DPDPA Compliance for Collection Centres in India

It depends on who determined the purpose, and one centre is usually both across different flows. For walk-in patients the centre collects, prices and books the test itself — it is a Data Fiduciary. For samples drawn under a hospital's or parent lab's instruction, where that entity set the purpose and the panel, the centre acts as a Data Processor for that flow. Map it per referral source rather than declaring a single status for the business.

No. Section 8(1) makes a Data Fiduciary responsible for compliance in respect of any processing undertaken by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary. A clause shifting responsibility to the vendor does not displace that. The practical answer is Section 8(2): a valid written contract with the LIS provider, the home-collection app, the SMS/WhatsApp gateway and the cloud backup, each with purpose limitation, no onward sub-processing without approval, a breach notification window shorter than your own, and deletion on exit. Never treat downstream data as though it stops being personal data once it leaves your counter.

Four lanes run cumulatively, not as alternatives. CERT-In requires reporting a reportable cyber incident within 6 hours of noticing it. Rule 7(1) requires intimating affected Data Principals without delay. Rule 7(2)(a) requires an initial intimation to the Data Protection Board without delay. Rule 7(2)(b) requires a detailed report to the Board within 72 hours, covering the events and circumstances, likely consequences, mitigation taken and your contact details. Misdirected WhatsApp reports count — a report sent to the wrong number is a personal data breach, not a front-desk error. Name an owner and a backup for each lane in writing before you need them. Failure of reasonable security safeguards under Section 8(5) carries a penalty of up to ₹250 crore.

Only if the Central Government notifies you as a Significant Data Fiduciary. Rule 13's annual data protection impact assessment, independent audit and algorithmic due-diligence duties attach to notified SDFs — not to every collection centre or franchise. Everything else applies to you regardless of size: Section 5 notice at the counter, per-purpose consent, processor contracts, breach reporting, erasure, and a published grievance contact. Note one earlier date if you plan to route consent through a Consent Manager: Rule 4 registration commences 13 November 2026, ahead of the 13 May 2027 substantive deadline.