REGULATION OF ENCRYPTED COMPUTATION IN GENOMIC ANALYSIS

1. INTRODUCTION

Encrypted computation in genomic analysis refers to the use of cryptographic techniques to analyse DNA sequences, genetic variants and genomic datasets while limiting access to the underlying information. Technologies include homomorphic encryption, secure multiparty computation, private set intersection and, in appropriate architectures, trusted execution environments.

These methods can support collaborative research between hospitals, universities, pharmaceutical companies and genomic databases without requiring unrestricted disclosure of raw genetic information. Nevertheless, encryption does not automatically eliminate privacy risks. Results may reveal sensitive genetic characteristics, and access to decryption keys, metadata or repeated queries may permit identification or inference about individuals and their relatives.

In India, the relevant legal framework includes the constitutional right to privacy, the Information Technology Act, 2000, the applicable provisions of the Digital Personal Data Protection Act, 2023, and relevant research-ethics and healthcare-confidentiality requirements. Patent law, contractual obligations and international data-transfer rules may also become relevant. There is currently no single Indian statute specifically dedicated to encrypted genomic computation.

2. LEGAL AND REGULATORY FRAMEWORK

A. CONSTITUTIONAL RIGHT TO PRIVACY

Article 21 of the Constitution protects personal liberty and the right to privacy. Genomic information can disclose information about disease susceptibility, biological relationships and inherited characteristics. Consequently, governmental collection or use of such information must satisfy applicable constitutional requirements.

B. INFORMATION TECHNOLOGY ACT, 2000

Section 43 addresses specified unauthorised computer-related acts, including unauthorised access and copying of information. Section 66 criminalises conduct covered by Section 43 when undertaken dishonestly or fraudulently. Section 72 concerns specified breaches of confidentiality and privacy, while Section 72A addresses certain disclosures of information in breach of a lawful contract.

Section 43A historically provided compensation for failure by a body corporate to protect sensitive personal data or information through reasonable security practices. Its continuing applicability must be considered alongside the phased commencement of the DPDP Act and the corresponding statutory transition.

C. DIGITAL PERSONAL DATA PROTECTION ACT, 2023

The DPDP Act establishes a framework for lawful processing of digital personal data, including obligations relating to processing purposes, consent where required, security and accountability. Its definition of personal data turns on identifiability rather than whether information is described as genomic, encrypted or pseudonymised.

The Act and DPDP Rules, 2025 have a phased commencement schedule. As of 27 October 2026, the principal processing obligations in Sections 3–17 are scheduled to commence on 13 May 2027. Organisations must therefore comply with the provisions already in force and the applicable existing legal framework while preparing for the remaining obligations. <Cite refs={["turn605968search3","turn605968search9"]}/>

D. RESEARCH ETHICS AND GENOMIC GOVERNANCE

Genomic research should comply with applicable institutional ethics requirements, informed-consent conditions and the relevant ICMR ethical guidelines. Researchers should specify whether data may be reused, shared with commercial partners, analysed internationally or processed for future research purposes.

Where a project involves regulated clinical trials, diagnostic products or medical devices, additional permissions may be required. Encrypted computation does not remove these independent regulatory obligations.

3. CORE COMPLIANCE REQUIREMENTS

LAWFUL PROCESSING: Establish a valid legal basis for genomic-data processing and clearly define the research purpose.

KEY MANAGEMENT: Separate encryption keys from datasets and restrict access to authorised personnel.

PRIVACY-PRESERVING COMPUTATION: Assess homomorphic encryption, secure multiparty computation and other appropriate techniques.

OUTPUT CONTROL: Restrict queries and disclosures that could reveal individual genetic information.

SECURITY TESTING: Assess re-identification, inference, insider threats and implementation vulnerabilities.

AUDITABILITY: Maintain records of data access, computations, permissions and authorised disclosures.

RETENTION AND DELETION: Apply appropriate retention rules and ensure that deletion commitments cover relevant copies and derived datasets where legally and technically feasible.

4. RELEVANT CASE LAWS

1. JUSTICE K.S. PUTTASWAMY (RETD.) v. UNION OF INDIA, (2017) 10 SCC 1

Authority: Direct constitutional authority on privacy.

The Supreme Court recognised privacy as a fundamental right and discussed informational privacy, personal autonomy and the need for lawful and proportionate restrictions.

Legal principle: Genomic computation must respect privacy interests even where the purpose is scientific advancement. The use of encryption can reduce exposure but does not itself establish that the processing is lawful or proportionate.

2. JUSTICE K.S. PUTTASWAMY (RETD.) v. UNION OF INDIA, (2019) 1 SCC 1

Authority: Analogous constitutional authority.

The Supreme Court considered privacy and proportionality in the context of the Aadhaar framework.

Legal principle: Genomic-data systems should demonstrate that the information processed is necessary for the stated objective and that safeguards are proportionate to the risks. The judgment did not directly address encrypted genetic analysis.

3. DISTRICT REGISTRAR AND COLLECTOR, HYDERABAD v. CANARA BANK, (2005) 1 SCC 496

Authority: Analogous privacy authority.

The Supreme Court examined privacy interests relating to access to private records and emphasised protection against unjustified intrusion.

Legal principle: Access to genomic datasets, cryptographic keys and analytical outputs should be limited by appropriate legal authority and safeguards.

4. MR. X v. HOSPITAL Z, (1998) 8 SCC 296

Authority: Direct healthcare-confidentiality authority; analogous application to genomic research.

The Supreme Court considered medical confidentiality in the context of disclosure of a patient's HIV status and competing interests.

Legal principle: Sensitive medical information should not be disclosed merely because another party considers it useful. Genomic researchers must evaluate confidentiality obligations and any lawful basis for disclosure.

5. SELVI v. STATE OF KARNATAKA, (2010) 7 SCC 263

Authority: Analogous constitutional authority concerning bodily privacy and personal autonomy.

The Supreme Court examined the involuntary administration of narcoanalysis, polygraph examinations and brain electrical activation profile tests. It addressed constitutional protections against compelled testimonial evidence and personal autonomy.

Legal principle: Genetic sampling and genomic analysis may raise significant autonomy and privacy questions. The decision is not a direct ruling on DNA databases or encrypted computation, but it reinforces the importance of constitutional safeguards where biological information is collected or used coercively.

6. JUSTICE K.S. PUTTASWAMY (RETD.) v. UNION OF INDIA, (2017) 10 SCC 1 — DNA AND GENETIC INFORMATION DISCUSSION

Authority: Direct constitutional privacy authority concerning genetic information.

The Constitution Bench's privacy judgment discusses the sensitive nature of cellular samples and DNA profiles, including the capacity to reveal identity and genetic relationships.

Legal principle: Genomic information deserves careful protection because its consequences can extend beyond the person whose sample was collected to biological relatives. Secure computation should therefore incorporate safeguards against inference and unauthorised disclosure.

5. LIABILITY AND RISK MANAGEMENT

Liability may arise from unlawful acquisition, unauthorised disclosure, inadequate security or misuse of genomic information. Depending on the facts, consequences may include civil claims, regulatory action, contractual liability or criminal proceedings under applicable law.

Institutions should assess whether a computation provider can access plaintext data, whether outputs can be linked to individuals, and whether the system protects against malicious queries. They should also document key destruction, incident response, access revocation and the limits of any claimed anonymity.

6. PRACTICAL COMPLIANCE FRAMEWORK

A genomic research institution should begin with a documented privacy and security assessment. It should identify data controllers or equivalent responsible parties, determine permitted uses, establish key-management procedures and select cryptographic techniques appropriate to the sensitivity of the analysis.

Before sharing outputs, researchers should assess re-identification risk and enforce limits on query frequency and result granularity. Independent security testing, institutional ethics review and clear participant communications should accompany the technical safeguards.

7. CONCLUSION

Encrypted computation can facilitate valuable genomic research while reducing unnecessary disclosure of sensitive DNA information. However, cryptographic protection is a technical safeguard rather than a complete legal exemption.

Indian constitutional privacy jurisprudence, healthcare-confidentiality principles and applicable data-protection laws require institutions to consider lawful purpose, proportionality, security and accountability. A robust governance framework should combine strong cryptography with responsible key management, ethical oversight, controlled outputs and transparent data-use policies. This approach can support scientific collaboration without treating genetic privacy as a secondary concern.