1. INTRODUCTION

Genetic data refers to information obtained from DNA analysis, genome sequencing, genetic testing, and biological samples. It can reveal inherited diseases, predispositions to medical conditions, ancestry, biological relationships, and other intimate characteristics. Unlike passwords or identification numbers, genetic information cannot ordinarily be changed once exposed.

Privacy rights in genetic data protect individuals against unauthorised collection, disclosure, analysis, retention, and discriminatory use of their biological information. In India, these protections arise principally from the constitutional right to privacy, data protection legislation, medical confidentiality, and applicable criminal and civil laws.

2. LEGAL FRAMEWORK IN INDIA

A. CONSTITUTIONAL PROTECTION: Article 21 protects life and personal liberty, including informational privacy and bodily autonomy. Article 14 also protects against arbitrary State action.

B. DIGITAL PERSONAL DATA PROTECTION ACT, 2023: Identifiable genetic information processed digitally falls broadly within the Act's definition of personal data. The Act provides a framework for lawful processing, consent, security, individual rights, and accountability. However, genetic data is not separately classified as a special category under the Act.

The Digital Personal Data Protection Rules, 2025, were notified with phased commencement. As of October 2026, the principal processing obligations under Sections 3–17 are scheduled to commence eighteen months after the November 2025 notification, in May 2027. Their future application must therefore be distinguished from provisions already in force.

C. INFORMATION TECHNOLOGY ACT, 2000: Section 43A and the Sensitive Personal Data or Information Rules, 2011, may remain relevant to qualifying body-corporate processing of genetic information associated with medical records, subject to their statutory scope and the phased transition under the DPDP framework.

D. MEDICAL CONFIDENTIALITY: Healthcare professionals and laboratories must respect applicable confidentiality obligations. Unauthorised disclosure may also give rise to professional disciplinary action or other legal remedies.

3. MAJOR LEGAL IMPLICATIONS

A. UNAUTHORISED DISCLOSURE: Publishing or transferring genetic results without lawful authority may violate privacy obligations and expose the responsible organisation to legal consequences.

B. DISCRIMINATION: Genetic information may be misused in employment, insurance, education, or social settings. India does not have a comprehensive, standalone genetic-information non-discrimination statute equivalent to the United States' Genetic Information Nondiscrimination Act.

C. INFORMED CONSENT: Individuals should understand the purpose of testing, intended recipients, secondary research uses, storage periods, and potential data-sharing arrangements. Consent for diagnosis should not automatically be treated as consent for unrelated commercial research.

D. FAMILY PRIVACY: Genetic information can reveal risks affecting biological relatives. This creates difficult questions about confidentiality, disclosure, and competing interests in preventing serious harm.

E. DATA BREACHES AND RE-IDENTIFICATION: Removing names does not necessarily make genomic information anonymous. Genetic datasets may be re-identified through comparison with genealogy databases or other available information.

4. IMPORTANT CASE LAWS

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) — Direct constitutional authority.

A nine-judge Supreme Court bench unanimously recognised privacy as a fundamental right under the Constitution. The judgment identified informational privacy as an essential component of personal liberty. Although not a genetic-data case, it provides the central constitutional foundation for protecting genomic information.

2. Justice K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar judgment, 2018) — Analogous authority.

The Court examined the constitutional validity of collecting and using identity and biometric information. It applied legality, legitimate State purpose, and proportionality to privacy restrictions. These principles are relevant to compulsory genetic databases and genomic surveillance.

3. District Registrar and Collector v. Canara Bank (2005) — Analogous authority.

The Supreme Court recognised privacy interests in personal documents and records against unjustified State intrusion. Its reasoning supports safeguards against indiscriminate access to confidential genetic and medical records.

4. Mr. X v. Hospital Z (1998) — Analogous authority.

The Supreme Court considered medical confidentiality in the context of disclosure of HIV status and competing interests in preventing harm. The decision illustrates that confidentiality is important but not absolute; any proposed disclosure of genetic information requires careful consideration of applicable law and circumstances.

5. Suchita Srivastava v. Chandigarh Administration (2009) — Analogous authority.

The Court recognised reproductive choice and bodily integrity as aspects of personal liberty under Article 21. The judgment is relevant to genetic testing, reproductive genetics, and decisions involving bodily autonomy.

6. Selvi v. State of Karnataka (2010) — Analogous authority.

The Supreme Court restricted involuntary administration of certain investigative techniques, including narco-analysis and related tests, on constitutional grounds. The decision supports scrutiny of compelled biological or genetic investigations, although it did not establish a general prohibition on DNA testing.

7. Sharda v. Dharmpal (2003) — Analogous authority.

The Court considered medical examination in matrimonial proceedings and held that courts possess power to order examinations in appropriate circumstances. The case demonstrates that bodily privacy must be balanced against legitimate judicial needs rather than treated as absolute.

5. PRACTICAL COMPLIANCE AND REMEDIES

Genetic-testing laboratories, hospitals, biobanks, and research institutions should obtain appropriate consent, restrict access, encrypt genomic records, maintain audit logs, establish retention and deletion policies, and separate clinical testing from optional research participation. Cross-border transfers should be assessed under applicable data-protection, research, and sector-specific requirements.

Affected individuals may seek institutional grievance redressal, professional complaints, civil remedies, or constitutional judicial review where legally available. The appropriate remedy depends on the applicable law, evidence of misuse, and the nature of the defendant.

6. CONCLUSION

Privacy rights in genetic data protect dignity, autonomy, confidentiality, and freedom from unjustified biological surveillance. India's constitutional jurisprudence provides a strong foundation, while data-protection legislation supplies an evolving statutory framework. Because genetic information can expose details about both individuals and their relatives, responsible governance requires meaningful consent, restricted access, robust security, and proportionate disclosure. Stronger genetic-specific safeguards would help address the distinctive risks of discrimination, re-identification, and irreversible exposure.