite the specific regulation.

Section 16 + ABDM Policy

India residency for ABHA-linked records

Once you integrate with Ayushman Bharat Digital Mission, ABDM mandates India residency for health records — DPDP is silent, ABDM is not.

Rule 7(1)-(2)

72-hour breach notification (DPB) + 6-hour CERT-In

Phase-1 notification "without delay" to DPB, Phase-2 detailed report within 72 hours covering Rule 7(2)(a)-(e). Stacks on top of the CERT-In 6-hour window for any cyber incident.

Section 10 + Rule 13

DPO + independent annual audit (if designated SDF)

India-resident DPO reporting directly to the Board; independent annual audit; DPIA within 12 months of designation. National chains processing tens of millions of patients should plan as if designated.

Rule 8(3) + Seventh Schedule

1-year processing log retention via DPA

Diagnostic labs and every downstream processor (cloud, telecom, billing, courier) must retain processing and traffic logs for at least 12 months — flow down via the DPA.

Do diagnostic labs need an India-resident DPO under DPDP?

Mandatory only if designated SDF, but any national chain processing more than a few million patients should plan as if designated. The DPO must be an individual (not outsourced to a firm) and must report directly to the Board under Rule 13.

How does MCI / NDPS retention override DPDP erasure?

MCI Regulations 2002 mandate a 3-year minimum retention of patient records from last visit; NDPS Act 1985 mandates 2 years for Schedule H/X prescriptions. DPDP Section 8(7) allows retention where another law mandates it — the refusal of an erasure request must cite the specific regulation in writing.

Is ABDM integration enough to satisfy DPDP consent?

No. ABDM has its own consent artefact for each share event, but DPDP Section 5 still requires the itemised notice (purposes, categories, rights, grievance officer) and Section 6 still requires withdrawal as easy as giving consent. Align both — do not collapse them.

What is the minimum Section 8 security baseline for a diagnostic lab?

AES-256 at rest, TLS 1.2+ in transit, RBAC + MFA for privileged access, SIEM-grade monitoring with anomaly alerts, 12-month processing log retention, annual VAPT, and a two-phase breach playbook covering DPB + CERT-In + ABDM. Most ISO 27001 / ISO 27799 certified labs are already 70 % of the way there.

How does POCSO interact with DPDP for paediatric records?

POCSO Section 23(2) prohibits disclosure of a child victim's identity — this is a criminal-law restriction that runs alongside DPDP Section 9. Even with valid parental consent under DPDP, POCSO disclosure restrictions still apply for offence-related records.