1. Introduction

Cross-Platform Biological Data Interoperability Law is an emerging area of biotechnology, health-information law, data protection, bioethics and digital governance. It concerns the legal rules governing the collection, exchange, integration, transfer, interpretation and reuse of biological and health-related data across different digital platforms, institutions, databases and technological systems.

Biological data may include:

Human genomic and DNA sequencing information.

RNA, protein and biomarker datasets.

Electronic health records (EHRs).

Medical imaging and diagnostic information.

Biometric and physiological measurements.

Clinical-trial and pharmaceutical research datasets.

Embryonic, reproductive and hereditary information.

Microbiome and cellular data.

Biological information generated by wearable devices and AI-powered diagnostic systems.

For example, suppose a hospital in India collects a patient's genomic information, a diagnostic laboratory analyses it, an international research institution processes it using artificial intelligence, and a pharmaceutical company uses the resulting information for drug development.

The legal questions include:

Who has authority to share the biological information?

Is the patient's consent sufficient for every subsequent use?

Who is responsible if two platforms exchange inaccurate or incomplete information?

Can biological data be transferred internationally?

Who bears liability for cybersecurity breaches?

Can a patient demand correction, restriction or deletion?

Who is accountable when an interoperability failure produces an incorrect medical diagnosis?

The central legal principle is that technical interoperability does not automatically create legal permission to exchange or reuse biological data.

2. Legal framework in India

India does not currently have one standalone statute titled the Cross-Platform Biological Data Interoperability Act. Instead, the subject is governed by several overlapping legal frameworks.

A. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 is a central legal framework for digital biological and health information when it qualifies as personal data.

Important provisions include:

Application to biological interoperability

Suppose a genetic-testing company transfers DNA-derived information to a hospital platform. The company must establish a lawful basis for processing, provide the required notice, comply with applicable consent requirements and ensure that the receiving platform uses the data consistently with the legally permitted purpose.

A patient's consent to medical diagnosis should not automatically be interpreted as consent to unrelated commercial genetic profiling.

An important qualification is that the DPDP Act does not create a separate statutory category for genetic or health data equivalent to the GDPR's special-category regime. Nevertheless, such information can be personal data and requires protection under the applicable provisions.

The DPDP Rules, 2025 were notified in November 2025. Their commencement is phased, so the applicable obligations must be assessed according to the particular provision and its commencement date.

India Code+3

B. Ayushman Bharat Digital Mission (ABDM)

The Ayushman Bharat Digital Mission is particularly important because it seeks to facilitate the exchange of health records between different healthcare platforms.

Its architecture involves:

ABHA health identifiers.

Health Information Exchange and Consent Manager (HIE-CM).

Healthcare professional and facility registries.

Electronic health records.

Common health-data exchange standards.

Federated data-sharing architecture.

The ABDM Health Data Management Policy emphasises privacy by design, consent-based sharing and safeguards for digital health information.

Legal significance: Hospitals, laboratories and other participating entities cannot treat technical access to an interoperable network as unlimited authority to use patient information.

The government has also described ABDM's architecture as a federated system in which patient information is not maintained in one centralised repository.

National Portal of India+2

C. Information Technology Act, 2000 and SPDI Rules, 2011

The Information Technology Act and the Sensitive Personal Data or Information Rules, 2011 have historically played an important role in protecting medical records and associated sensitive information.

Relevant provisions include:

Section 43A: Compensation for failure to protect sensitive personal data, subject to its statutory requirements and continuing applicability.

Section 72: Punishment for breach of confidentiality and privacy.

Section 72A: Punishment for disclosure of information in breach of lawful contract.

The SPDI Rules expressly address medical records, medical history and biometric information.

Their present application must be read alongside the DPDP Act's repeal, transition and commencement provisions. They should not be treated as an independent substitute for the newer data-protection framework.

D. Constitutional protection

Article 21 of the Indian Constitution protects life and personal liberty, including the right to privacy.

Articles 14 and 19 may also become relevant where biological information is used in discriminatory decisions, restrictions on liberty or interference with constitutionally protected freedoms.

For example, unauthorised disclosure of a person's hereditary disease information could raise questions involving privacy, dignity, discrimination and informational autonomy.

3. Essential legal principles governing interoperability

3.1 Consent and purpose limitation

Consent must be assessed according to the actual processing activity.

Different activities may require separate legal justification:

Collecting genetic information.

Transferring it between hospitals.

Sharing it with diagnostic laboratories.

Using it for pharmaceutical research.

Sharing it with international research platforms.

Processing it through AI systems.

Consent for one activity does not necessarily authorise all six activities.

3.2 Data accuracy and integrity

Interoperability systems must preserve the accuracy and completeness of information during transmission.

For example, if a laboratory transfers a genetic variant using an incorrect coding format, a receiving hospital may interpret the result incorrectly.

Possible legal consequences include:

Medical negligence.

Breach of contractual obligations.

Failure to comply with data-protection duties.

Consumer liability where applicable.

Institutional negligence.

3.3 Data security and cybersecurity

Every participating platform should maintain appropriate technical and organisational safeguards.

These may include encryption, authentication, access controls, audit logs, secure APIs, identity verification and incident-response procedures.

3.4 Cross-border biological data transfers

International transfers create additional legal issues.

A hospital may share genomic information with a foreign research institution, but the parties must examine applicable Indian transfer restrictions, foreign data-protection laws, research ethics requirements and contractual safeguards.

3.5 Data ownership and control

Biological data raises a distinction between:

Ownership of a physical biological sample.

Rights relating to personal information derived from that sample.

Intellectual property in a research invention.

Rights to access and correct medical records.

Authority to reuse information for secondary research.

These are legally different interests. Ownership of a laboratory database does not automatically give its operator unrestricted rights over the personal information contained in it.

4. Important judicial decisions and case laws

There is no reported Indian Supreme Court judgment that establishes a complete legal doctrine specifically called Cross-Platform Biological Data Interoperability. However, several important judgments establish principles directly relevant to biological information exchange, medical confidentiality, informational privacy and unauthorised disclosure.

Case 1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Landmark Indian Supreme Court judgment

Citation: (2017) 10 SCC 1; AIR 2017 SC 4161.

Court: Supreme Court of India, nine-judge Constitution Bench.

Facts and legal question:

The case concerned whether the Indian Constitution protects an individual's right to privacy, including privacy in relation to personal information in an increasingly digital society.

Judgment:

The Supreme Court unanimously recognised privacy as a fundamental right protected under Article 21 and other freedoms under Part III of the Constitution.

Justice D.Y. Chandrachud's judgment specifically recognised informational privacy and the threats created by digital information systems and non-state actors.

The Court identified three requirements for justifying an invasion of privacy:

Legality – the existence of a valid law.

Legitimate aim – a legally permissible objective.

Proportionality – a rational and proportionate relationship between the objective and the means adopted.

Application to biological interoperability:

If a hospital transfers a patient's genomic information to another platform without proper legal authority, the transfer may raise constitutional privacy concerns.

Similarly, an AI research company cannot assume that access to biological data automatically gives it unlimited authority to use that data.

Legal principle: Informational privacy must be respected even when personal information is processed through interconnected digital systems.

Indian Kanoon+1

Case 2. Mr. X v. Hospital Z (1998)

Citation: (1998) 8 SCC 296; AIR 1999 SC 495.

Court: Supreme Court of India.

Facts:

The dispute concerned disclosure of a patient's HIV-positive status and the conflict between medical confidentiality and the interests of another person potentially affected by the information.

Judgment:

The Supreme Court considered the competing interests of individual confidentiality and the protection of another person's health and safety.

The judgment recognised that medical confidentiality is important but is not absolute in every circumstance.

Application to biological interoperability:

A healthcare platform may receive highly confidential genetic or infectious-disease information. Disclosure to another institution must be supported by an appropriate legal justification.

For instance, a laboratory cannot casually circulate a patient's HIV, hereditary disease or infectious-disease information among unrelated platforms.

However, a legally justified disclosure may be possible in circumstances involving a sufficiently important competing interest.

Legal principle: Medical confidentiality is a significant legal obligation, but it must be balanced against legally recognised competing interests.

Indian Kanoon

Case 3. District Registrar and Collector v. Canara Bank (2005)

Citation: (2005) 1 SCC 496.

Court: Supreme Court of India.

Facts:

The dispute concerned the inspection of private documents maintained by a bank and the extent to which individuals could expect confidentiality in information entrusted to another institution.

Judgment:

The Supreme Court examined privacy and confidentiality in relation to documents held by third parties.

Application to biological interoperability:

The case is relevant to the argument that sharing personal information with an institution does not automatically eliminate the individual's privacy interests.

For example, when a patient submits genetic information to a laboratory, the laboratory's possession of the data does not mean that the patient's privacy interests disappear.

A receiving platform must also consider the confidentiality obligations associated with the information.

Legal principle: Entrusting private information to an intermediary does not, by itself, eliminate all privacy protections.

Indian Kanoon

Case 4. K.S. Puttaswamy v. Union of India (Aadhaar judgment, 2018)

Citation: (2019) 1 SCC 1.

Court: Supreme Court of India, Constitution Bench.

Legal significance:

The Supreme Court examined the constitutional validity of the Aadhaar framework, including questions concerning biometric information, informational privacy, proportionality and data protection.

Application to biological interoperability:

The judgment is relevant when biological information is connected to identity-management systems, biometric authentication platforms and large-scale digital databases.

It provides constitutional guidance for assessing whether the collection and use of biometric information are necessary and proportionate.

Legal principle: Large-scale digital identity and biometric systems must satisfy constitutional requirements governing privacy and permissible state action.

Case 5. Sharda v. Dharmpal (2003)

Citation: (2003) 4 SCC 493.

Court: Supreme Court of India.

Legal issue:

The case considered the circumstances in which a court could direct a medical examination in matrimonial proceedings.

Application to biological interoperability:

The judgment is relevant to the relationship between medical examination, bodily privacy, evidentiary requirements and judicial authority.

It demonstrates that medical information and bodily examination raise competing legal interests that must be evaluated within the applicable legal framework.

It does not, however, authorise unrestricted digital sharing of medical or genetic information.

Case 6. Sorrell v. IMS Health Inc. (2011)

Citation: 564 U.S. 552 (2011).

Court: Supreme Court of the United States.

Facts:

The case concerned Vermont legislation restricting the sale, disclosure and use of prescriber-identifying information for pharmaceutical marketing.

Judgment:

The US Supreme Court invalidated the restrictions under the First Amendment because of the way the legislation regulated speech and speaker-based distinctions.

Application to biological interoperability:

The case is relevant to the commercial use and transfer of health-related information between data platforms, particularly where pharmaceutical companies obtain information for commercial analysis.

It illustrates that information-sharing disputes can involve privacy, commercial interests and constitutional freedoms simultaneously.

Important limitation: This was not a ruling establishing patients' ownership of medical records or unrestricted rights to exchange genetic information.

5. Comparative international legal framework

A. European Union – General Data Protection Regulation (GDPR)

The General Data Protection Regulation provides particularly important protection for genetic, biometric and health information.

Article 9 specifically covers genetic data, biometric data used for unique identification and health information.

Therefore, cross-platform transfers of genomic information must satisfy both an Article 6 lawful basis and an applicable Article 9 condition.

Article 20 is particularly relevant to interoperability because it provides a right to receive certain personal data in a structured, commonly used and machine-readable format and, in specified circumstances, transmit it to another controller.

Legislation.gov.uk+1

B. European Health Data Space Regulation, 2025

The European Health Data Space Regulation (Regulation (EU) 2025/327) establishes a framework for the primary and secondary use of electronic health data.

It is particularly significant because its scope includes:

Electronic health records.

Human genetic and genomic data.

Epigenomic data.

Proteomic and transcriptomic information.

Clinical-trial datasets.

Medical-device-generated health data.

Biobank information.

Its relevance extends beyond ordinary medical records to biological research datasets and molecular information.

It demonstrates how legal systems can combine interoperability standards with access controls, governance requirements and restrictions on secondary use.

EUR-Lex

C. United States – HIPAA and information blocking

The US framework combines:

Health Insurance Portability and Accountability Act (HIPAA).

HIPAA Privacy Rule.

HIPAA Security Rule.

21st Century Cures Act.

Information-blocking regulations.

Under 42 U.S.C. § 300jj-52, information blocking includes certain practices likely to interfere with, prevent or materially discourage access, exchange or use of electronic health information.

This is important because interoperability law must protect privacy without permitting unjustified institutional obstruction of legitimate information exchange.

U.S. Code

6. Legal liability for interoperability failures

One of the most important aspects of this emerging field is determining which institution becomes legally responsible when biological information is incorrectly transferred, interpreted or processed.

6.1 Hospital liability

A hospital may be liable where it:

Transfers medical records to an unauthorised platform.

Fails to maintain appropriate security safeguards.

Sends incorrect patient-identification information.

Fails to verify critical information received from another institution.

Uses biological data beyond its legally authorised purpose.

6.2 Laboratory liability

A laboratory may face liability if it transmits inaccurate genetic results, uses incompatible data formats without adequate validation, or fails to communicate material limitations in its findings.

6.3 Software-platform liability

A digital health platform may face liability where defective software, inadequate authentication or improper data mapping causes unauthorised disclosure or material corruption of patient information.

6.4 AI developer liability

An AI developer may face liability where an algorithm incorrectly interprets transferred biological data and the resulting error causes legally recognisable harm.

Liability depends on the developer's role, applicable statutory duties, contractual arrangements, foreseeability, causation and the conduct of healthcare professionals.

7. Cross-platform interoperability and biotechnology research

Uniwersytet Medyczny w Białymstoku. O Centrum.

EMR, EHR & HIE: Interoperability in 2026 | Medium

So, what’s a biobank actually for? - Eurac Research

10

Interoperability is especially important in advanced biotechnology because biological information is generated by multiple scientific and technological systems.

Example 1: Genomic interoperability

A hospital uses one sequencing platform, while another laboratory uses a different genomic database.

The systems must preserve:

Gene identifiers.

Variant classifications.

Reference genome versions.

Sequencing quality information.

Clinical interpretation.

Patient identity and consent information.

A technical mismatch may produce incorrect scientific conclusions and subsequent legal disputes.

Example 2: Biobank interoperability

A university biobank shares biological datasets with a pharmaceutical research organisation.

The legal questions include:

Whether the original consent permits secondary research.

Whether the data is sufficiently de-identified.

Whether commercial use is authorised.

Whether international transfer requirements are satisfied.

Whether research ethics approval is necessary.

Example 3: AI-based healthcare interoperability

An AI diagnostic platform combines:

Genomic information.

Electronic health records.

Blood-test results.

Wearable-device measurements.

Medical imaging.

If the system combines information belonging to different patients or uses incorrect biological identifiers, the consequences may include incorrect diagnoses and serious medical harm.

8. Major legal challenges

The following issues remain particularly important for future legislation and judicial interpretation.

9. Proposed regulatory model for India

India could strengthen biological-data interoperability governance through the following measures.

1. Uniform biological-data standards

Establish interoperable technical standards for genomic, proteomic, clinical and other biological information.

2. Consent portability

Create a mechanism through which individuals can review, manage and withdraw applicable permissions across participating platforms.

3. Data provenance

Every biological-data transfer should record its source, date, purpose, modifications and receiving institution.

4. Genetic-data safeguards

Introduce stronger safeguards against unauthorised commercial exploitation and discriminatory use of identifiable genetic information.

5. Interoperability audits

Require periodic technical and legal audits of participating laboratories, hospitals and research platforms.

6. Cross-border transfer governance

Require clear allocation of responsibilities between Indian institutions and international data recipients.

7. AI accountability

Require traceability of biological information used in automated medical decisions, together with appropriate human oversight.

8. Patient remedies

Provide accessible mechanisms for correction, grievance redressal, investigation and compensation where legally justified.

10. Important distinctions between related legal doctrines

11. Conclusion

Cross-Platform Biological Data Interoperability Law is an important emerging area of biotechnology governance. It addresses the legal consequences of connecting hospitals, diagnostic laboratories, genomic databases, biobanks, pharmaceutical companies and AI-powered healthcare systems.

Its development requires balancing five fundamental interests:

Scientific research and technological innovation.

Individual privacy and informational autonomy.

Accurate and reliable biological information.

Secure and lawful data exchange.

Institutional accountability and effective remedies.

In India, the constitutional principles established in Justice K.S. Puttaswamy, the DPDP Act, 2023, the applicable DPDP Rules, 2025, and the ABDM framework provide important foundations.

The central proposition is that interoperability should facilitate lawful access to biological information without eliminating individual privacy, confidentiality, scientific integrity or institutional accountability.

12. Suggested research questions for advanced biotechnology law

For doctoral research, legal dissertations and specialised biotechnology-law studies, the following questions are particularly significant:

Can genomic information be transferred across platforms without renewed consent?

Should biological data have a separate statutory classification under Indian data-protection law?

Who bears liability for biological-data corruption during interoperability?

Can a patient's genetic information be legally separated from familial genetic interests?

Should pharmaceutical companies have access to interoperable genomic databases?

Can AI-generated biological interpretations be legally treated as medical evidence?

Should India introduce a dedicated Biological Data Interoperability Regulatory Authority?

How should courts determine causation when multiple platforms contribute to a biological-data error?

Research note: The judgments discussed above establish related legal principles; they do not directly decide a standalone cause of action called Cross-Platform Biological Data Interoperability. The proposed regulatory doctrines are analytical recommendations, not existing statutory provisions.

Primary legal and research sources

Digital Personal Data Protection Act, 2023 – India Code

Digital Personal Data Protection Rules, 2025 – MeitY

ABDM Health Data Management Policy

K.S. Puttaswamy (2017) – Supreme Court judgment

Mr. X v. Hospital Z (1998)

GDPR – Article 9 and data protection framework

European Health Data Space Regulation, 2025