Two tubes swap places on a 96-well plate. That’s the whole incident.
There’s no breach notification, no ransomware note, nothing for the SOC to chase. The assay runs, the numbers look plausible, and by Friday morning two patients have been sent each other’s results. Every control downstream (encryption, role-based access, carefully tested backups) then guards those wrong records with total commitment.
Privacy people spend most of their working lives on what happens to a record after it’s born. Fair enough, that’s where the regulators usually look. But in a lab handling genomic or clinical samples, whether a record is true gets settled much earlier, on a bench, by a tired pair of hands or, more and more, by liquid handling instruments.
Accuracy Is a Legal Duty, Not Just a Lab Quality Measure
People forget the GDPR has an accuracy principle. It’s right there in Article 5(1)(d), sitting quietly between data minimisation and storage limitation: data has to be accurate, and inaccurate data has to be fixed or deleted without delay. Australia’s version lives in APP 10. Same idea, built around taking “reasonable steps”.
Outside healthcare, this mostly means fixing a typo in someone’s postcode when they complain.
Labs are different, and not in a small way. Genetic and health data are special category data under Article 9, and a misattributed result might change a treatment plan before anybody thinks to double-check it. The patient has no reason to suspect anything. Nobody files a rectification request for an error they can’t see. So prevention isn’t a nice-to-have here. It’s most of the obligation.
Where the Errors Actually Happen
Ask any lab manager about manual pipetting and you’ll get the same short list, usually with a sigh. Skipped steps. Volumes that are a little off. Well B7 instead of B8. A plate map retyped from Excel at the end of a twelve-hour day, with row 41 quietly shifted down by one.
None of this means the staff are careless. Hand pipetting hundreds of samples is monotonous, finicky work, and monotony is where mistakes breed.
Here’s what should bother a compliance team, though. Every one of those slips happens upstream of the LIMS, the laboratory information management system where most governance actually starts. The audit log can tell you exactly who looked at a result and when. It cannot tell you the result belongs to someone else, because as far as the system knows, it doesn’t.
Labs aren’t naive about this. Regulated ones work to ALCOA+, the data integrity checklist (attributable, legible, contemporaneous, original, accurate, plus a few more). Clinical labs obsess over positive patient ID and chain of custody. Read those requirements next to Article 5 and they overlap almost word for word. They just live with the quality manager, and the privacy office rarely gets a look.
How Liquid Handling Instruments Narrow the Gap
Robots don’t get bored. That’s most of the pitch, and the research backs it: a 2026 paper in HardwareX from a University College London team notes that automated pipetting delivers substantially higher accuracy and precision than doing it by hand, with better reproducibility to match.
The newer, and frankly more interesting, development is that modern liquid handling instruments now check the run before committing a single drop.
Take Bio Molecular Systems’ Myra. Sample lists for normalisation or pooling jobs go into its Workbench software as a CSV, which kills off the retyping step (a classic spot for transcription errors). MyraSim then does the maths on volumes and tells you if the protocol simply won’t work. A camera system, MyraVision, looks at the deck and flags missing parts, so the plate someone put in the wrong slot gets noticed while it’s still empty. Mid-run, MyraSense keeps an eye on liquid levels and picks up collisions.
Was any of that designed for a DPO? Obviously not. Yet each check shuts a gap where a sample and its data could part ways, and if you were writing up “reasonable steps” for a regulator, you’d want exactly that sort of thing on the page.
Why Privacy Teams Should Look at the Integrations
The bench hardware is half the story. Once liquid handling instruments talk to a LIMS, an API or a user directory, they’ve joined the data flow, and they deserve the same scrutiny as anything else holding patient identifiers.
Myra’s Workbench links to LIMS, APIs and user management, and drives both the liquid handlers and BMS’s Mic qPCR cyclers from one screen. There’s also MyraScript, a Python-based layer for custom protocols. Scientists love that sort of freedom. A security architect will have questions, and they’re good ones to bring to any vendor: can anyone tweak a protocol, or is editing tied to named logins? Is sample data arriving by integration, by file, or by someone typing? After a run, is there a trail linking samples, operator and method? Where does the run data live, and who sets the retention?
Every vendor will answer differently, and so will every lab, depending on configuration. No product makes you compliant out of the box. But you want this conversation happening before procurement signs off, not during an incident review.
Bringing the Bench Into the Privacy Programme
You don’t need a new framework. You need the current one to stop at the right door.
Most records of processing begin at the LIMS. Push yours back a step, to sample receipt, plate set-up and the instrument run itself, because that’s where the personal data is actually made.
Get a privacy person into automation purchasing conversations, even just for one meeting. A new liquid handler gets treated as a lab budget question. It also decides, quite literally, how health records come into existence.
And keep the receipts. Pre-run simulation, deck verification, automated sample import: if a regulator ever asks what you do to keep health data accurate, those are real answers you can point to.
If your lab is still on manual pipetting, it’s worth sitting through a short demo of pre-run checks on one of your own protocols. You’ll see fairly quickly how much risk is baked into the current process, and how much of it a machine could quietly take off the table.
