1. Introduction

Data sharing in biotechnology research refers to the collection, transfer, disclosure, publication, preservation and reuse of scientific information generated through biotechnology projects. Such information may include genomic sequences, clinical-trial results, biological specimen records, laboratory findings, patient health data, AI-generated biomedical predictions and information held in biobanks.

The central legal challenge is balancing two competing objectives:

Scientific openness: enabling researchers to verify findings, reproduce experiments, develop treatments and accelerate innovation.

Legal protection: safeguarding patient privacy, informed consent, intellectual property, commercial confidentiality, research integrity and the rights of communities contributing biological samples.

There is no single worldwide law governing all biotech data sharing. Applicable requirements depend on the jurisdiction, type of data, research participants, funding arrangements, consent terms and intended recipient.

In India, the relevant framework includes the Digital Personal Data Protection Act, 2023 (DPDP Act), applicable commencement notifications and rules, clinical-research requirements, institutional ethics standards, contractual obligations and intellectual-property law. International projects may additionally be subject to European Union data-protection law or United States research-funding conditions.

For example, the US National Institutes of Health (NIH) Data Management and Sharing Policy, effective 25 January 2023, requires covered research projects to submit and implement an approved data-management and sharing plan. It promotes sharing while recognizing justified privacy, legal and proprietary restrictions.

Grants & Funding+1

2. Principal legal rules governing data sharing

Rule 1 — Lawful authority to share

Researchers must identify the applicable legal basis, participant authorization where required, institutional approval and contractual permissions before disclosing data. Consent to participate in one study does not automatically authorize every future use or unrestricted publication.

Rule 2 — Ethics approval and participant protection

Research involving human participants, human biological materials or associated personal data must comply with applicable ethics-review requirements. Consent documents should address relevant future uses, confidentiality risks and any rights to withdraw where applicable.

Rule 3 — Data minimization and security

Share only the information reasonably necessary for the approved research purpose. Apply access controls, encryption, audit logs, retention limits and appropriate de-identification. Genomic data may remain identifiable even after names and direct identifiers are removed.

Rule 4 — Data-sharing agreements

Written agreements should specify permitted uses, access conditions, onward transfer, publication rights, security responsibilities, breach notification, ownership of intellectual property and procedures for ending access.

Rule 5 — Cross-border compliance

Before transferring data or samples internationally, assess privacy-transfer rules, research permissions, export controls, material-transfer restrictions, applicable biosafety requirements and the terms of any funding award.

These rules must be applied together. Permission under a funding policy to publish research data does not override a legal restriction, an applicable consent limitation or a binding confidentiality obligation.

3. Indian legal framework

A. Digital Personal Data Protection Act, 2023

The DPDP Act establishes a framework for processing digital personal data. Its relevance to biotech research depends on whether the information is digital personal data, who processes it, the purpose of processing and which provisions have commenced.

Key provisions include:

Official text: Digital Personal Data Protection Act, 2023.

MeitY+1

Important commencement qualification: The Act and the DPDP Rules, 2025 have phased commencement dates. As of 5 November 2026, the substantive provisions in sections 3–17 are scheduled to commence 18 months after the Gazette notification of 13 November 2025, namely 13 May 2027. Consequently, researchers should not treat all substantive DPDP duties as already operative on the date of this explanation. Applicable pre-existing laws and rules must also be considered.

IndiaCode+2

A further distinction is essential: the research-related exemption is not a universal permission to distribute every patient dataset. Its scope and conditions must be examined against the particular processing activity, and other applicable legal, ethical and contractual restrictions remain relevant.

B. Indian Council of Medical Research (ICMR) ethical guidance

ICMR's National Ethical Guidelines for Biomedical and Health Research Involving Human Participants provide an important ethical framework for human biomedical research in India.

In practice, researchers should address:

Prior review and approval by the appropriate ethics committee.

Informed consent for collecting, storing and using human biological materials and related information.

Confidentiality and protection against unauthorized disclosure.

Future use of stored samples and data, including whether additional consent or review is needed.

Disclosure of relevant risks, including the possibility that genomic information may reveal sensitive information about participants or their relatives.

ICMR guidance must be read alongside applicable legislation and binding clinical-trial requirements; ethical guidance and statutory rules are not interchangeable.

For research involving human biological materials, the India clinical-research regulatory overview identifies written consent and ethics-committee review as important requirements.

ClinRegs+1

C. Clinical-trial data and regulatory submissions

Clinical-trial data may include case-report information, safety outcomes, adverse-event reports, laboratory results, genomic analyses and statistical datasets.

Research organizations should determine whether the proposed disclosure is permitted under the relevant clinical-trial rules, approved protocol, ethics approval, consent documentation and agreements with sponsors or investigators.

For example, a sponsor may be able to publish appropriately prepared aggregate trial results while remaining prohibited from providing identifiable patient records to an unrelated commercial company.

D. Intellectual property and confidential information

Sharing research data does not automatically transfer ownership of a patent, invention, biological material or confidential know-how.

Three separate questions must be answered:

Data access: Who may inspect or reuse the research dataset?

Intellectual property: Who owns or licenses inventions, patent rights, software or other protected results?

Publication and confidentiality: What can be disclosed publicly, and when?

A university might permit a collaborator to analyze genomic data under a restricted licence without granting that collaborator ownership of a patented diagnostic method. Conversely, a contract cannot necessarily prevent disclosures required by applicable law or binding funding conditions.

4. International rules affecting biotech data sharing

European Union — GDPR

The General Data Protection Regulation treats genetic data and health data as specially protected categories of personal data. Relevant provisions include Articles 5, 6, 9, 25, 32, 44–49 and 89.

Research sharing may require an applicable lawful basis, an Article 9 condition, safeguards, data minimization and compliance with international-transfer rules. Article 89 addresses safeguards for scientific research; it does not automatically authorize unrestricted disclosure.

Official text: GDPR, Regulation (EU) 2016/679.

United States — NIH Data Management and Sharing Policy

For research covered by the policy, investigators must prepare and implement a Data Management and Sharing Plan. Data should generally be shared by the earlier of the associated publication date or the applicable policy's other sharing deadline.

NIH recognizes that sharing may need to be restricted to protect participant privacy, honor consent limitations and safeguard proprietary information.

Official guidance: NIH Data Management and Sharing Policy overview.

Grants & Funding+1

Australia — Privacy and research governance

Australian projects must assess the Privacy Act 1988 where applicable, the Australian Privacy Principles, relevant state or territory requirements, research ethics guidance and institutional obligations. Cross-border disclosures may raise additional issues under Australian Privacy Principle 8.

The precise obligations depend on the organization, dataset, research context and applicable exceptions.

5. Detailed case laws

The following decisions establish principles relevant to biotechnology data sharing. Some directly concern genetic or biological materials; others concern privacy, research access or informed consent. They should not all be treated as decisions that specifically adjudicated modern genomic-data-sharing platforms.

Case 1 — Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1 · 24 August 2017

Facts and issue: A nine-judge Constitution Bench considered whether privacy is protected as a fundamental right under the Indian Constitution.

Decision: The Supreme Court recognized privacy as a constitutionally protected right, including as an intrinsic aspect of Article 21 and the freedoms guaranteed by Part III of the Constitution.

The judgment explains that an invasion of privacy must satisfy legality, a legitimate state aim and proportionality.

Indian Kanoon+1

Application to biotech research: Genetic profiles, clinical records and identifiable biological information can expose intimate facts about individuals and families. Research organizations should therefore assess whether data disclosure is lawful, necessary and proportionate, particularly when a government agency requests sensitive research information.

Legal significance: Puttaswamy supplies an important constitutional framework for privacy disputes in India. It does not, by itself, prescribe a complete consent procedure for every private-sector research collaboration.

Case 2 — Moore v. Regents of the University of California (1990)

Supreme Court of California · 51 Cal. 3d 120 · 793 P.2d 479

Facts: John Moore's cells were used in research after they were removed during medical treatment. His physicians pursued commercial research interests without adequately disclosing those interests to him.

Decision: The court rejected Moore's conversion claim based on ownership of the excised cells but allowed claims relating to the physicians' disclosure obligations, including breach of fiduciary duty and lack of informed consent, to proceed.

The court distinguished a patient's ownership claim over removed cells from the physician's obligation to disclose material conflicts of interest.

Justia Law

Application to biotech data sharing: The decision illustrates why informed consent and disclosure of commercial interests matter when human biological materials are used to generate commercially valuable discoveries.

For example, a researcher who obtains a specimen for clinical diagnosis should not assume that this automatically authorizes unrelated commercial research or every downstream use of the information generated from it.

Legal significance: Moore is an important US biological-materials case, but it does not establish a universal ownership rule for all genetic data or settle the law in India.

Case 3 — Washington University v. Catalona (2007)

United States Court of Appeals for the Eighth Circuit · 490 F.3d 667

Facts: A dispute arose over prostate-tissue samples and associated research materials collected through a university research program. A former researcher sought to facilitate transfer of those materials to another institution.

Decision: The court upheld the university's claim to control the research materials under the circumstances, rejecting the argument that the participating donors' consent forms had given them ownership rights sufficient to compel the requested transfer.

Application to biotech research: The case illustrates that the right to participate in research, consent to the use of a specimen and ownership or control of a biobank collection are distinct legal questions.

Before transferring samples or associated data to another institution, parties should examine the consent forms, repository policies, material-transfer agreements and applicable ownership rules.

Legal significance: Catalona concerns physical research materials and the governing documents, rather than a general rule that universities own every item of participant data.

Case 4 — Greenberg v. Miami Children's Hospital Research Institute (2003)

United States Court of Appeals for the Eleventh Circuit · 264 F. Supp. 2d 1064 (S.D. Fla. 2003)

Facts: Families affected by Canavan disease contributed biological samples and information to support research. A dispute arose after researchers obtained patent protection relating to the disease and its genetic testing.

Legal issue: Whether the contributors could assert claims based on the researchers' use of their contributions and the alleged failure to disclose the intended commercial implications.

Decision: The litigation addressed several claims concerning informed consent, fiduciary obligations, unjust enrichment and the research arrangement. The court did not establish that contributors automatically owned the resulting discoveries or had a general right to share in all commercial proceeds.

Application to biotech data sharing: Research institutions should disclose material limitations on access, foreseeable commercial uses and relevant intellectual-property arrangements. Community participation in research does not, by itself, resolve who owns resulting inventions or who controls subsequent disclosure.

Legal significance: Greenberg is useful for examining the intersection of genetic research, participant expectations and commercialization. Its holdings must be read in light of the particular claims and agreements involved.

Case 5 — Association for Molecular Pathology v. Myriad Genetics, Inc. (2013)

Supreme Court of the United States · 569 U.S. 576

Facts: The dispute concerned patents on genes associated with breast and ovarian cancer, including BRCA1 and BRCA2.

Decision: The Supreme Court held that naturally occurring DNA segments are not patent-eligible merely because they have been isolated. It distinguished naturally occurring DNA from certain synthetically created DNA, including cDNA.

Application to biotech data sharing: The case highlights the distinction between access to genetic information and patent rights over inventions involving that information. A researcher may be able to access or publish a genetic sequence without thereby obtaining rights to use a patented diagnostic method.

Legal significance: Myriad is principally a patent-eligibility decision, not a privacy or data-sharing judgment. Its relevance is to the intellectual-property boundaries surrounding genomic research.

6. Comparative legal principles from the cases

These decisions are complementary rather than interchangeable. A dispute about unauthorized disclosure of patient records is different from a dispute about ownership of a biological sample or patent eligibility.

7. Data-sharing agreements: essential clauses

A biotech research collaboration should ordinarily have a written data-sharing agreement (DSA), data-use agreement (DUA), material-transfer agreement (MTA), or a combination appropriate to the transaction.

A well-drafted agreement should cover the following matters:

Purpose and permitted use

Identify the approved research questions, datasets, authorized recipients and prohibited secondary uses.

Privacy and confidentiality

Specify de-identification standards, access controls, encryption, re-identification prohibitions and breach reporting.

Intellectual property

Allocate rights in pre-existing technology, inventions, analytical methods, software, databases and jointly developed results.

Publication and acknowledgment

Establish reasonable review periods for confidentiality, patent filings and accuracy without allowing indefinite suppression of legitimate scientific results.

Retention, withdrawal and deletion

Establish retention periods, return or deletion procedures, and the handling of derived datasets, backups and results that must lawfully be retained.

Liability and dispute resolution

Allocate responsibility for unauthorized disclosure, security failures, misuse, contractual breaches and applicable dispute-resolution procedures.

A DSA cannot cure an otherwise unlawful disclosure. The underlying data must still be eligible for sharing, and the parties must have the required authority and approvals.

8. Special legal issues in genomic and AI-based biotech research

A. Re-identification of genomic data

Removing a person's name does not necessarily make genomic data anonymous. Genetic information may be linked with family relationships, public genealogical resources or other datasets.

Appropriate safeguards can include controlled-access repositories, restrictions on downloading data, secure research environments and review of proposed secondary uses.

NIH guidance expressly recommends assessing privacy risks even where data have been described as de-identified.

Grants & Funding+1

B. AI training and secondary use

A dataset collected for clinical research may later be proposed for training a diagnostic AI model. The researcher should assess whether that use falls within the original authorization, applicable law, ethics approval, funding conditions and data-sharing agreement.

Further review may be required when the new use changes the research purpose, introduces commercial interests or creates materially different risks to participants.

C. Cross-border genomic transfers

International collaboration may involve transferring genomic data, biological samples, cloud-stored datasets and model outputs between institutions in different countries.

Before transfer, researchers should assess:

Whether the receiving institution may lawfully access and use the information.

Whether the transfer is permitted under applicable data-protection law.

Whether the samples are subject to separate material-transfer or export requirements.

Whether the transfer is consistent with participant consent and ethics approval.

Whether any contractual or funding restrictions prevent onward disclosure.

D. Public repositories versus controlled access

Open access is not always the legally appropriate default.

The appropriate choice depends on the actual data and legal context; the table is not a substitute for a project-specific assessment.

9. Legal consequences of non-compliance

Unauthorized or improperly managed data sharing can create several forms of exposure:

Privacy liability: unlawful disclosure, failure to meet applicable safeguards or misuse of personal information.

Research-ethics consequences: suspension of research activities, ethics-committee action or restrictions on future research.

Contractual liability: breach of a DSA, DUA, MTA, confidentiality agreement or funding condition.

Intellectual-property disputes: unauthorized use of patented technology, trade secrets or protected software.

Regulatory and funding consequences: corrective action, loss of access to datasets or funding-related sanctions.

Reputational damage: loss of participant trust, institutional credibility and opportunities for collaboration.

The precise remedy depends on the governing law, the nature of the breach and the terms of the applicable agreement. No single penalty applies to every data-sharing violation.

10. Practical compliance checklist

Before sharing biotech research data, a research institution can use the following checklist.

Research sharing readiness

0 of 8 completed

Identify the data, biological materials and jurisdictions involved.

Confirm consent, legal authority and ethics approvals.

Review privacy, confidentiality and intellectual-property restrictions.

Prepare and approve the DSA, DUA or MTA as applicable.

Assess re-identification and cross-border transfer risks.

Choose an appropriate repository and access-control model.

Document approvals, transfers, recipients and security measures.

Set publication, retention, deletion and incident-response procedures.

Reset checklist

Conclusion

The governing principle of biotech research data sharing is responsible access rather than unrestricted disclosure. Researchers should promote reproducibility and scientific collaboration while respecting privacy, consent, research ethics, intellectual property and binding contractual obligations.

For India, Puttaswamy provides a foundational constitutional privacy principle, while cases such as Moore, Catalona and Greenberg illuminate the distinct questions of informed consent, control of biological materials and commercialization. Myriad Genetics clarifies a related but separate issue: the patentability of genetic material.

The most reliable compliance strategy combines applicable law, ethics approval, appropriate consent, documented data-sharing arrangements, risk-based security and careful review of cross-border transfers. Because the DPDP Act has phased commencement, its operative provisions should be checked against the relevant date before a particular sharing arrangement is approved. This is a general legal research overview, not a substitute for advice on a specific research project.