Walk into almost any diagnostic collection centre in India and you are likely standing in a business that belongs to someone other than the brand on the signboard. The sample you give is sent on to a central lab. The report comes back under the brand's name. And somewhere in a drawer sits a franchise agreement that was signed years before anyone in the industry had read the Digital Personal Data Protection Act.
That agreement is about to matter more than most of the compliance documents on the shelf, because it answers a question the Act forces every diagnostic network to answer: in this relationship, who is the Data Fiduciary and who is the Data Processor?
One Question, Two Very Different Answers
The Act defines a Data Fiduciary in Section 2(i) as a person who, alone or in conjunction with others, determines the purpose and means of processing personal data. A Data Processor under Section 2(k) is a person who processes data on behalf of a Fiduciary. The difference is not cosmetic. Under Section 8(1), the Fiduciary stays responsible for compliance, including for processing done by its Processors. Under Section 8(2), it may engage a Processor only under a valid contract.
Now apply that to a franchised collection point. There are two honest readings.
In the first, the collection centre simply collects on the central lab's behalf: it follows the brand's forms, uses the brand's systems and passes everything upstream. That points to a Processor acting for the lab, and the lab as Fiduciary.
In the second, the collection centre runs its own business. It keeps its own patient records, runs its own walk-in registrations, perhaps its own marketing. For that intake data it is making its own decisions about purpose, which points to an independent Fiduciary, with the central lab a separate Fiduciary for the testing.
Both readings are plausible for different franchise models, and sometimes for different parts of the same one. That is exactly the problem.
Why the Silence in the Agreement Is the Risk
Most franchise agreements in this sector deal with brand standards, pricing, sample handling, turnaround times and revenue share. Few say anything about which party decides what to do with patient data. Some assume the central lab owns everything. Others assume the collection centre does.
Without a clear statement, three things can go wrong. A Processor relationship may exist in fact with no Section 8(2) contract behind it, leaving both sides exposed. A collection centre that is really a Fiduciary may be operating without its own notice or consent basis, because the brand assumed the brand's paperwork covered it. And when a breach happens at the collection point, such as a report sent to the wrong person, nobody has agreed in advance who investigates, who notifies the Data Protection Board and who tells the patient.
None of this is a theoretical worry. A single misdirected report is a personal data breach under the Act, with no minimum size, and the penalty ceilings under the Schedule run to ₹250 crore for failing to maintain reasonable security safeguards and ₹200 crore for failing to notify. Not every incident reaches those numbers, but the point of writing the roles down is to avoid arguing about them during one.
What a Good Clause Actually Contains
The fix does not need a new contract from scratch. It needs a data schedule added to the existing one, covering a handful of points:
- A plain statement of roles, per category of data: booking data, intake records, samples, results, billing.
- Who owns each decision, including who may use the data for marketing and who may not.
- Security obligations in line with Rule 6 of the DPDP Rules, covering access control, logging and the other minimum safeguards, since the Fiduciary stays answerable for what its Processors do.
- A breach clause with a short, hard deadline for the collection centre to tell the central lab, so the lab can meet its own notification duties.
- Staff and access rules, because phlebotomists and front-desk staff are the people who actually touch the data.
- An exit clause stating what happens to patient data if the franchise ends.
Why Start Now
The Rules' core operational provisions take effect on 13 May 2027. A network with dozens or hundreds of collection points cannot renegotiate that many agreements in a fortnight, and some franchisees will push back on new obligations. Starting the conversation early, with a standard data schedule, turns a scramble into a rollout.
Nitin Ray is a Compliance Manager at RuleExpert, where he works with healthcare providers and diagnostic businesses on DPDP readiness. For the full picture on Fiduciary and Processor roles, legal basis, report-sharing safeguards and sector laws for labs, see RuleExpert's complete guide to DPDP for diagnostic labs and imaging centres. This article reflects publicly available regulatory information at the time of writing and does not constitute legal advice.
Comments