1. Introduction

Cross-Border Genetic Data Sharing Adequacy Standards refer to the legal principles, regulatory requirements and institutional safeguards governing the transfer of human genetic information from one country to another, particularly where the receiving country has a different level of data protection, privacy regulation, research oversight and cybersecurity infrastructure.

Genetic data includes information derived from an individual's DNA, RNA, chromosomes, genetic sequencing, inherited characteristics and biological samples. Such information can reveal highly sensitive details concerning:

Individual genetic identity and inherited characteristics.

Hereditary diseases and medical predispositions.

Family relationships, ancestry and biological parentage.

Reproductive characteristics and genetic risks.

Potential health conditions of biological relatives.

Population-level genetic characteristics.

Cross-border sharing is important for international genomic research, rare-disease diagnosis, personalized medicine, biotechnology development, pharmaceutical research and international public-health cooperation.

However, genetic information presents distinctive legal risks because it is generally permanent, potentially identifiable and capable of revealing information about individuals who never directly consented to the original research.

The central legal question is:

When can one country lawfully transfer genetic information to another country while ensuring that the receiving country provides an adequate level of privacy, confidentiality, security and legal protection?

Adequacy is not simply a question of whether two countries have similar privacy legislation. It concerns the practical effectiveness of legal rights, enforcement mechanisms, independent supervision, remedies and restrictions on further disclosure.

2. Meaning and Legal Nature of Adequacy Standards

Adequacy standards determine whether a foreign jurisdiction, institution or transfer arrangement provides sufficient safeguards for personal genetic information.

An adequacy assessment generally considers six dimensions:

Legal adequacy: Whether the receiving jurisdiction has enforceable privacy and data-protection legislation.

Institutional adequacy: Whether independent regulatory authorities supervise genetic-data processing.

Technical adequacy: Whether appropriate encryption, access controls and cybersecurity measures exist.

Procedural adequacy: Whether collection, transfer, processing and retention are governed by transparent procedures.

Individual-rights adequacy: Whether individuals can access, correct, restrict or seek deletion of their genetic information where legally applicable.

Remedial adequacy: Whether effective judicial or administrative remedies are available following unlawful disclosure or misuse.

Adequacy must also address onward transfers. A foreign research institution should not automatically be permitted to transfer genetic information to another country merely because it originally received the information lawfully.

Important distinction: An adequacy decision, contractual safeguard, research consent and ethical approval are separate legal mechanisms. One does not automatically replace the others.

3. International Legal Framework

A. European Union – General Data Protection Regulation (GDPR)

The GDPR provides one of the most developed legal frameworks for international genetic-data transfers.

Relevant provisions:

Under Article 9, genetic data is classified as special-category personal data. Its processing is generally prohibited unless a recognised exception applies, such as explicit consent or qualifying scientific research supported by appropriate safeguards.

Under Article 45, the European Commission may recognise a non-EU country as providing adequate protection. An adequacy decision allows covered personal data to flow to that country without requiring an additional Chapter V transfer mechanism.

However, adequacy does not eliminate the need to comply with the GDPR's other processing requirements.

European Commission+2

Important legal principle: A country cannot be considered adequate merely because it has enacted a data-protection statute. Its legal system must provide effective protection in practice.

B. International Transfer Through Standard Contractual Clauses

Where the destination country does not have an adequacy decision, organisations may use appropriate safeguards under Article 46.

Standard Contractual Clauses (SCCs) are particularly important for international genomic research.

An agreement between an Indian genomic research institution and a European biotechnology company, for example, may regulate:

Permitted research purposes.

Restrictions on secondary use.

Confidentiality obligations.

Encryption and access management.

Prohibition of unauthorised onward transfers.

Data-breach notification.

Retention and destruction.

Individual rights and complaint mechanisms.

Independent audits and regulatory cooperation.

Nevertheless, contractual promises alone may be insufficient where the receiving country's surveillance or other domestic laws undermine those protections.

C. UNESCO International Framework

The UNESCO International Declaration on Human Genetic Data (2003) is an important international normative instrument.

It addresses:

Consent for collection and processing.

Confidentiality of genetic information.

Genetic-data sharing.

Cross-border cooperation.

Non-discrimination.

Protection of human dignity.

Access to genetic information.

Scientific research and international solidarity.

The Declaration recognises that genetic information has implications beyond the individual because it can reveal information about biological relatives and communities.

It is not a directly enforceable international treaty. Its importance lies in providing ethical and policy standards for national legislation and institutional research governance.

D. Council of Europe Framework

The Council of Europe's Convention 108 and Convention 108+ establish international principles for personal-data protection.

Their relevance to genetic-data transfers includes:

Fair and lawful processing.

Purpose specification.

Data security.

Special protection for sensitive information.

Independent supervision.

Appropriate safeguards for international transfers.

The Oviedo Convention on Human Rights and Biomedicine is also relevant to genetic testing, informed consent and the protection of human dignity, although its applicability depends on the state's treaty commitments.

4. Indian Legal Framework

India's legal position must be examined separately because India does not operate an EU-style general adequacy-decision system.

A. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) is the principal general legislation governing digital personal data in India.

Important provisions include:

Section 4 – Grounds for processing

Processing must be based on consent or another recognised legitimate use under the Act.

Section 5 – Notice

The Data Principal must receive the prescribed information concerning the processing of personal data.

Section 6 – Consent

Consent must satisfy statutory requirements, including being free, specific, informed, unconditional and unambiguous.

Section 8 – General obligations of Data Fiduciaries

Data Fiduciaries must comply with applicable obligations concerning security safeguards, accuracy where relevant, breach notification and erasure.

Section 16 – Processing of personal data outside India

The Central Government may restrict transfers of personal data to specified countries or territories. Other Indian laws providing a higher degree of protection or transfer restrictions continue to apply.

The DPDP Act does not expressly create a separate category of genetic data equivalent to GDPR Article 9 special-category data. Consequently, genetic information is generally regulated as personal data when it identifies or relates to an identifiable individual.

India Code+1

B. Digital Personal Data Protection Rules, 2025

The DPDP Rules, 2025 were notified in November 2025.

Rule 15 addresses transfers of personal data outside India and allows requirements to be specified by the Central Government concerning the availability of personal data to foreign states, their agencies and entities under their control.

Rule 16 addresses exemptions for research, archiving and statistical purposes, subject to the standards specified in the Second Schedule.

These provisions are important for international genetic research because research exemptions should not be interpreted as unrestricted permission to disclose identifiable genomic information.

The commencement schedule of the Act and Rules must also be considered when determining which obligations are operative on a particular date.

Press Information Bureau+1

C. Constitutional Protection of Genetic Privacy

Article 21 of the Constitution of India protects life and personal liberty, including the fundamental right to privacy.

Article 14 is relevant to arbitrary or discriminatory treatment based on genetic characteristics.

Article 19 may become relevant where genetic-data restrictions affect protected research, expression or professional activity, subject to constitutional limitations.

The constitutional framework becomes particularly significant when government agencies collect, retain, disclose or transfer genetic information without adequate legal authority or safeguards.

5. Adequacy Assessment: Essential Legal Standards

An international genetic-data transfer should be evaluated through the following standards.

A. Equivalent Level of Protection

The receiving country should provide protection that is sufficiently equivalent to the protection required by the exporting jurisdiction.

This does not necessarily require identical legislation. Instead, the assessment examines whether the foreign legal system provides effective and enforceable protection.

For example, a European university transferring genomic information to a research centre in India should examine whether the Indian recipient can prevent unauthorised access, commercial exploitation and disclosure to third parties.

B. Purpose Limitation

Genetic information should be transferred for a clearly defined purpose.

Permissible purposes may include:

Diagnosis of rare genetic diseases.

International cancer research.

Pharmacogenomic studies.

Population-health research.

Development of gene therapies.

International clinical trials.

A transfer for disease research should not automatically authorise subsequent use for insurance underwriting, employment screening, commercial ancestry profiling or unrelated predictive analytics.

C. Data Minimisation

Only the genetic information necessary for the specified purpose should be transferred.

For example, if researchers require a limited set of genetic variants, transferring an individual's entire genome may be disproportionate.

The organisation should consider whether the purpose can be achieved through:

Selected genetic markers.

Pseudonymised genomic records.

Aggregated datasets.

Federated research.

Secure computing environments.

D. Informed and Specific Consent

Consent should explain:

What genetic information will be collected.

Which foreign institution will receive it.

The country where processing will occur.

The scientific or commercial purpose.

Whether secondary research is anticipated.

Whether the information will be retained indefinitely or for a specified period.

Whether onward transfer is contemplated.

What rights and complaint mechanisms are available.

Consent to genetic testing does not necessarily constitute consent to unlimited international sharing.

Furthermore, consent is not the only possible lawful basis under every legal system. Public-interest research and other statutory grounds may apply where the relevant legal conditions and safeguards are satisfied.

E. Genetic Re-identification Risk

Removing names and addresses does not necessarily make genomic data anonymous.

A genome contains distinctive information that may be matched against genealogy databases, family records or other datasets.

Therefore, adequacy assessment must consider:

Re-identification through genomic comparison.

Familial identification.

Cross-database matching.

Population inference.

Ancestry identification.

Identification through rare genetic variants.

Pseudonymisation reduces risk but does not convert personal data into anonymous information where identification remains reasonably possible.

F. Security and Cybersecurity

Appropriate technical safeguards should include:

Encryption during transmission.

Encryption at rest.

Multi-factor authentication.

Role-based access controls.

Secure genomic databases.

Audit logs.

Controlled downloading.

Intrusion detection.

Regular vulnerability assessments.

Secure destruction of unnecessary copies.

The receiving institution should demonstrate that these measures are actually implemented rather than merely promised in a contract.

G. Onward Transfer Restrictions

A foreign recipient should not be able to transfer genetic information to another institution without satisfying applicable legal requirements.

For instance:

An Indian research institution receives genomic data from Germany and subsequently sends the same information to a biotechnology company in another country.

The original transfer arrangement should specify whether such disclosure is authorised, under what conditions, and what safeguards apply.

H. Independent Supervision and Remedies

Adequacy also depends on whether affected individuals can obtain meaningful remedies.

These may include:

Complaints to data-protection authorities.

Judicial review.

Compensation where legally available.

Orders restricting further processing.

Regulatory investigation.

Correction or deletion where appropriate.

Notification of serious data breaches.

A foreign jurisdiction that provides theoretical privacy rights but no practical means of enforcing them may fail the adequacy assessment.

6. Important Judicial Decisions and Case Laws

The following judgments are particularly relevant. Some directly concern genetic information, while others establish broader principles governing privacy, international data transfers and genetic research.

Case 1. Data Protection Commissioner v. Facebook Ireland Ltd and Schrems (Schrems II)

Direct international-transfer precedent

Court: Court of Justice of the European Union.

Citation: Case C-311/18.

Date: 16 July 2020.

Facts:

Maximillian Schrems challenged the transfer of personal information from Facebook Ireland to the United States.

The dispute concerned whether contractual safeguards adequately protected European personal data against access by foreign public authorities, particularly under national-security surveillance legislation.

Legal issues:

Whether standard contractual clauses could support international data transfers.

Whether the receiving country's surveillance laws undermined contractual safeguards.

Whether individuals possessed enforceable rights and effective remedies.

Whether the EU-US Privacy Shield provided adequate protection.

Judgment:

The CJEU upheld the validity of the Standard Contractual Clauses mechanism in principle but invalidated the EU-US Privacy Shield adequacy decision.

It held that international transfers must provide a level of protection essentially equivalent to that guaranteed under EU law.

Exporters must assess the circumstances of the transfer and the relevant laws and practices of the destination country. Where necessary, supplementary measures must be implemented.

Relevance to genetic-data sharing:

Suppose a European genomics company transfers whole-genome sequencing data to a foreign cloud-computing provider.

Even if the provider signs contractual confidentiality agreements, the transfer may remain problematic if foreign public authorities can access the information without sufficient legal limitations or effective remedies.

The company must examine the practical effectiveness of its safeguards.

Legal principle: Contractual compliance alone cannot establish adequacy where the receiving country's legal system defeats the protection promised by the contract.

EUR-Lex+2

Case 2. Schrems v. Data Protection Commissioner (Schrems I)

Court: Court of Justice of the European Union.

Citation: Case C-362/14.

Date: 6 October 2015.

Facts:

Schrems challenged the transfer of personal data to the United States under the former Safe Harbour framework.

The challenge arose from concerns regarding access to personal data by US intelligence authorities.

Judgment:

The CJEU invalidated the European Commission's Safe Harbour adequacy decision.

It emphasised the importance of effective protection of fundamental rights and the independence and powers of national supervisory authorities.

Relevance to genetic information:

Genomic information may reveal extremely intimate personal and familial characteristics.

A receiving country should therefore provide meaningful protection against disproportionate government access, unauthorised commercial disclosure and inadequate remedies.

The judgment demonstrates that an adequacy framework cannot survive merely because an international arrangement has been formally recognised.

Case 3. Justice K.S. Puttaswamy (Retd.) v. Union of India

Leading Indian constitutional precedent

Court: Supreme Court of India.

Citation: (2017) 10 SCC 1.

Date: 24 August 2017.

Bench: Nine judges.

Facts:

The case concerned whether privacy was constitutionally protected under Indian law, particularly in the context of the Aadhaar programme and the increasing collection and use of personal information.

Judgment:

The Supreme Court unanimously recognised privacy as a fundamental right protected under Article 21 and other freedoms guaranteed by Part III of the Constitution.

The judgment recognised informational privacy as an important component of the constitutional right to privacy.

It also established a threefold test for assessing an infringement of privacy:

Legality: There must be a valid legal basis.

Legitimate aim: The interference must pursue a legitimate governmental objective.

Proportionality: The measure must bear a rational and proportionate relationship to that objective.

Relevance to genetic-data sharing:

The decision provides a constitutional foundation for protecting genetic information against arbitrary collection, disclosure and international transfer.

For example, if an Indian public authority transfers citizens' genetic profiles to a foreign institution without adequate legal authority, safeguards or proportionality, the transfer may raise constitutional concerns.

The decision also supports the argument that privacy protection must address non-state actors, including private biotechnology companies and genomic research institutions.

Legal principle: Informational privacy is a constitutional entitlement, and technological advancement does not eliminate the individual's right to control personal information.

Indian Kanoon+2

Case 4. S. and Marper v. United Kingdom

Court: European Court of Human Rights, Grand Chamber.

Application Nos.: 30562/04 and 30566/04.

Date: 4 December 2008.

Facts:

The applicants challenged the indefinite retention of their fingerprints, DNA samples and DNA profiles following criminal proceedings in which one applicant was acquitted and the proceedings against the other were discontinued.

Legal issues:

Whether the indefinite retention of DNA samples and profiles violated the right to respect for private life under Article 8 of the European Convention on Human Rights.

Judgment:

The Court held that the blanket and indiscriminate retention of the applicants' biometric and DNA information violated Article 8.

It recognised that DNA samples contain extensive genetic and health-related information, including information about biological relatives.

The Court emphasised the importance of safeguards against misuse and disproportionate retention.

Relevance to cross-border genetic-data sharing:

The judgment establishes that DNA information is not merely an ordinary identification record.

International genomic databases must consider:

Familial privacy.

Restrictions on secondary use.

Retention periods.

Access controls.

Necessity of storage.

Protection against indiscriminate disclosure.

Legal principle: Genetic information requires particularly careful protection because it can reveal information about both the individual and their biological relatives.

BAILII

Case 5. Gaughran v. United Kingdom

Court: European Court of Human Rights.

Application No.: 45245/15.

Date: 13 February 2020.

Facts:

The applicant challenged the indefinite retention of his DNA profile, fingerprints and photograph after a conviction for driving with excess alcohol.

His original DNA sample was destroyed, but his DNA profile continued to be retained.

Judgment:

The Court found a violation of Article 8.

It considered the indiscriminate nature of retention, the absence of meaningful review and the failure to adequately balance the competing interests.

Importantly, it explained that DNA profiles can reveal genetic relationships even after the original data subject has died.

Relevance:

A foreign genomic institution should not retain transferred genetic information indefinitely merely because it was initially received lawfully.

Retention must be justified by purpose, necessity, proportionality and applicable legal requirements.

This is particularly important for international repositories containing genetic information from deceased research participants.

HUDOC+1

Case 6. Greenberg v. Miami Children's Hospital Research Institute

Court: United States District Court, Southern District of Florida.

Citation: 264 F. Supp. 2d 1064 (S.D. Fla. 2003).

Date: 29 May 2003.

Facts:

Parents of children affected by Canavan disease and supporting organisations had contributed biological materials and research assistance to facilitate research into the disease.

A dispute arose after the research findings were used in connection with patenting and commercial genetic testing.

Legal issues:

The litigation involved the use of contributed biological materials, research expectations, informed consent and commercialisation of genetic research.

Relevance:

The case demonstrates the legal importance of understanding the intended purposes of genetic research contributions.

Where biological samples or genetic datasets are shared internationally, institutions should clearly distinguish between:

Academic research.

Diagnostic development.

Commercial research.

Patent-related activities.

Licensing.

Secondary research.

Consent and contractual arrangements should address the foreseeable scope of these activities.

Legal principle: Genetic research contributions can generate disputes when the actual use of contributed materials or research outputs differs from participants' expectations.

PubMed

Case 7. Moore v. Regents of the University of California

Court: Supreme Court of California.

Citation: 51 Cal. 3d 120, 793 P.2d 479 (1990).

Date: 9 July 1990.

Facts:

John Moore underwent medical treatment at the University of California. Researchers developed a commercially valuable cell line from his biological materials without adequately disclosing their financial interests.

Judgment:

The California Supreme Court rejected Moore's conversion claim based on ownership of the excised cells but allowed claims concerning the alleged failure to obtain informed consent and breach of fiduciary duty to proceed.

Relevance:

The case is important in distinguishing physical ownership of biological materials from the legal obligations surrounding their collection, disclosure and research use.

In cross-border genomic projects, researchers should disclose foreseeable commercial interests and clarify the rights and obligations associated with biological samples and derived datasets.

Legal principle: Research institutions must not ignore informed-consent and disclosure obligations merely because biological materials have entered a research process.

7. Additional Legal Issues in Cross-Border Genetic Data Transfers

A. Conflict Between National Privacy Laws

Different countries adopt different approaches to genetic-data protection.

For example:

The EU treats genetic data as a specially protected category under GDPR Article 9.

India regulates genetic information under its general personal-data framework, without creating a separate GDPR-style special category.

The United States has a sectoral framework involving health privacy, research regulation and genetic-discrimination legislation.

Other jurisdictions may rely on constitutional rights, general privacy statutes or research-ethics regulations.

This creates conflicts concerning the lawfulness of international transfers.

Example:

An Indian biotechnology company receives genomic information from a German university. The German institution must satisfy the GDPR's international-transfer requirements, while the Indian company must comply with applicable Indian requirements.

Compliance with Indian law alone does not establish compliance with the GDPR.

B. Genetic Information and Familial Privacy

One person's genetic information may reveal information about other biological relatives.

For example, an individual may consent to international genomic research, but their genetic profile may reveal:

An undisclosed biological parent.

The existence of previously unknown siblings.

Hereditary disease risks.

Genetic ancestry.

Biological relationships within a family.

This creates a conflict between individual autonomy and familial privacy.

The law must distinguish between the participant's authority to consent to processing of their own data and the rights of relatives who may be indirectly identifiable.

C. Genetic Data of Children

International transfers involving children's genetic information require particular care.

Relevant safeguards include:

Appropriate parental or guardian authorisation where required.

Consideration of the child's best interests.

Age-appropriate explanations.

Restrictions on unrelated commercial use.

Protection against future discrimination.

Appropriate retention and deletion policies.

Parental consent should not automatically be treated as unlimited permission for lifelong commercial exploitation of a child's genetic information.

D. Genetic Data of Deceased Persons

A further issue concerns the international transfer of genetic information after the death of the original participant.

Although some privacy statutes exclude deceased persons from their general personal-data protections, other legal interests may survive or arise independently.

These include:

Confidentiality obligations.

Contractual commitments.

Family members' privacy.

Research-ethics obligations.

Restrictions on the use of biological materials.

National rules concerning human tissue and genetic samples.

The reasoning in Gaughran illustrates why genetic information may continue to affect living relatives even after the original individual dies.

E. Commercialisation and Intellectual Property

International genomic research frequently involves pharmaceutical companies, biotechnology companies and research institutions.

A transfer agreement should distinguish between ownership or control of biological samples, access to genetic datasets, intellectual property rights and rights to commercialise research outcomes.

Important legal questions include:

Can the recipient patent a research invention derived from transferred genetic information?

Can genetic datasets be licensed commercially?

Can the recipient share information with pharmaceutical companies?

Can genomic information be used to train artificial intelligence?

Are participants entitled to information about commercial uses?

Are benefit-sharing obligations applicable?

The Nagoya Protocol may also become relevant where genetic resources fall within its scope and the relevant jurisdictional and treaty conditions are satisfied. It should not be assumed that every human genomic dataset automatically falls within the Protocol.

8. Comparative Analysis of International Adequacy Standards

Important qualification: The United States does not have one universal adequacy system equivalent to the EU GDPR. HIPAA, for example, applies to specified covered entities and business associates, rather than every organisation handling genetic information.

9. Institutional Responsibilities and Regulatory Accountability

Cross-border genetic-data sharing requires accountability at multiple institutional levels.

1. Exporting institution

The exporting organisation must:

Identify a lawful basis for processing.

Establish the legal basis for international transfer.

Assess the destination jurisdiction.

Provide required participant information.

Verify the recipient's safeguards.

Document the transfer decision.

2. Receiving institution

The recipient must:

Follow agreed processing purposes.

Maintain confidentiality.

Prevent unauthorised access.

Restrict onward transfers.

Maintain appropriate security.

Respect applicable deletion and retention obligations.

3. Research ethics committees

Research ethics committees should evaluate:

Scientific necessity.

Informed consent.

Participant vulnerability.

International data-sharing arrangements.

Commercialisation risks.

Genetic re-identification risks.

Future research applications.

4. Data-protection authorities

Regulatory authorities should supervise:

Unlawful international disclosures.

Non-compliance with transfer mechanisms.

Data breaches.

Inadequate contractual protections.

Unauthorised secondary processing.

Failure to provide appropriate remedies.

5. Courts

Courts should examine whether genetic-data transfers comply with applicable constitutional, statutory and contractual requirements.

They may provide remedies such as injunctions, compensation where legally available, judicial review and orders restricting unlawful processing.

10. Model Adequacy Assessment Framework

A practical adequacy assessment can be organised into ten stages.

Cross-border genetic-data transfer assessment

Identify genetic information

Determine whether the dataset contains identifiable genomic information, biological samples or pseudonymised genetic profiles.

Identify the transfer purpose

Establish whether the transfer concerns clinical diagnosis, scientific research, commercial development or another purpose.

Determine applicable laws

Identify the legal requirements of the exporting and receiving jurisdictions.

Establish lawful processing

Identify consent, statutory authority or another applicable lawful basis.

Assess destination-country protection

Examine privacy legislation, surveillance powers, enforcement and individual remedies.

Assess technical safeguards

Examine encryption, pseudonymisation, access controls and cybersecurity.

Control onward transfers

Establish restrictions on further disclosure and secondary use.

Evaluate familial and discrimination risks

Consider genetic re-identification, family privacy and discriminatory applications.

Establish accountability

Allocate responsibility between exporters, recipients, processors and research institutions.

Conduct continuing review

Reassess the arrangement when laws, processing purposes, technology or security conditions change.

11. Emerging Legal Challenges

The adequacy framework is becoming increasingly complicated because of technological developments.

A. Artificial Intelligence and Genomic Data

AI systems can analyse international genomic datasets to predict disease susceptibility, identify genetic relationships and develop personalised medical treatments.

The legal problem is whether the original consent and transfer arrangements cover AI training, model development and subsequent commercial applications.

B. Federated Genomic Research

Federated learning permits research institutions to analyse genomic information without necessarily transferring the underlying datasets to a central foreign repository.

This can reduce direct disclosure risks, but it does not eliminate privacy risks arising from model outputs, inference attacks or information leakage.

C. Synthetic Genomics and Derived Data

Genomic information may be transformed into synthetic datasets or other derived research outputs.

The legal question is whether the derived information remains identifiable or can reveal information about the original participants.

D. International Genomic Cloud Storage

Cloud computing introduces complex questions concerning:

Physical data location.

Remote administrative access.

Subcontractors.

Foreign government access.

Encryption-key control.

Multiple international storage locations.

E. Population Genomics

Large-scale population-genomics projects may expose information about particular communities and populations.

Adequacy assessments should therefore consider group-level privacy, discriminatory use and risks arising from the combination of genomic and demographic datasets.

12. Critical Legal Analysis

Cross-border genetic-data adequacy standards reveal an important tension between scientific cooperation and individual privacy.

On one side, international genetic-data sharing can improve rare-disease diagnosis, accelerate drug development and support the discovery of new medical treatments.

On the other side, inadequate safeguards may expose individuals and their biological relatives to permanent privacy risks.

Three major weaknesses deserve particular attention.

First: The inadequacy of ordinary anonymisation.

Traditional anonymisation methods may not adequately protect genomic information because genetic sequences can be matched against other datasets.

Second: The weakness of purely contractual protection.

A research institution cannot guarantee adequate protection merely by signing a confidentiality agreement if the receiving country's domestic law permits disproportionate access to the information.

Third: The absence of a uniform global adequacy standard.

Different jurisdictions adopt different approaches to consent, research exemptions, data localisation, government access and individual remedies.

Consequently, a transfer may be lawful under one jurisdiction's domestic legislation but fail the exporting jurisdiction's international-transfer requirements.

A more effective regulatory framework should combine enforceable rights, independent supervision, technical safeguards, purpose restrictions, familial privacy protection and continuing institutional accountability.

13. Conclusion

Cross-Border Genetic Data Sharing Adequacy Standards represent an important intersection of international data-protection law, constitutional privacy, biotechnology regulation, research ethics and human-rights jurisprudence.

The GDPR provides the most developed general adequacy mechanism through Articles 45 and 46. India's DPDP Act, 2023, and the DPDP Rules, 2025, establish a different framework based principally on permitted transfers subject to government-imposed restrictions and applicable safeguards.

The judgments in Schrems I, Schrems II, Puttaswamy, S. and Marper, Gaughran, Greenberg and Moore collectively provide important principles for evaluating privacy, international transfers, genetic confidentiality, research consent and commercial exploitation.

The central legal proposition is that the lawful international transfer of genetic information requires more than permission to transmit data: it requires continuing and demonstrable protection against misuse, disproportionate access, re-identification, unauthorised secondary use and inadequate remedies.

14. Important Legal Authorities for Further Research

15. Official and Primary Research Sources

European Commission – Adequacy Decisions.

CJEU – Schrems II, Case C-311/18.

European Data Protection Board – International Transfers.

India Code – DPDP Act, 2023.

Digital Personal Data Protection Rules, 2025.

Supreme Court of India – Puttaswamy Judgment.

S. and Marper v. United Kingdom.

European Court of Human Rights – Gaughran v. United Kingdom.

Research note: There is no single comprehensive international judgment establishing a universal adequacy test specifically for cross-border human genetic datasets. The legal framework must therefore be developed by applying international-transfer jurisprudence together with genetic-privacy, constitutional, biomedical-research and data-protection decisions.