Regulation and governance of dna databases in India

Introduction

DNA databases are organised collections of genetic profiles maintained for identification, criminal investigation, missing-person identification and other authorised purposes. They contain highly sensitive personal information because DNA can reveal an individual’s identity, biological relationships and certain inherited characteristics. Therefore, their regulation requires a balance between effective law enforcement, privacy, individual liberty and protection against misuse.

In India, DNA database governance is primarily addressed through the Criminal Procedure (Identification) Act, 2022, the Information Technology Act, 2000, constitutional privacy protections and relevant rules governing the handling of personal data. The framework must also be understood in light of the Supreme Court’s decisions on privacy and bodily autonomy.

Legal framework governing DNA databases in India

The Criminal Procedure (Identification) Act, 2022 replaced the Identification of Prisoners Act, 1920. It authorises the collection and preservation of specified measurements and related records of convicted persons, arrested persons and certain other categories of individuals. The term “measurements” includes physical and biological samples, their analysis and behavioural attributes.

The Act permits authorised agencies to collect prescribed measurements and provides for their retention in accordance with statutory requirements. The National Crime Records Bureau (NCRB) is empowered to collect, store, preserve, process and disseminate records of measurements. However, the Act does not establish a comprehensive, standalone statutory regime exclusively governing DNA databases. Its broad collection powers must therefore be interpreted consistently with constitutional safeguards.

The Information Technology Act, 2000, particularly Section 43A and the associated sensitive personal data framework, historically provided protections concerning sensitive personal information. The Digital Personal Data Protection Act, 2023 establishes a broader framework for processing digital personal data, subject to its provisions, exemptions and implementation arrangements. The precise application of these laws to law-enforcement DNA records must be assessed according to the relevant statutory provisions.

Constitutional protection of genetic information

Article 21 of the Constitution protects life and personal liberty, including the right to privacy. DNA information deserves heightened protection because it can expose intimate biological characteristics and familial connections.

Article 14 requires non-arbitrary and non-discriminatory State action. Consequently, DNA collection policies must have a rational purpose and should not disproportionately affect particular communities or social groups.

Article 20(3), which protects an accused person against compelled self-incrimination, may also become relevant where biological evidence is collected through coercive procedures. Courts must distinguish between physical evidence and compelled testimonial communication while ensuring that collection methods remain lawful and proportionate.

Important case laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

The Supreme Court unanimously recognised privacy as a fundamental right under Article 21 and Part III of the Constitution. It held that any restriction on privacy must satisfy legality, legitimate State purpose, proportionality and appropriate procedural safeguards. These principles are central to DNA databases because genetic information is exceptionally sensitive and its collection may affect privacy even when used for criminal investigation.

2. Selvi v. State of Karnataka (2010)

The Supreme Court considered the constitutional validity of involuntary narco-analysis, polygraph examinations and brain-mapping techniques. It held that involuntary administration of these techniques violates Articles 20(3) and 21. Although the case did not directly concern DNA databases, it establishes important safeguards against compelled investigative techniques and reinforces the importance of personal liberty and bodily integrity.

3. District Registrar and Collector v. Canara Bank (2005)

The Supreme Court recognised that privacy protections extend to confidential personal and financial records. It emphasised that State access to private information must be supported by lawful authority. This principle is relevant to DNA databases because genetic records should not be accessed or disclosed without a legitimate legal basis.

4. Gobind v. State of Madhya Pradesh (1975)

The Supreme Court acknowledged the constitutional significance of privacy while recognising that privacy rights may be subject to carefully justified restrictions. The decision provides an early foundation for evaluating State surveillance and personal-data collection.

5. Ritesh Sinha v. State of Uttar Pradesh (2019)

The Supreme Court considered whether a Magistrate could direct an accused person to provide a voice sample. It recognised the power to direct such collection under the criminal procedure framework. Although voice samples are not DNA profiles, the judgment is relevant to the legal treatment of physical or identifying evidence during criminal investigations.

Governance and safeguards for DNA databases

Effective governance requires clear rules governing collection, storage, access, use and destruction of DNA profiles. Important safeguards include:

Purpose limitation: DNA profiles should be used only for legally authorised purposes.

Restricted access: Only authorised personnel should access database records.

Data security: Encryption, access logs and cybersecurity controls should prevent unauthorised disclosure.

Retention limits: Records should not be retained indefinitely without legal justification.

Independent oversight: Collection and use should be subject to institutional monitoring and judicial review.

Accuracy and correction: Individuals should have appropriate procedures to challenge incorrect records.

Protection against discrimination: Genetic information should not be used to stigmatise individuals or their families.

A particularly important distinction must be maintained between DNA profiles used for identification and the underlying biological samples. Biological samples may contain substantially more information than the limited identification profile stored in a database. Their retention and secondary use therefore require stronger safeguards.

Challenges in implementation

India faces several challenges, including the absence of a comprehensive DNA-specific governance statute, uncertainty concerning retention and deletion, risks of unauthorised access, possible misuse of familial genetic information and inadequate public awareness. The collection of genetic information from vulnerable communities also raises concerns about discrimination and disproportionate surveillance.

Furthermore, technological developments make it increasingly possible to infer sensitive information from genetic data. Governance standards must therefore evolve alongside forensic technology.

Conclusion

The regulation of DNA databases in India requires a carefully balanced legal framework that supports criminal investigation without compromising constitutional freedoms. The Criminal Procedure (Identification) Act, 2022 provides statutory authority for collecting and maintaining specified measurements, while constitutional privacy principles and data-protection legislation provide important safeguards. The decisions in Puttaswamy, Selvi and Canara Bank establish significant principles concerning privacy, bodily autonomy and access to personal information. A dedicated DNA governance framework with clear retention limits, independent oversight, strict access controls and effective remedies would strengthen public confidence and protect individual rights.