Genetic Privacy and Data Protection in India: Emerging Legal Challenges in the Age of Genomic Research

Genetic data is a highly specific type of personal data, being inalterable, inherently family-like, capable of being used to predict future health states, and incapable of being completely anonymized. With the growing strides India is making towards its genomic goals defined under the Genome India project and the general push for precision medicine, the current legal architecture to regulate genomic data has become a pressing constitutional, statutory, and ethical concern. This article engages in a doctrinal analysis and comparative legal analysis of the existing
regulatory framework of genomic data in India, namely the Justice K.S. Puttaswamy (Retd.) v Union of India (2017) case, the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and the Indian Council of Medical Research (ICMR) National Ethical Guidelines, 2017.

The analysis places India’s framework in a comparative perspective, which is based on the General Data Protection Regulation of the European Union, the Genetic Information Nondiscrimination Act of the United States, as well as institutional governance models of the United Kingdom Biobank and Genomics England. The study points out six key regulatory gaps in the Indian regulatory landscape: the absence of a sui generis special category for genetic data, the absence of an adequate informed consent architecture suitable for longitudinal genomic research, the lack of statutory storage and retention limits, the lack of an anti-genetic discrimination statute, structural vulnerabilities in cross-border data transfer governance, and the total absence of any statutory frameworks for AI-driven predictive genomics. The article concludes with evidence-based recommendations for the enactment of a dedicated Genetic Data Protection Act, a Genetic Non-Discrimination Act, and a National Genomic Data Regulatory Authority.

1. Balagurunathan, Y., Sethuraman, R.R. (2024). An analysis of ethics-based foundation and regulatory issues for genomic data privacy. Journal of the Institution of Engineers (India): Series B, 105(4), 1097–1107. https://doi.org/10.1007/s40031-024-01058-3

2. Barman, B., Sarmah, S. (2025, February). Data Privacy and Security in Healthcare Systems Using Blockchain: A Review. In: 2025 3rd International Conference on Intelligent Systems, Advanced Computing and Communication (ISACC) (pp. 213–218). IEEE. https://doi.org/10.1109/isacc65211.2025.10969312

3. Chatterjee, S., Sreenivasulu, N.S. (2022). Artificial intelligence and human rights: a comprehensive study from Indian legal and policy perspective. International Journal of Law and Management, 64(1), 110–134. https://doi.org/10.1108/IJLMA-02-2021-0049

4. Staunton, C., Slokenberga, S., Parziale, A., Mascalzoni, D. (2022). Appropriate safeguards and Article 89 of the GDPR: Considerations for biobank, databank and genetic research. Front. Genet, 13, 719317. 10.3389/fgene.2022.719317

5. Erlich, Y., Shor, T., Pe’er, I., Carmi, S. (2018). Identity inference of genomic data using long-range familial searches. Science, 362(6415), 690–694. https://doi.org/10.1126/science.aau4832

6. Feeney, O. (2024). Catching the next wave? The relationship between UNESCO and developments in genomics. European Journal of Human Genetics, 32, 605–606. https://doi.org/10.1038/s41431-024-01621-y

7. Gymrek, M., McGuire, A.L., Golan, D., Halperin, E., Erlich, Y. (2013). Identifying personal genomes by surname inference. Science, 339(6117), 321–324. https://doi.org/10.1126/science.1229566

8. Hanspal, M.S. (2025). The Digital Personal Data Protection Act, 2023: Key Provisions, Issues, and Future Directions. Journal of Law, 6(2), 12–23. https://doi.org/10.53361/dmejl.v6i02.02

9. Indian Council of Medical Research. (2017). National Ethical Guidelines for Biomedical and Health Research Involving Human Subjects. Chapter 7. ICMR.

10. Joly, Y., Dupras, C., Pinkesz, M., Tovino, S.A., Rothstein, M.A. (2020). Looking beyond GINA: policy approaches to address genetic discrimination. Annual Review of Genomics and Human Genetics, 21(1), 491–507. https://doi.org/10.1146/annurev-genom-111119-011436

11. Kaye, J. (2012). The tension between data sharing and the protection of privacy in genomics research. Annual Review of Genomics and Human Genetics, 13(1), 415–431. https://doi.org/10.1146/annurev-genom-082410-101454

12. Knoppers, B.M. (2010). Consent to “personal” genomics and privacy. The EMBO Reports, 11(6), 416–419. https://doi.org/10.1038/embor.2010.69

13. Knoppers, B.M., Harris, J.R., Budin-Ljøsne, I., Dove, E.S. (2014). A human rights approach to an international code of conduct for genomic and clinical data sharing. Human Genetics, 133(7), 895–903. https://doi.org/10.1007/s00439-014-1432-6

14. Nakta, V., Dahiya, S. (2024). Genetic jurisprudence: reimagining Indian legal system’s approach to DNA evidence and privacy protections. Panjab University Law Review, 63(1), 130–146. https://pulr.puchd.ac.in/index.php/pulr/article/view/280

15. Naveed, M., Ayday, E., Clayton, E.W., Fellay, J., Gunter, C.A., Hubaux, J.P., ... Wang, X. (2015). Privacy in the genomic era. ACM Computing Surveys (CSUR), 48(1), 1–44. https://doi.org/10.1145/2767007

16. Peloquin, D., Machin, E., Aurelius, L. (2026, April 24). The European Data Protection Board releases new guidelines on the processing of personal data for scientific research. Ropes & Gray LLP. Available at: https://www.ropesgray.com/en/insights/alerts/2026/04/the-european-data-protection-board-releases-new-guidelines-on-the-processing-of-personal-data

17. Phillips, A., Borry, P., Van Hoyweghen, I., Vears, D.F. (2021). Disclosure of genetic information to family members: a systematic review of normative documents. Genetics in Medicine, 23(11), 2038–2046. https://doi.org/10.1038/s41436-021-01248-0

18. Solove, D.J. (2006). A taxonomy of privacy. University of Pennsylvania Law Review, 154(3), 477–564. https://doi.org/10.2307/40041279

19. Tabor, H.K., Berkman, B.E., Hull, S.C., Bamshad, M.J. (2011). Genomics really gets personal: how exome and whole genome sequencing challenge the ethical framework of human genetics research. American Journal of Medical Genetics Part A, 155(12), 2916–2924. https://doi.org/10.1002/ajmg.a.34357

20. Takashima, K., Maru, Y., Mori, S., Mano, H., Noda, T., Muto, K. (2018). Ethical concerns on sharing genomic data including patients’ family members. BMC Medical Ethics, 19(1), 61. https://doi.org/10.1186/s12910-018-0310-5

21. Tavani, H.T. (2004). Genomic research and data-mining technology: Implications for personal privacy and informed consent. Ethics and Information Technology, 6(1), 15–28. https://doi.org/10.1023/B:ETIN.0000036156.77169.31

22. UNESCO. (1997). Universal Declaration on the Human Genome and Human Rights. UNESCO General Conference, 29th Session. Available at: https://unesdoc.unesco.org/ark:/48223/pf0000110220

23. UNESCO. (2003). International Declaration on Human Genetic Data. UNESCO General Conference, 32nd Session (32 C/Res 22). Available at: https://unesdoc.unesco.org/ark:/48223/pf0000136112

24. UNESCO. (2005). Universal Declaration on Bioethics and Human Rights. UNESCO General Conference, 33rd Session. Available at: https://unesdoc.unesco.org/ark:/48223/pf0000146180

25. Wang, T., Liu, L. (2009). From Data Privacy to Location Privacy. In: Machine Learning in Cyber Trust (pp. 217–246). Springer, Boston, MA. https://doi.org/10.1007/978-0-387-88735-7_9