1. Introduction

Data portability between genomic service providers refers to the right or ability of an individual to obtain, retrieve, transfer and reuse their genetic and genomic information from one service provider to another without unnecessary legal, technical or contractual barriers.

With the development of genetic testing, whole-genome sequencing, DNA profiling, ancestry testing, precision medicine and personalised healthcare, genomic data has become an important category of personal information.

For example, an individual may:

Obtain a DNA test from one private genomic testing company.

Wish to transfer the raw genomic data to another laboratory for a second opinion.

Seek to transfer genetic information to a hospital for personalised treatment.

Change genomic service providers while retaining access to previously generated test results.

Obtain genomic data for independent scientific interpretation or research, subject to applicable consent and privacy requirements.

The legal question is whether an individual has a legally enforceable right to demand that one genomic service provider provide their data in a usable format or transmit it directly to another provider.

The central legal distinction is between the right to access personal data, the right to receive a copy of personal data, and the right to have personal data transmitted from one service provider to another. These rights are related, but they are not identical.

This discussion focuses primarily on Indian law, with comparative reference to the European Union's General Data Protection Regulation (GDPR), because the GDPR expressly recognises data portability.

2. Meaning and nature of genomic data

2.1 What constitutes genomic data?

Genomic data is information obtained through the examination, sequencing or analysis of an individual's DNA or genetic material.

It may include:

Raw genomic data: Original DNA sequencing information, such as FASTQ, BAM, CRAM or VCF files.

Processed genomic data: Data produced after filtering, sequencing and bioinformatics analysis.

Genetic test reports: Reports identifying genetic variations, mutations or inherited conditions.

Health-related genetic information: Information about hereditary diseases, susceptibility to particular conditions and possible treatment responses.

Family-related genetic information: Information that may reveal biological relationships, ancestry and genetic characteristics of relatives.

Genomic data is particularly sensitive because it may reveal information not only about the individual but also about biological relatives who have not themselves consented to the testing.

2.2 Why is data portability important in genomic services?

Data portability serves several important purposes:

Patient autonomy: Individuals retain greater control over their genetic information.

Continuity of healthcare: Patients can change hospitals or laboratories without unnecessarily repeating genetic tests.

Second medical opinions: Individuals can obtain independent interpretations of their genomic results.

Scientific advancement: Researchers may access properly authorised genomic information for legitimate research.

Competition: Individuals are not unnecessarily locked into one commercial genomic service provider.

Transparency: Individuals can understand what information has been collected, processed and retained.

2.3 Difference between data access and data portability

A genomic testing company may provide an individual with a PDF report but refuse to provide the underlying sequencing files in a reusable format. This may satisfy a limited request for a report, but it does not necessarily satisfy a legal right to portability where such a right applies.

3. Legal framework governing genomic data portability in India

India does not presently provide an express, general statutory right equivalent to Article 20 of the GDPR. Nevertheless, individuals have important privacy, access-related and data-protection interests that may support requests for obtaining and transferring genomic information.

The principal legal provisions are discussed below.

3.1 Constitutional protection under Article 21

Article 21 of the Constitution of India guarantees the right to life and personal liberty.

The Supreme Court has interpreted Article 21 to include the right to privacy, personal autonomy and informational privacy.

Genomic information falls within the broader concept of informational privacy because it contains deeply personal information concerning an individual's biological identity and hereditary characteristics.

Accordingly, a genomic service provider should not treat an individual's genetic information as unrestricted commercial property merely because the provider collected or analysed it.

However, the constitutional right to privacy does not automatically create an unrestricted right to compel private laboratories to transmit every category of genomic information to another company.

The constitutional framework provides an important foundation for protecting individuals against unjustified collection, disclosure, retention and misuse of genetic information.

3.2 Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's principal general legislation governing digital personal data.

It is particularly relevant to genomic service providers that collect, store, analyse or otherwise process digitally recorded genetic information.

Important qualification regarding the current legal position (4 November 2026): The DPDP Act has a phased commencement. The notification dated 13 November 2025 brought certain provisions into force immediately, while most substantive processing and individual-rights provisions are scheduled to commence 18 months after publication, on 13 May 2027. Therefore, the full statutory rights framework is not yet operative on the date of this discussion.

India Code

+2

A. Section 3 – Application of the Act

Section 3 establishes the scope of application of the DPDP Act.

It covers digital personal data processed within India and certain processing outside India connected with offering goods or services to individuals in India.

Genomic testing companies processing identifiable digital DNA information may fall within its scope.

B. Section 4 – Grounds for processing personal data

Section 4 provides the legal framework for processing personal data based on consent or certain legitimate uses recognised by the legislation.

A genomic service provider must identify a lawful basis for processing the individual's genetic information.

C. Section 5 – Notice

The data fiduciary must provide the required notice explaining the personal data collected and the purpose of processing.

For genomic service providers, this should explain:

The nature of genetic information collected.

The purpose of sequencing and analysis.

Whether information is shared with third-party laboratories.

Whether information is used for research or commercial purposes.

Whether data is transferred to overseas entities.

D. Section 6 – Consent

Consent must satisfy the statutory requirements of being free, specific, informed, unconditional and unambiguous, with a clear affirmative action.

For genomic services, consent should distinguish, where applicable, between:

Clinical testing.

Secondary genetic analysis.

Research participation.

Commercial use.

Disclosure to other service providers.

A patient's consent to genetic testing should not automatically be interpreted as unrestricted permission for every subsequent commercial use of their genomic data.

E. Section 11 – Right to access information

Section 11 provides a right to obtain information about personal data being processed, including a summary of the personal data and processing activities, subject to the statutory conditions.

This may support an individual's request to understand what genomic information a laboratory holds and how it processes that information.

F. Section 12 – Right to correction and erasure

This section provides rights relating to correction, completion, updating and erasure of personal data, subject to applicable legal requirements.

For example, an individual may seek correction of an incorrectly associated genetic report or request erasure where the statutory conditions are satisfied.

G. Section 13 – Right of grievance redressal

An individual may raise grievances concerning the processing of personal data and seek redress through the prescribed mechanism.

H. Section 14 – Right to nominate

An individual may nominate another person to exercise specified rights in the event of death or incapacity, in accordance with the Act.

A significant limitation: Section 11 does not create a general right to direct transmission of genomic data from one service provider to another. The DPDP Act does not reproduce the GDPR's express Article 20 data-portability right.

Thus, under the Indian statutory framework, access to genomic data and direct provider-to-provider portability must be treated as separate legal questions.

India Code

+1

3.3 Information Technology Act, 2000 and SPDI Rules, 2011

Until the relevant repeal provision of the DPDP Act takes effect, the Information Technology Act and the applicable SPDI framework remain important to the analysis.

A. Section 43A of the IT Act

Section 43A deals with compensation for failure to protect sensitive personal data or information.

Where a body corporate possesses, deals with or handles sensitive personal information and is negligent in implementing reasonable security practices, causing wrongful loss or wrongful gain, it may be liable to pay compensation.

This is relevant to genomic companies because unauthorised disclosure, insecure transfer or improper handling of genetic information may result in serious harm.

However, Section 43A is not itself a data-portability provision.

B. Rule 3 of the SPDI Rules, 2011

Rule 3 identifies categories of sensitive personal data or information, including:

Physical, physiological and mental health conditions.

Medical records and history.

Biometric information.

Other specified sensitive information.

Rule 2 expressly refers to DNA in its definition of biometrics when used for authentication purposes.

Therefore, DNA information used for authentication falls within that definition. Other medical or genetic information may also fall within the SPDI framework depending on its nature and context.

C. Rule 5 – Collection of information

Rule 5 requires consent for the collection of sensitive personal information and establishes requirements concerning the purpose and collection of such information.

For genomic service providers, the collection of DNA information should be transparent and connected with a lawful and disclosed purpose.

D. Rule 6 – Disclosure of information

Rule 6 regulates disclosure of sensitive personal information to third parties.

Generally, prior permission of the provider of the information is required, subject to the exceptions prescribed in the Rules.

This is relevant where an individual wishes to transfer genomic information from one laboratory to another.

E. Rule 7 – Transfer of information

Rule 7 regulates the transfer of sensitive personal information, including transfers to other bodies corporate or persons.

Such transfers are subject to the prescribed conditions, including the recipient providing the same level of data protection as required under the Rules and the transfer being necessary for the performance of a lawful contract or otherwise consented to by the provider of the information.

Legal significance: These provisions regulate the circumstances in which information may be transferred. They do not establish a comprehensive individual right to compel a genomic company to transfer data to a competitor.

IndiaCode

+2

3.4 Indian Evidence Act and Bharatiya Sakshya Adhiniyam, 2023

Genomic information may also be relevant in legal proceedings, particularly in disputes involving:

Paternity and legitimacy.

Inheritance and succession.

Criminal investigations.

Identification of missing persons.

Medical negligence.

Establishment of biological relationships.

The Bharatiya Sakshya Adhiniyam, 2023, governs the admissibility and evidentiary treatment of electronic and other evidence in proceedings to which it applies.

However, admissibility of a genomic report is different from the individual's right to obtain or transfer the report.

A genomic service provider may also have to consider the preservation of records where a court order, investigation or other legal obligation requires retention.

4. Important Indian case laws

There is an important distinction to maintain while examining judicial precedents: Indian courts have recognised privacy and autonomy interests in genetic information, but the Supreme Court has not established a general Article 20-style right to genomic data portability.

The following decisions provide the relevant legal principles.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

SUPREME COURT OF INDIA · NINE-JUDGE CONSTITUTION BENCH

Citation: (2017) 10 SCC 1; AIR 2017 SC 4161.

Facts:

The case arose from constitutional challenges concerning the Aadhaar scheme and the collection and use of personal and biometric information by the State.

The Supreme Court was required to determine whether the Constitution recognises a fundamental right to privacy.

Legal issues:

Whether privacy is a fundamental right under the Indian Constitution.

Whether informational privacy is protected under Article 21.

Whether the collection and use of personal information require adequate legal safeguards.

Judgment:

The nine-judge Constitution Bench unanimously recognised privacy as a constitutionally protected fundamental right.

The Court recognised that privacy includes informational privacy and individual autonomy.

It also established that an invasion of privacy must satisfy three requirements:

Legality: There must be a valid legal basis.

Legitimate aim: The interference must pursue a legitimate objective.

Proportionality: The means adopted must be proportionate to the objective.

Relevance to genomic data portability:

This judgment is particularly important because genetic information is among the most intimate categories of personal information.

Applying the principles in Puttaswamy, an individual has a constitutionally protected interest in controlling access to and use of their genomic information.

A genomic service provider should therefore have a lawful justification for collecting, retaining, sharing or disclosing such information.

However, the judgment does not expressly recognise a right to data portability or impose a general obligation on private genomic laboratories to provide direct provider-to-provider transmission.

Legal principle: Informational privacy and personal autonomy are fundamental rights under Article 21.

Indian Kanoon

+2

Case 2: Selvi v. State of Karnataka (2010)

SUPREME COURT OF INDIA

Citation: (2010) 7 SCC 263.

Facts:

The case concerned the constitutional validity of involuntary administration of scientific investigative techniques, including:

Narcoanalysis.

Polygraph examination.

Brain Electrical Activation Profile (BEAP) tests.

The Court considered whether compelling individuals to undergo such procedures violated their constitutional rights.

Legal issues:

Whether involuntary scientific investigative techniques violate Article 20(3).

Whether compulsory testing violates personal liberty under Article 21.

Whether bodily autonomy and mental privacy are constitutionally protected.

Judgment:

The Supreme Court held that involuntary administration of the impugned techniques violates the protection against self-incrimination under Article 20(3) and personal liberty under Article 21.

The judgment emphasised the importance of individual autonomy and protection against involuntary intrusion.

Relevance to genomic data portability:

Although Selvi did not concern commercial genomic service providers or data transfer, its reasoning is relevant to the protection of biological and personal autonomy.

It supports the proposition that scientific advancement cannot automatically override an individual's constitutional rights.

For genomic service providers, this is important when obtaining biological samples, conducting additional testing or using genetic information for purposes beyond the original agreement.

Legal principle: Scientific and investigative procedures must respect constitutional protections of personal liberty and autonomy.

Case 3: R. Rajendran v. Kamar Nisha & Others (2025)

SUPREME COURT OF INDIA · RECENT DNA-PRIVACY PRECEDENT

Citation: Criminal Appeal No. 1013 of 2021, 2025 INSC 1304, judgment dated 10 November 2025.

Facts:

The dispute involved a claim concerning the biological paternity of a child.

A direction had been issued requiring the parties to undergo DNA profiling in connection with criminal allegations.

The appellant challenged the direction, arguing that compulsory DNA testing would violate privacy and personal liberty.

Legal issue:

Whether a court could direct DNA testing when the existing evidence did not establish a sufficient necessity for such an intrusive procedure.

Judgment:

The Supreme Court set aside the direction for DNA testing.

It held that compulsory DNA testing constitutes a serious intrusion into privacy and personal liberty.

The Court applied the principles of legality, legitimate State aim and proportionality established in Puttaswamy.

It also emphasised that the privacy rights of all persons affected by DNA testing must be considered, including children.

Relevance to genomic data portability:

This is a particularly significant recent decision for the genomic-data sector.

The Court recognised the sensitive nature of genetic information and the potential consequences of its collection and examination.

The judgment supports the following propositions:

Genetic information deserves strong privacy protection.

DNA testing must have a legally justified purpose.

The interests of persons other than the immediate applicant must be considered.

Scientific convenience cannot independently justify intrusive processing of genetic information.

The judgment does not directly decide data portability, but its reasoning strengthens the privacy-based argument for responsible access, disclosure and transfer of genomic information.

Sci API

+2

Case 4: K.S. Puttaswamy (Aadhaar) v. Union of India (2018)

SUPREME COURT OF INDIA · AADHAAR CONSTITUTIONAL CHALLENGE

Citation: (2019) 1 SCC 1.

Facts:

The case concerned the constitutional validity of the Aadhaar framework, including the collection, storage and use of biometric and identity-related information.

The petitioners challenged aspects of the scheme on privacy and data-protection grounds.

Judgment:

The Supreme Court examined the relationship between privacy, informational autonomy, consent and statutory safeguards.

The Court recognised the importance of legal authority and safeguards when personal information is collected and processed.

Relevance to genomic data portability:

The judgment is useful in understanding the risks associated with centralised databases containing sensitive personal information.

By analogy, genomic service providers should adopt safeguards relating to:

Collection and storage of genetic information.

Access controls.

Disclosure to third parties.

Purpose limitation.

Protection against unauthorised access and misuse.

The judgment does not establish a direct portability right, but it provides constitutional support for protecting individuals against inappropriate use of their biological information.

Sci API

+1

Case 5: Goutam Kundu v. State of West Bengal (1993)

SUPREME COURT OF INDIA

Citation: (1993) 3 SCC 418.

Facts:

The case involved a matrimonial dispute in which one party sought a blood-group examination to establish the paternity of a child.

Judgment:

The Supreme Court laid down important principles governing the circumstances in which courts may direct blood tests in paternity disputes.

It cautioned against ordering such tests routinely and emphasised the need for sufficient grounds.

Relevance to genomic data portability:

The decision is relevant because it recognises that biological information cannot be subjected to intrusive examination merely because one party desires it.

In the context of genomic services, it supports the importance of lawful purpose, individual interests and safeguards before genetic information is collected or examined.

It is not a data-portability case.

Case 6: Bhabani Prasad Jena v. Convenor Secretary, Orissa State Commission for Women (2010)

SUPREME COURT OF INDIA

Citation: (2010) 8 SCC 633.

Facts:

The case involved a dispute concerning paternity and a request for DNA testing.

Judgment:

The Supreme Court held that DNA testing should not be ordered mechanically.

Courts must consider whether there is an eminent need for such testing and balance the interests of the parties.

Relevance to genomic data portability:

The judgment reinforces the principle that genetic testing involves privacy interests and must be justified by the circumstances.

It is relevant when considering whether a genomic service provider can undertake additional testing or disclose genetic information without adequate legal justification.

Case 7: Aparna Ajinkya Firodia v. Ajinkya Arun Firodia (2023)

SUPREME COURT OF INDIA

Citation: 2023 INSC 146; (2023) 4 SCR 680.

Facts:

The case concerned a matrimonial dispute involving a request for DNA testing of a child to establish biological paternity.

Judgment:

The Supreme Court emphasised that DNA testing cannot be ordered as a matter of routine.

The Court considered the privacy and dignity of the child and the potential consequences of genetic testing.

Relevance to genomic data portability:

The case demonstrates that genetic information can affect individuals other than the person directly requesting the test.

Therefore, when genomic information is transferred between service providers, particular care should be taken where the information may reveal family relationships or genetic characteristics of third parties.

Sci API

+1

5. Comparative legal position: European Union GDPR

The European Union provides a more developed legal framework for data portability than India.

The General Data Protection Regulation (GDPR) expressly recognises the right to data portability under Article 20.

5.1 Article 20 – Right to data portability

Article 20(1) provides that a data subject has the right to:

Receive personal data concerning them which they have provided to a controller.

Receive the information in a structured, commonly used and machine-readable format.

Transmit the information to another controller without hindrance from the original controller.

Article 20(2) further recognises the right to have personal data transmitted directly from one controller to another, where technically feasible.

EUR-Lex

+1

5.2 Application of Article 20 to genomic data

Genetic data receives special protection under Article 9 of the GDPR, which identifies genetic data as a special category of personal data.

The processing of genetic information is generally prohibited unless an applicable exception under Article 9(2) is satisfied.

Article 20 can apply to genomic data where its requirements are met.

For example:

A patient undergoes whole-genome sequencing through Laboratory A. The patient subsequently wishes to obtain the raw genomic files and transfer them to Laboratory B.

If the processing is based on consent or contract, is carried out by automated means and the information falls within the scope of Article 20, the patient may exercise the portability right.

The original provider cannot refuse merely because it prefers that the patient continue using its services.

5.3 Conditions for exercising the right

An important distinction is that data inferred or derived by a provider may not automatically qualify as data provided by the individual.

For instance, raw sequencing information and observed genomic measurements may qualify, whereas a proprietary risk score or a provider's independently generated analytical conclusion may require a separate assessment.

5.4 Important GDPR case law

Case 1: Österreichische Datenschutzbehörde v. CRIF GmbH (2023)

Citation: Case C-487/21, Court of Justice of the European Union, judgment dated 4 May 2023.

The case concerned the meaning of the right to obtain a copy of personal data under Article 15(3) GDPR.

The Court held that the right to a copy requires a faithful and intelligible reproduction of the personal data undergoing processing.

Relevance to genomic services:

A genomic service provider should not assume that a brief summary is always sufficient to satisfy an individual's right to access a copy of personal data.

Depending on the circumstances, a sufficiently complete reproduction of the personal data may be necessary.

This is particularly relevant where the individual requests underlying genetic information rather than merely a summary report.

However, this is an access-right judgment under Article 15, not a direct Article 20 portability judgment.

Case 2: Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (2020)

Citation: Case C-311/18, judgment dated 16 July 2020.

The case concerned international transfers of personal data from the European Union to the United States.

The Court examined the protection required when personal data is transferred internationally.

Relevance to genomic services:

Where genomic data is transferred between laboratories in different countries, the applicable international data-transfer safeguards must be considered.

The sensitivity of genomic data makes the protection of transferred information particularly important.

The case does not concern the Article 20 right directly.

EUR-Lex

+1

6. Rights of individuals when transferring genomic data

The rights of individuals in relation to genomic service providers can be understood through the following categories.

6.1 Right to obtain genomic information

An individual should be able to request information about the genetic data maintained by a service provider.

This may include:

Raw DNA sequencing files.

Genetic test results.

Reports generated from genetic analysis.

Information concerning the processing of genomic data.

Information concerning third-party disclosures, to the extent provided by applicable law.

In India, the legal basis must be assessed under the applicable IT/SPDI framework and, once operative, the DPDP Act.

6.2 Right to transfer genomic information

An individual may request that their genomic information be provided to another laboratory or healthcare institution.

For example, a patient may request Laboratory A to provide sequencing files to Laboratory B.

Under Indian law, this request may be supported by consent, contractual terms, applicable disclosure and transfer provisions, and privacy principles.

However, there is no presently operative general statutory right equivalent to GDPR Article 20 that automatically compels direct transfer.

6.3 Right to data security

Genomic service providers must take appropriate steps to protect genetic information against:

Unauthorised access.

Accidental disclosure.

Data theft.

Unauthorised alteration.

Improper commercial exploitation.

The applicable statutory security obligations are particularly important during the transfer process.

6.4 Right to control secondary use

Genomic information collected for medical diagnosis should not automatically be treated as freely available for unrelated commercial research.

The provider must consider the applicable legal basis, consent requirements and research-related safeguards.

6.5 Right to correction

Where a genetic report contains incorrect personal identifiers or information, an individual may seek correction under applicable law.

For example, a laboratory may incorrectly associate a genomic report with another patient's identity. Such an error must be addressed through appropriate correction procedures.

6.6 Right to erasure

An individual may seek deletion of personal genomic information where the applicable statutory conditions are satisfied.

However, deletion may be restricted by legal obligations, legitimate retention requirements or other applicable laws.

Furthermore, deleting a digital genomic file is not necessarily the same as destroying the physical biological sample from which it was generated.

7. Obligations of genomic service providers

Data portability also requires an understanding of the responsibilities of the original service provider.

A genomic service provider should consider the following obligations:

7.1 Can a genomic provider refuse data portability?

A provider may have legitimate grounds to restrict or refuse a particular transfer.

Examples include:

The request is made by a person who has not established authority to access the individual's information.

The proposed disclosure would unlawfully reveal another person's personal information.

The requested transfer would violate a binding court order or statutory restriction.

The provider is required to preserve records for legal or regulatory purposes.

The request involves proprietary analytical material that is not covered by the applicable access or portability right.

However, a provider should not automatically refuse an otherwise lawful request merely because the individual wants to use a competing service.

The distinction between personal genomic information and the provider's proprietary intellectual property is particularly important.

8. Technical and ethical challenges in genomic data portability

8.1 Lack of standardisation

Different genomic service providers may use different sequencing technologies, file formats and analytical systems.

For example:

FASTQ files contain sequencing reads.

BAM and CRAM files contain aligned sequencing information.

VCF files contain genetic variants.

A receiving laboratory may not be able to interpret every file without additional information concerning sequencing methods, reference genomes and quality-control procedures.

8.2 Privacy of family members

Genetic information may reveal hereditary characteristics shared by biological relatives.

Consequently, transferring an individual's genomic data may indirectly reveal information about other family members.

This raises questions concerning third-party privacy and confidentiality.

8.3 Commercial confidentiality

Genomic service providers may develop proprietary algorithms for interpreting genetic variations.

The individual may have rights over their personal genomic information without necessarily acquiring ownership of the provider's software, algorithms or proprietary analytical methods.

8.4 International transfers

A genomic provider may transfer data to laboratories outside India.

Such transfers raise additional concerns concerning:

Applicable data-protection laws.

International data-transfer restrictions.

Security standards.

Government access to genetic databases.

Cross-border enforcement.

The DPDP Rules, 2025 address overseas transfers through Rule 15, subject to restrictions imposed by the Central Government.

IndiaCode

+1

9. Comparison between Indian law and GDPR

Overall observation: The GDPR offers a more explicit statutory mechanism for data portability. Indian law provides significant protection for personal information but does not currently establish the same general right to direct transmission between genomic service providers.

10. Practical example: Transfer of genomic data between two laboratories

Consider the following hypothetical situation.

Example: Patient transfers genomic data

Laboratory A

Original genomic service provider

Stores sequencing files and genetic test reports

Patient requests data transfer

Laboratory B

New genomic service provider

Receives data for independent genetic analysis

Legal considerations

Is the patient authorised to request the information?

Does the applicable law permit disclosure?

Is consent required?

Does the transfer involve third-party information?

Are adequate security measures in place?

Are any retention or legal restrictions applicable?

Legal outcome in India

The patient can make a request for access to their genomic information and seek its disclosure to Laboratory B.

The provider must assess the request under the applicable privacy, contractual and data-protection framework.

However, the patient cannot simply rely on Section 20 of the GDPR as a source of an enforceable portability right in India.

Legal outcome in the European Union

Where Article 20 GDPR applies, the individual can require the original provider to supply qualifying personal data in a structured, commonly used and machine-readable format.

The individual can also request direct transmission to the new provider, where technically feasible.

11. Suggestions for strengthening genomic data portability rights in India

India's legal framework could be strengthened through the following measures.

1. Express statutory recognition of genomic data portability

A specific right should be introduced allowing individuals to obtain their genomic data and transfer it between authorised service providers.

2. Standardisation of genomic formats

Common technical standards should be developed to facilitate interoperability between laboratories.

3. Specific rules for genetic information

Genomic data should receive appropriate safeguards recognising its hereditary, predictive and familial implications.

4. Transparent consent mechanisms

Consent should distinguish between clinical testing, research, commercial use and transfer to another provider.

5. Protection of family members

Rules should address the privacy interests of biological relatives whose information may be indirectly revealed through genomic data.

6. Secure transfer infrastructure

Providers should adopt encryption, access controls, identity verification and secure transfer protocols.

7. Clear retention and deletion policies

Individuals should be informed about the retention of genomic files, biological samples and derivative information.

12. Conclusion

Data portability between genomic service providers is an important aspect of informational privacy, individual autonomy and patient empowerment.

The increasing use of genomic testing makes it necessary to recognise that genetic information is not merely ordinary personal data. It may reveal hereditary conditions, biological relationships, disease susceptibility and other intimate characteristics.

In India, the constitutional foundation for protecting genomic information is provided by Article 21 and the Supreme Court's decision in Justice K.S. Puttaswamy v. Union of India (2017).

The IT Act, 2000 and SPDI Rules, 2011 provide an additional framework for protecting sensitive information and regulating its disclosure and transfer. The DPDP Act, 2023 introduces further individual rights, including access, correction and erasure, but does not expressly recognise the GDPR-style general right to data portability. Its substantive rights provisions are also subject to phased commencement.

The decisions in Selvi v. State of Karnataka, Bhabani Prasad Jena v. Convenor Secretary, Aparna Ajinkya Firodia v. Ajinkya Arun Firodia and particularly the recent R. Rajendran v. Kamar Nisha demonstrate the importance of privacy, autonomy and safeguards in the collection and examination of genetic information.

The European GDPR provides a useful comparative model through Article 20, which expressly enables individuals to receive and transfer qualifying personal information between service providers.

Ultimately, India needs a clearer statutory framework specifically addressing genomic data portability, interoperability, informed consent, confidentiality and the protection of genetic information belonging to both individuals and their biological relatives.

13. Important cases and statutory references for academic citation

Important statutory references:

Constitution of India: Article 21.

Information Technology Act, 2000: Section 43A.

SPDI Rules, 2011: Rules 2, 3, 5, 6 and 7.

Digital Personal Data Protection Act, 2023: Sections 3–14, particularly Sections 11–14.

GDPR: Articles 9, 15, 20 and Chapter V.

Primary research sources:

Supreme Court judgment – K.S. Puttaswamy (2017) .

Supreme Court judgment – R. Rajendran v. Kamar Nisha (2025) .

Information Technology SPDI Rules, 2011 .

Digital Personal Data Protection Act, 2023 .

Digital Personal Data Protection Rules, 2025 .

Official GDPR text – Article 20 .

Academic qualification: There is no direct Indian Supreme Court judgment establishing an enforceable general right to transfer genomic data between competing private genomic service providers. The Indian cases discussed above establish supporting principles of privacy and genetic autonomy, rather than deciding that specific portability question. This distinction is essential when using the material in a dissertation, research paper or legal examination.