1. Introduction

Liability for genomic data breaches refers to the legal responsibility of individuals, laboratories, hospitals, biotechnology companies, genetic-testing companies, research institutions, data processors and government authorities when genetic or genomic information is unlawfully accessed, disclosed, collected, transferred, altered, misused, stolen or inadequately protected.

Genomic data is particularly sensitive because it contains information about an individual's biological identity, inherited characteristics, genetic predispositions and familial relationships. Unlike an ordinary password or financial account number, genetic information cannot simply be changed after it has been compromised.

For example, a genomic data breach may reveal:

Genetic predisposition to hereditary diseases.

Risk of developing particular cancers.

Information about biological parentage and family relationships.

Ancestry and ethnic origins.

Genetic characteristics of relatives who never consented to testing.

Information that could potentially be used for discrimination in employment, insurance or other commercial activities.

Consequently, genomic data breaches can give rise to several forms of liability, including:

Civil liability for negligence.

Liability for breach of confidentiality.

Statutory liability under data protection legislation.

Constitutional liability for violations of privacy.

Criminal liability for unlawful access or disclosure.

Contractual liability for breach of data-processing agreements.

Regulatory liability for failure to implement appropriate security measures.

Liability for consequential psychological, financial and reputational harm.

The legal issue is not merely whether information was stolen. It is also whether the organisation responsible for the information failed to exercise reasonable care in collecting, storing, processing, sharing and protecting genomic information.

2. Meaning and nature of genomic data breaches

A genomic data breach occurs when genomic information is compromised through an unauthorised or unlawful act, or through a failure to maintain appropriate security and confidentiality.

Genomic information includes:

Whole-genome sequencing data.

Whole-exome sequencing data.

DNA profiles.

Genetic variants and mutations.

Chromosomal information.

Genetic disease-risk assessments.

Biometric genetic identifiers.

Family-based genetic datasets.

Common forms of genomic data breaches

Important distinction: A security incident does not automatically establish every form of legal liability. Liability depends on the applicable law, the organisation's duties, the nature of the breach, available defences and, where required, proof of damage and causation.

3. Legal framework governing genomic data breaches in India

A. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) is an important part of India's emerging framework for the protection of personal data.

Genomic information can qualify as personal data when it relates to an identifiable individual.

Important provisions include:

Section 8 is particularly important. An organisation responsible for genomic information cannot avoid its statutory responsibilities merely by arguing that the breach was caused by a third-party hacker or cloud service provider.

The statutory obligations must be examined in light of the organisation's role and the applicable rules.

A contravention can attract financial penalties under the Act. The Schedule provides for a penalty that may extend to ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches.

The precise application of the Act depends on its commencement provisions, applicable rules, exemptions and the relevant processing circumstances.

B. Information Technology Act, 2000

The Information Technology Act, 2000 may also apply to genomic data breaches.

Section 43

Where a person accesses, downloads, copies or extracts data from a computer system without permission, civil compensation may arise under the circumstances specified in the section.

Section 43A

Historically, this provision addressed compensation for failure by a body corporate to maintain reasonable security practices in handling sensitive personal data or information.

Its present applicability must be assessed alongside the DPDP Act and the relevant commencement and repeal provisions. It should not be treated as an automatically available parallel remedy for every new breach.

Section 66

Where acts specified under Section 43 are committed dishonestly or fraudulently, criminal liability may arise.

Section 72

Provides punishment for breach of confidentiality and privacy in circumstances covered by the provision.

Section 72A

Addresses disclosure of personal information in breach of a lawful contract, with the required wrongful intent or knowledge.

C. Constitutional protection under Article 21

Article 21 of the Constitution of India protects the right to life and personal liberty.

The right to privacy forms part of Article 21.

Genomic information is closely connected with privacy because it reveals intimate biological information about an individual and potentially their relatives.

Unauthorised disclosure of genetic information may therefore raise constitutional privacy concerns, particularly where the State or a public authority is involved.

D. Indian Council of Medical Research (ICMR) ethical guidelines

ICMR's National Ethical Guidelines for Biomedical and Health Research Involving Human Participants are relevant to genomic research.

They emphasise:

Informed consent.

Confidentiality.

Privacy protection.

Responsible management of biological samples.

Ethical handling of genetic information.

Appropriate safeguards in research.

Protection of participants from misuse of their personal information.

These guidelines are especially relevant when genomic information is collected for research rather than routine clinical treatment.

4. Liability under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

Until the relevant DPDP provisions become effective, the Information Technology Act and the SPDI Rules remain particularly important to the Indian legal analysis.

The SPDI Rules regulate the collection, disclosure and protection of sensitive personal information by body corporates.

Important rules

Rule 3 – Sensitive personal data

The Rules identify categories of sensitive personal information, including:

Physical, physiological and mental health conditions.

Medical records and history.

Biometric information.

Other specified sensitive information.

Although genetic information is not expressly listed as a separate category, genomic information may fall within the scope of the Rules depending on its content and relationship to health or biometric information.

Rule 5 – Collection of information

An organisation collecting sensitive personal information must comply with applicable requirements concerning consent, purpose, collection and disclosure.

For example, a genetic-testing company cannot assume that permission to perform a diagnostic test automatically authorises every subsequent commercial use of the resulting genomic data.

Rule 6 – Disclosure of information

Disclosure to third parties must satisfy the applicable consent and legal requirements.

Rule 8 – Reasonable security practices and procedures

A body corporate handling sensitive personal information must maintain reasonable security practices and procedures.

Failure to implement appropriate technical and organisational safeguards may contribute to liability under the applicable legal framework.

5. Different forms of legal liability for genomic data breaches

A. Liability for negligence

Negligence arises when an organisation fails to exercise the degree of care reasonably expected of an entity entrusted with highly sensitive genomic information.

For example, a hospital maintains thousands of patients' genetic reports on an inadequately secured server. An attacker accesses the server and publishes the reports online.

The hospital may face allegations of negligence because it failed to implement reasonable safeguards.

The essential elements are:

Duty of care: The organisation owed a duty to protect genomic information.

Breach of duty: It failed to implement reasonable security measures.

Causation: The failure contributed to the breach.

Damage: The affected individual suffered legally recognisable harm.

Potential consequences include compensation for proven financial loss, reputational damage, psychological injury where legally recognised, and other appropriate remedies.

B. Liability for breach of confidentiality

Genomic information is inherently private.

A laboratory, genetic counsellor, hospital or biotechnology company may receive such information under circumstances that create an express or legally recognised duty of confidentiality.

Suppose a genetic-testing laboratory discloses a patient's hereditary cancer-risk report to an employer without lawful authority.

The disclosure may constitute a breach of confidentiality even if the information was obtained legitimately in the first place.

Potential remedies include:

Injunctions against further disclosure.

Compensation where legally available.

Orders requiring appropriate protective measures.

Disciplinary or regulatory proceedings.

Other contractual or statutory remedies.

C. Liability for unauthorised commercial exploitation

Genomic information may have considerable commercial value.

Biotechnology companies may use genomic databases for pharmaceutical research, personalised medicine, drug development and artificial intelligence training.

Liability may arise when a company:

Uses genomic information beyond the agreed purpose.

Transfers genetic data without the necessary authority.

Sells identifiable genetic information unlawfully.

Fails to comply with applicable consent requirements.

Conceals secondary uses from individuals.

Misrepresents the extent of data anonymisation.

The central legal question is whether the processing was authorised and whether the organisation complied with applicable contractual, statutory and confidentiality obligations.

D. Liability for re-identification of anonymised genomic information

One of the most serious risks is the re-identification of supposedly anonymous genomic information.

Genomic information can contain distinctive patterns that may be matched with publicly available information or relatives' genetic records.

For example, a research institution publishes an anonymised genetic database. A third party combines it with genealogy databases and other publicly available information to identify individual participants.

The institution may face liability if its anonymisation claims were misleading or if it failed to implement safeguards reasonably required by its legal and contractual obligations.

However, re-identification alone does not automatically establish negligence. The applicable duty, foreseeability, security measures and causal connection must be examined.

E. Liability for third-party data processors

Genomic testing companies commonly outsource data storage and processing to:

Cloud computing companies.

External sequencing laboratories.

Data analytics companies.

Artificial intelligence developers.

Research institutions.

Outsourcing does not necessarily eliminate the original organisation's legal responsibilities.

For example:

A hospital transfers genomic records to a cloud service provider. The provider experiences a cyberattack because of inadequate access controls.

Depending on the applicable legal regime and contractual arrangements, liability may arise against the hospital, the service provider or both.

Relevant issues include:

Selection of the service provider.

Security due diligence.

Data-processing agreements.

Access restrictions.

Encryption and authentication.

Incident reporting.

Supervision and auditing.

F. Liability for familial and hereditary privacy violations

Genetic information is unusual because it may reveal information about individuals other than the person who provided the sample.

For example, the disclosure of an individual's genetic mutation may indirectly reveal that their biological relatives carry an increased hereditary disease risk.

This creates a complicated question: whose privacy has been violated?

The tested individual has a direct interest in their genetic privacy. Relatives may also have legitimate privacy interests where the disclosure identifies or reveals information about them.

The law must balance:

Individual autonomy.

Familial privacy.

Medical confidentiality.

The interests of relatives.

Legitimate public-health and research objectives.

An organisation cannot automatically assume that consent from one family member resolves every privacy issue involving other identifiable individuals.

6. Important judicial decisions and case laws

The following cases are particularly relevant to genomic privacy, DNA information, informational privacy and the responsibility to protect sensitive personal information.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India

Citation: (2017) 10 SCC 1; AIR 2017 SC 4161.

Facts:

The case concerned whether the Constitution of India recognises a fundamental right to privacy.

The dispute arose in the context of the Aadhaar identification programme and the collection and use of personal and biometric information.

A nine-judge Constitution Bench examined the constitutional status of privacy.

Legal issues:

Whether privacy is a fundamental right.

Whether informational privacy is constitutionally protected.

Whether the State can collect and process personal information without adequate legal safeguards.

Whether privacy protection also imposes positive obligations on the State.

Judgment:

The Supreme Court unanimously recognised privacy as a fundamental right protected under Article 21 and other freedoms under Part III of the Constitution.

Justice D.Y. Chandrachud's opinion recognised informational privacy as an important component of the right to privacy.

The judgment also recognised that privacy risks can originate from non-State actors, not merely the government.

It identified the need for a robust data protection framework.

Principle applicable to genomic data breaches:

Genomic information is an especially intimate form of personal information.

Unauthorised collection, storage, processing or disclosure of genomic information may therefore raise serious constitutional privacy concerns.

The judgment is particularly relevant to:

Genetic database surveillance.

Unauthorised disclosure of DNA information.

Government genomic databases.

Commercial genetic profiling.

Unlawful secondary use of genetic information.

Significance for liability:

Puttaswamy establishes the constitutional foundation for protecting informational privacy. However, it does not automatically create a private damages claim against every private company suffering a data breach. The appropriate cause of action and defendant must be identified separately.

Indian Kanoon+2

Case 2: Selvi v. State of Karnataka (2010)

Supreme Court of India

Citation: (2010) 7 SCC 263; AIR 2010 SC 1974.

Facts:

The case concerned the involuntary administration of narcoanalysis, polygraph examination and brain-mapping techniques during criminal investigations.

The Supreme Court considered whether compelling individuals to undergo such procedures violated constitutional protections.

Legal issues:

Whether involuntary investigative techniques violate personal liberty.

Whether compelled extraction of personal information violates privacy.

Whether such procedures violate Article 20(3) of the Constitution.

Whether individual consent is necessary for certain investigative procedures.

Judgment:

The Supreme Court held that involuntary administration of the techniques in question violated Article 20(3) and Article 21 protections.

The Court emphasised personal autonomy, mental privacy and the protection of individuals against involuntary extraction of personal information.

Relevance to genomic data breaches:

Although the case did not concern a cyberattack or a commercial genetic database, its principles are relevant to the protection of intimate personal and biological information.

It supports the proposition that biological and personal information cannot be obtained or exploited without regard to constitutional protections.

Significance:

An organisation handling genomic information should respect individual autonomy and applicable consent requirements.

Indian Kanoon

Case 3: S. and Marper v. United Kingdom (2008)

European Court of Human Rights

Citation: Applications Nos. 30562/04 and 30566/04, Judgment dated 4 December 2008.

Facts:

Two individuals challenged the retention of their fingerprints, DNA samples and DNA profiles by British police authorities.

One applicant had been acquitted, while proceedings against the other had been discontinued.

Despite these outcomes, the authorities retained their biological samples and DNA profiles.

Legal issues:

Whether retaining DNA samples violates privacy.

Whether genetic information is personal information.

Whether DNA profiles reveal information about relatives.

Whether indefinite retention is proportionate.

Whether adequate safeguards exist against misuse.

Judgment:

The Grand Chamber held that retaining the applicants' DNA samples and profiles constituted an interference with their right to respect for private life under Article 8 of the European Convention on Human Rights.

The Court observed that cellular samples contain extensive sensitive information, including health-related and familial information.

It also recognised that DNA profiles can reveal genetic relationships and information concerning ethnic origins.

The indiscriminate and indefinite retention of the applicants' DNA information was disproportionate.

Relevance to genomic data breaches:

This is one of the most important international authorities for understanding genomic privacy.

The judgment establishes that:

DNA information deserves heightened privacy protection.

Genetic samples contain information beyond simple identification.

Genetic information can affect relatives.

Retention and use must be proportionate.

Adequate safeguards against misuse are necessary.

Significance for liability:

If an institution retains genomic information indefinitely without adequate justification or safeguards, its conduct may raise serious privacy and data-protection issues.

The case is persuasive comparative authority in India, not a binding Indian Supreme Court judgment.

Bailii+2

Case 4: In re 23andMe, Inc. Customer Data Security Breach Litigation (2024–2026)

United States litigation

Proceeding: MDL No. 3098, Case No. 3:24-md-03098-EMC, originally before the United States District Court for the Northern District of California.

Facts:

In October 2023, genetic-testing company 23andMe disclosed a cybersecurity incident involving unauthorised access to customer accounts.

The incident involved personal information associated with approximately 6.4 million US residents.

The litigation involved allegations relating to:

Inadequate protection of personal information.

Failure to maintain appropriate security procedures.

Privacy violations.

Genetic-information privacy.

Breach-notification obligations.

Unjust enrichment.

Legal significance:

The litigation illustrates how a genomic data breach can lead to collective consumer claims and substantial financial exposure.

The class settlement received final approval on 30 January 2026. The final settlement amount was approved at $46.75 million on 7 July 2026.

The settlement should not be interpreted as a judicial finding that every allegation against the company was proven.

Importance for genomic data liability:

This case demonstrates the potential financial consequences of a breach involving genetic information.

It also illustrates that companies handling genetic information may face multiple overlapping claims, including ordinary data-security claims and specialised genetic privacy claims.

23andmedatasettlement.com+2

Case 5: California Attorney General's 23andMe settlement (2026)

Date: 19 October 2026.

The California Attorney General announced a proposed $6 million settlement with Chrome Holding Co., formerly known as 23andMe.

The settlement concerned allegations of inadequate protection of customer personal and genetic information following the 2023 breach. It also addressed objections to the sale of Californians' genetic information and biological samples during bankruptcy proceedings.

The announcement stated that the settlement was pending court approval and that affected consumers retained the right to request deletion of their information and destruction of their samples.

Legal significance:

This development is important because it illustrates that genomic data protection obligations can extend beyond the initial cybersecurity incident.

They can also concern:

Transfer of genetic databases during insolvency.

Protection of genetic samples.

Consumer control over genetic information.

Continued retention after corporate restructuring.

Regulatory enforcement.

It is a proposed regulatory settlement, not a final judicial determination of all allegations.

Office of the Attorney General

Case 6: District Registrar and Collector v. Canara Bank (2005)

Supreme Court of India

Citation: (2005) 1 SCC 496.

Facts:

The case concerned statutory powers relating to inspection and seizure of private financial records maintained by banks.

The Supreme Court examined the privacy interests associated with confidential personal and financial information.

Legal issues:

Whether private records are protected by privacy principles.

Whether access to confidential records requires lawful authority.

Whether statutory powers can be exercised without adequate safeguards.

Judgment:

The Supreme Court recognised the importance of privacy in confidential personal records and examined the limits of State access to such information.

Application to genomic data:

The reasoning is relevant by analogy to genomic databases maintained by hospitals and research institutions.

Access to private genetic records should be governed by lawful authority and appropriate safeguards.

Significance:

It supports the principle that sensitive personal records should not become freely accessible merely because they are held by an institution.

Case 7: R. Rajagopal v. State of Tamil Nadu (1994)

Supreme Court of India

Citation: (1994) 6 SCC 632.

Facts:

The case concerned the publication of an autobiography containing information about a prisoner and his personal life.

The Supreme Court examined the right to privacy and the limits of publication of private information.

Judgment:

The Court recognised the right to privacy and discussed the protection of personal information against unauthorised publication.

Application to genomic information:

The disclosure of genomic reports, hereditary disease information and family genetic relationships may interfere with personal privacy.

A laboratory or company cannot treat confidential genetic information as unrestricted material for public disclosure.

Significance:

The decision provides an important foundation for understanding liability arising from unauthorised publication of confidential personal information.

7. Who can be held liable for a genomic data breach?

Liability depends on the role played by each participant in the genomic-data processing chain.

A distinction must be made between the data fiduciary, the data processor and an individual wrongdoer. Their respective responsibilities depend on the applicable law and the facts.

8. Essential elements for establishing liability

A claimant seeking legal remedies for a genomic data breach may need to establish the following elements, depending on the cause of action.

1. Existence of genomic information

The claimant must establish that the information concerned identifiable or identifiable-linked genomic data.

2. Legal duty

The defendant must have owed a relevant duty arising from legislation, contract, confidentiality obligations, professional standards or other applicable law.

3. Breach of duty

Examples include:

Failure to encrypt sensitive records where appropriate.

Weak authentication.

Unrestricted employee access.

Inadequate security monitoring.

Unlawful disclosure.

Failure to follow required data-retention procedures.

4. Causation

The claimant must establish the necessary connection between the defendant's conduct and the alleged injury, where causation is an element of the claim.

5. Injury or statutory contravention

Depending on the legal remedy, this may involve:

Financial loss.

Identity-related harm.

Discrimination.

Reputational injury.

Psychological injury.

Loss of confidentiality.

A statutory breach attracting regulatory penalties.

An important distinction is that regulatory penalties and private compensation do not necessarily require identical proof.

9. Types of damages and remedies

A. Compensatory damages

Compensation may be sought for legally recognised losses resulting from the breach.

Examples:

Financial expenses incurred to address the incident.

Losses resulting from misuse of genetic information.

Proven consequential financial injury.

Other legally compensable harm.

B. Injunctive relief

Courts may be approached for orders preventing:

Further disclosure of genetic reports.

Unauthorised commercial use.

Continued unlawful processing.

Transfer of confidential genomic databases.

Publication of identifiable genetic information.

C. Erasure and destruction

Depending on the applicable legal regime, an individual may seek appropriate remedies relating to:

Deletion of digital genomic records.

Destruction of biological samples.

Restriction of further processing.

Removal of unlawfully disclosed information.

However, erasure rights may be subject to legal retention obligations, legitimate research requirements and other statutory exceptions.

D. Regulatory penalties

Under the DPDP Act, Section 33 and its Schedule provide for monetary penalties for specified contraventions.

In particular, the maximum scheduled penalty for failure to take reasonable security safeguards to prevent personal data breaches is ₹250 crore.

E. Criminal proceedings

Where the facts satisfy the elements of an applicable criminal offence, proceedings may arise under the Information Technology Act or other relevant criminal legislation.

A mere cybersecurity failure, however, does not automatically constitute a criminal offence.

10. Defences available to organisations

An organisation facing allegations of genomic data breaches may rely on legally recognised defences, depending on the applicable claim.

1. Absence of negligence

The organisation may establish that it maintained reasonable security measures and complied with its relevant legal duties.

2. Independent criminal attack

The organisation may argue that a sophisticated external attack caused the breach despite reasonable precautions.

However, the mere existence of a cyberattack does not automatically absolve an organisation of responsibility.

3. Valid consent

The organisation may demonstrate that the relevant collection or disclosure was authorised by valid consent, where consent is the applicable legal basis.

Consent does not excuse inadequate security.

4. Statutory authority

Disclosure may be justified where required or authorised by applicable legislation or a lawful court order.

5. Absence of causation

The organisation may argue that the claimant's alleged loss was not caused by its conduct.

6. Absence of legally recognisable damage

For a damages claim requiring proof of injury, the defendant may contest whether the claimant suffered compensable harm.

11. Important distinction: Present legal position in India (November 2026)

There is an important commencement issue concerning the DPDP Act.

The Digital Personal Data Protection Rules, 2025 and the commencement notification were published on 13 November 2025.

However, the Act is being implemented in phases.

Therefore, as of 8 November 2026, Section 8's security-safeguard and breach-notification obligations have not yet commenced.

This is an important qualification: the Section 8 duties discussed above explain the future statutory framework, not an already-operative Section 8 cause of action.

Until the relevant provisions become effective, the existing Information Technology Act framework, including applicable SPDI Rules, contractual obligations, confidentiality principles and constitutional protections, must be considered.

The Section 43A framework and SPDI Rules are scheduled to be repealed through the DPDP Act's phased commencement arrangements, subject to the applicable notification and transitional provisions.

Sources:

IndiaCode+3

12. Practical illustrations of genomic data breach liability

The following hypothetical examples demonstrate how liability may arise.

Illustration 1: Hospital genomic database hacking

A hospital stores genomic information relating to 50,000 patients. Hackers gain access because the hospital uses weak passwords and inadequate security controls.

Possible liability:

Negligence.

Breach of confidentiality.

Liability under applicable IT legislation.

Regulatory consequences under applicable data protection law.

Legal principle: Puttaswamy supports the importance of protecting informational privacy.

Illustration 2: Genetic information disclosed to an insurance company

A genetic-testing company shares a customer's hereditary disease-risk information with an insurance company without the necessary legal authority.

Possible liability:

Unauthorised disclosure.

Breach of confidentiality.

Violation of applicable consent requirements.

Contractual liability.

Potential privacy-related claims.

Legal principle: Puttaswamy and S. and Marper recognise the special privacy interests associated with intimate personal and genetic information.

Illustration 3: Employee steals genomic records

An employee of a biotechnology company downloads thousands of genetic profiles and sells them to commercial organisations.

Possible liability:

Criminal liability, if the relevant statutory elements are satisfied.

Breach of confidentiality.

Contractual liability.

Civil liability.

Possible liability of the employer if its own failures contributed to the incident.

Illustration 4: Genetic database transferred during bankruptcy

A genetic-testing company becomes insolvent and proposes transferring its customer genomic database to another commercial organisation.

Possible liability and legal issues:

Whether the transfer is legally authorised.

Whether customer consent covers the proposed transfer.

Whether the transferee can retain biological samples.

Whether existing privacy commitments must be honoured.

Whether consumers can exercise applicable deletion rights.

The 2026 23andMe proceedings illustrate the practical importance of these issues.

13. Preventive legal and technical safeguards

Organisations handling genomic information should adopt a comprehensive protection framework.

14. Critical legal analysis

Genomic data breaches create distinctive legal challenges that are not fully addressed by ordinary data protection principles.

First, genetic information is permanent. A person cannot change their DNA in the same way that they can change a password.

Second, genomic information is familial. The disclosure of one person's genetic information may expose information about biological relatives.

Third, genetic information can be predictive. It may reveal potential future health risks, creating possibilities for discrimination and exploitation.

Fourth, anonymisation is not always sufficient. Genetic information may be re-identified by combining datasets.

Fifth, the consequences may extend across generations. Information about inherited conditions can have implications for descendants and other family members.

Sixth, corporate restructuring creates additional risks. The sale, transfer or liquidation of a genomic database may expose information to new organisations and purposes.

These characteristics justify particularly careful treatment of genomic information in privacy law, cybersecurity regulation and medical confidentiality.

15. Conclusion

Liability for genomic data breaches is an important emerging area of privacy, biotechnology and information technology law.

The liability of hospitals, genetic-testing laboratories, biotechnology companies, research institutions and data processors may arise when they fail to protect genomic information, disclose it without lawful authority, misuse it for commercial purposes or retain it contrary to applicable legal requirements.

In India, the principal legal foundations include:

Article 21 of the Constitution – protection of privacy.

Justice K.S. Puttaswamy v. Union of India (2017) – constitutional recognition of informational privacy.

Selvi v. State of Karnataka (2010) – personal autonomy and protection against involuntary extraction of personal information.

Information Technology Act, 2000 – applicable statutory remedies and offences.

SPDI Rules, 2011 – protection of specified sensitive personal information.

Digital Personal Data Protection Act, 2023 – the forthcoming comprehensive statutory framework for digital personal data protection.

S. and Marper v. United Kingdom (2008) – heightened protection of DNA samples and genetic profiles.

The fundamental legal principle is that genomic information is not merely ordinary digital information. It is deeply personal biological information that may reveal an individual's identity, health risks and familial relationships. Organisations entrusted with such information must comply with their applicable legal duties and take appropriate measures to prevent unauthorised access, disclosure and exploitation.

16. Important cases and authorities for examination or research

17. Primary legal research sources

For further examination of the legislation and judgments:

Puttaswamy – Supreme Court judgment

Selvi v. State of Karnataka

S. and Marper v. United Kingdom

Digital Personal Data Protection Rules, 2025

DPDP Act commencement notification

23andMe data breach litigation and settlement

Research note: The 23andMe proceedings are comparative examples, not binding Indian precedents. Similarly, the European Court of Human Rights decisions are persuasive comparative authorities rather than binding decisions of Indian courts.