Data sovereignty for neural information

Introduction

Data sovereignty for neural information refers to the legal and ethical principle that individuals should retain meaningful control over information generated from their brain activity and neural processes. Neural information may include brainwave recordings, neural signals, cognitive patterns, emotional responses and information collected through brain-computer interfaces (BCIs), neuroimaging technologies and neurostimulation devices.

These technologies are increasingly used in healthcare, neuroscience research, rehabilitation, artificial intelligence and communication systems. For example, brain-computer interfaces can collect neural signals to help individuals with neurological disabilities operate external devices.

However, neural information may reveal highly personal characteristics, including attention patterns, cognitive responses and possible health conditions. Unauthorised collection, commercial exploitation or disclosure of such information can threaten privacy, autonomy and human dignity. Therefore, data sovereignty has become an important principle in the governance of neurotechnology.

Legal framework in India

1. Digital personal data protection act, 2023

The Digital Personal Data Protection Act, 2023, provides a framework for processing digital personal data in India.

Section 4 establishes requirements for lawful processing, Section 6 addresses consent, and Section 8 specifies obligations of data fiduciaries.

Neural information may qualify as personal data when it relates to an identifiable individual. Therefore, organisations collecting neural signals through medical devices or research platforms must consider applicable requirements concerning consent, lawful processing and security safeguards.

The Act does not separately establish a statutory category called neural data or provide an independent ownership right over brain information. Its application must also be considered in light of relevant commencement provisions.

2. Information technology act, 2000

The Information Technology Act, 2000, provides a legal framework for electronic records, cybersecurity and confidentiality.

Important provisions include:

Section 43: Addresses unauthorised access and damage to computer systems.

Section 66: Covers specified computer-related offences.

Section 70: Provides for protected computer systems.

Section 72: Addresses breach of confidentiality and privacy by persons obtaining access through powers conferred under the Act.

These provisions may become relevant when neural information stored in electronic systems is accessed or disclosed without authorisation.

3. Mental healthcare act, 2017

The Mental Healthcare Act, 2017, protects the rights and dignity of persons receiving mental healthcare.

Section 23 establishes the right to confidentiality concerning mental health, treatment and related information, subject to statutory exceptions.

This protection is relevant where neural information is collected during psychiatric treatment, neurological assessment or mental healthcare research.

Important principles of neural data sovereignty

1. Individual control over neural information

Individuals should have meaningful control over the collection, storage and use of their neural information.

Researchers and technology companies should clearly explain why neural signals are collected and whether the information will be used for additional research or commercial purposes.

2. Informed consent

Consent should be voluntary, understandable and specific to the intended processing activity.

For example, a patient using a brain-computer interface should receive information about the collection of neural signals, storage arrangements, possible third-party access and research reuse.

3. Protection against commercial exploitation

Companies may use neural information to develop AI models, personalised healthcare products and behavioural prediction systems.

Data sovereignty requires clear contractual and legal safeguards to prevent unauthorised commercial exploitation.

4. Cross-border data transfers

Neurotechnology companies may store neural information on international cloud platforms.

Such transfers must comply with applicable data protection laws and relevant restrictions. Under Section 16 of the DPDP Act, 2023, the Central Government may restrict transfers of personal data to specified countries or territories through notification.

5. Data security and confidentiality

Neural information should be protected through encryption, access controls, secure storage and appropriate cybersecurity procedures.

Organisations should also establish procedures for responding to data breaches and unauthorised access.

International legal and ethical frameworks

International organisations have increasingly recognised the need for specific safeguards concerning neural information.

UNESCO: Its Recommendation on the Ethics of Neurotechnology, adopted in 2025, addresses ethical governance, human dignity, privacy and the protection of individuals in the development and use of neurotechnology.

OECD: Its Recommendation on Responsible Innovation in Neurotechnology, adopted in 2019, encourages responsible research, safety, privacy protection and public engagement.

Neurorights framework: Academic and policy discussions identify important protections such as mental privacy, cognitive liberty, mental integrity and protection against algorithmic discrimination. These concepts are influential but are not universally recognised as separate enforceable legal rights.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 of the Constitution.

The judgment recognised informational privacy, personal autonomy and the importance of protecting individuals against unjustified interference.

Relevance: Neural information may reveal highly personal characteristics about an individual's mental and physical condition. The judgment provides an important constitutional foundation for protecting neural information against unnecessary collection and misuse.

2. K.S. Puttaswamy v. Union of India (Aadhaar case, 2018)

The Supreme Court examined the constitutional validity of Aadhaar and considered the collection, storage and use of biometric information.

The Court emphasised proportionality and the importance of safeguards against excessive collection and disclosure.

Relevance: Neural information, like biometric information, may be used for identification and authentication. The judgment supports the need for legal justification, limited collection and appropriate security safeguards.

3. Selvi v. State of Karnataka (2010)

The Supreme Court examined the constitutional validity of involuntary narco-analysis, polygraph examinations and brain electrical activation profile tests.

The Court held that involuntary administration of these techniques violated constitutional protections, including the right against self-incrimination under Article 20(3) and personal liberty under Article 21.

Relevance: This is particularly important for neural data sovereignty. The judgment protects individuals against certain forms of involuntary extraction of information concerning their mental processes and supports personal autonomy and mental privacy.

4. Schloendorff v. Society of New York Hospital (1914)

The New York Court of Appeals recognised the principle that an adult patient of sound mind has the right to determine what is done to their body.

Relevance: Although the case predates modern neurotechnology, it provides a foundational principle for bodily autonomy and informed consent in procedures involving neural devices and brain-related medical interventions.

Challenges in protecting neural information

Neural data sovereignty faces several challenges because brain-computer interfaces continuously generate information and may connect directly with cloud-based AI platforms.

Major concerns include:

Unauthorised collection of neural signals.

Commercial use without meaningful consent.

Re-identification of supposedly anonymous neural datasets.

Cyberattacks targeting connected brain devices.

Unclear ownership and licensing arrangements.

International transfers involving different privacy laws.

Algorithmic profiling based on inferred cognitive characteristics.

These challenges require cooperation between governments, researchers, medical institutions and neurotechnology companies.

Compliance measures

Organisations handling neural information should:

Obtain meaningful and informed consent.

Collect only information necessary for specified purposes.

Provide clear explanations of data-sharing arrangements.

Implement encryption and strict access controls.

Establish retention and deletion policies.

Restrict unauthorised commercial reuse.

Conduct regular privacy and cybersecurity assessments.

Provide transparent procedures for withdrawal of consent.

Establish safeguards for vulnerable research participants.

Maintain accountability for third-party processing.

Conclusion

Data sovereignty for neural information is an emerging legal and ethical issue in neurotechnology. India's Digital Personal Data Protection Act, 2023, Mental Healthcare Act, 2017, and constitutional privacy protections provide important safeguards for personal and neural information. Judicial decisions such as Puttaswamy, Selvi v. State of Karnataka and Schloendorff establish significant principles concerning privacy, mental autonomy and informed consent. International developments, particularly UNESCO's 2025 Recommendation on the Ethics of Neurotechnology and the OECD's 2019 Recommendation, further support responsible governance. Strong legal safeguards are necessary to ensure that technological advancement does not undermine individual autonomy, mental privacy and human dignity.