DPDPA Checklist for Collection Centre Managers

What must a collection centre manager do for DPDPA compliance?

1. Settle who the Data Fiduciary is, in writing, if you're a franchise or partner centre. The lab brand usually decides the purpose and means, so the lab is the Fiduciary and the franchise centre a Processor. That must be a contract clause, not an assumption. Section 8(2) requires a valid contract before a processor handles data on the fiduciary's behalf, and the lab stays liable for your failures. Minimum terms: process only on lab instruction, no local copies retained after upload, no onward sharing without lab authorisation, security provisions under Rule 6(1)(f), and incident notification measured in hours. If you run an independent centre serving multiple labs, you are the Fiduciary for your own registration data — don't assume the lab's compliance covers you.
2. Strip the registration form to what the test actually needs. Name, age, sex, contact, referring doctor and the test panel are defensible. Occupation, marital status, full address for an in-centre walk-in, Aadhaar number, and a mandatory alternate contact usually are not. Section 6(1) confines consent to data necessary for the specified purpose. Aadhaar is not required to run a blood test — ABHA is voluntary under ABDM, and refusing a patient for declining either is indefensible. Walk-ins, home collection and health packages run on Section 6 consent, not a medical-emergency legitimate use.
3. Separate the consent for report delivery, marketing and research. Patients consent to testing. That does not cover pushing them health-package offers, sharing panel results with a corporate wellness client, or contributing samples and data to a research or pharma tie-up. Take each as a separate, refusable consent at registration under Rule 3, and never make any of them a condition of getting the test done. One signature covering all six purposes is not itemised consent.
4. Fix report delivery — the unauthenticated link is your biggest exposure. A report link sent over WhatsApp or SMS that opens without authentication means anyone holding the phone, or anyone who guesses an adjacent URL, reads the report. Require OTP or date-of-birth verification at open, set link expiry, replace sequential patient IDs with random tokens, and never put the test name in the SMS body — "your report is ready", not "your HIV ELISA report is ready." This is cheap, and it is what a regulator or a journalist will test first.
5. Get patient data off personal phones. Phlebotomists photographing requisition slips, saving patient numbers to personal contacts, or forwarding reports from their own WhatsApp is the most common real-world failure at collection centres. Issue centre-owned devices or an app with no local image storage, ban camera capture of forms, and run an exit routine when a phlebotomist resigns — you cannot wipe a device you don't own, and Section 8(5) makes that gap your reasonable-security failure.
6. Redesign the front desk so the last patient isn't visible to the next. Open registers listing name, age and test, screens angled toward the queue, and printed tube labels sitting on the counter are all disclosures you never had consent for. Practical fixes: token numbers instead of names called out, a screen privacy filter, tubes moved to a closed rack immediately, and the collection cubicle out of CCTV coverage entirely — cameras belong at the entrance and the sample handover point, never where a patient undresses or a sample is drawn.
7. Apply the extra rules that specific tests carry, because DPDPA is not the whole picture. DPDPA 2023 has no separate "sensitive personal data" tier — health data sits under the same rules as everything else. Sectoral law still adds duties on top. The HIV/AIDS (Prevention and Control) Act, 2017 requires informed consent and confidentiality for HIV testing and restricts disclosure. The PCPNDT Act governs any prenatal diagnostic work, including Form F records and an absolute bar on sex determination. Train front-desk staff that these results are never discussed at the counter and never given to the person who paid, unless that person is the patient.
8. Handle paediatric draws correctly — and do not over-apply Section 9. Rule 12 read with Fourth Schedule Part A(1) disapplies both Section 9(1) and Section 9(3) for a clinical establishment — which covers a diagnostic laboratory — where processing is restricted to providing health services to the child to the extent necessary for the protection of her health. You do not need Rule 10 verifiable parental consent as a precondition to running a clinically indicated test on a minor. What the carve-out does not touch: marketing or health-package outreach involving a child, research use of identifiable paediatric data, disclosure to a school, and targeted advertising directed at a child. Those snap back to full Section 9. For elderly patients whose relatives arrange the test, the patient is still the Data Principal; a son booking his mother's test does not become entitled to her report. Section 14 nomination is the correct route rather than informal family access.
9. Write down the retention rule for slips, samples and local copies. Section 8(7) requires erasure once the purpose is served, unless Indian law requires retention. Clinical establishment rules and NABL accreditation impose their own record-retention periods — get the exact figure applicable to your lab's accreditation and state rules from your quality manager and write it down. Then handle what nobody handles: paper requisition slips in the drawer, the local desktop's scan folder, the register from 2019, and residual samples after the retention window. Note the floors: Rule 6(1)(e) and Rule 8(3) set a one-year minimum for certain logs and related personal data. Physical destruction needs a logged shredding routine, not a bin.
10. Know your vendor chain and your breach clock before you need them. List everyone who touches the data: LIS/HIS vendor, the courier moving samples, the SMS and WhatsApp gateway, the report-hosting cloud and its region, the home-collection app. You need that list to answer a Section 11 access request and to act inside the clock if one is breached. Four lanes run cumulatively: CERT-In within 6 hours of noticing; Rule 7(1) affected patients without delay; Rule 7(2)(a) Board initial intimation without delay; Rule 7(2)(b) detailed report to the Board within 72 hours. Escalate to the parent lab in hours, not "promptly". Print it and put it next to the centre phone. Separately, if the LIS is hosted offshore, inventory that transfer under Rule 15.