Regulation of National Genomic Database Governance in China

1. Introduction

China regulates genomic databases through a combination of biosecurity legislation, human genetic resources rules, personal information protection, data security requirements, and scientific research ethics. These rules govern the collection, storage, processing, sharing, and international transfer of genetic information.

Genomic databases contain sensitive information about individuals, including DNA sequences, inherited diseases, biological relationships, and potential health risks. China therefore treats human genetic resources as a matter of both personal privacy and national biosecurity. The regulatory framework aims to protect individuals, prevent unauthorized foreign access, promote scientific research, and safeguard strategically important genetic resources.

China does not rely on one single statute for all national genomic databases. Instead, several laws and administrative regulations operate together.

2. Major Legal Framework

A. Biosecurity Law of the People’s Republic of China, 2021

The Biosecurity Law, effective from 15 April 2021, establishes a broad national framework for protecting biological resources and managing biological risks.

Its principal objectives include:

Protecting human genetic resources and biological resources.

Preventing biological security risks arising from research and technological development.

Strengthening governmental supervision of biological activities.

Coordinating biological data governance with national security requirements.

The law provides the broader security foundation for regulating genomic research, biological databases, and activities involving human genetic resources. Its application must be read together with more specific rules governing human genetic resources and data processing.

B. Regulation on the Administration of Human Genetic Resources, 2019

The Regulation on the Administration of Human Genetic Resources, promulgated by the State Council in 2019, was historically central to China's governance of human genetic material and associated information. The regulatory system was substantially revised when the Implementing Rules on the Regulation on the Administration of Human Genetic Resources took effect in July 2023.

The framework distinguishes between human genetic material, such as blood, tissues, and cells, and human genetic information, such as genetic sequences and associated analytical data.

Important regulatory concerns include:

Collection and preservation of human genetic resources.

International scientific collaboration involving Chinese human genetic resources.

Provision of genetic information to foreign organizations or individuals.

Protection of national interests and the rights of research participants.

The precise approval, filing, or security-review requirement depends on the nature of the activity, the parties involved, and the applicable exemptions.

C. Personal Information Protection Law (PIPL), 2021

The PIPL is a central statute governing the processing of personal information, including identifiable genetic data.

Genetic information may constitute sensitive personal information because its misuse can cause serious harm to an individual's privacy, dignity, or interests. Under Articles 28–30:

Sensitive personal information requires a specific purpose, sufficient necessity, and strict protective measures.

Separate consent is generally required, subject to statutory exceptions.

Individuals must be informed of the necessity of processing and its potential impact.

Additional safeguards apply to sensitive-data processing.

Articles 38–40 establish requirements for certain transfers of personal information outside China, including applicable security assessments, certification, or standard contractual mechanisms. Article 40 imposes additional localization and transfer requirements on specified critical information infrastructure operators and personal information processors meeting prescribed thresholds.

D. Data Security Law, 2021, and Cybersecurity Law

The Data Security Law establishes a framework for classifying data according to its importance and managing national-security risks. Its rules may apply to genomic datasets, particularly when they contain important scientific or strategically significant information.

The Cybersecurity Law governs network security and includes data-localization requirements for specified operators. These provisions may affect genomic databases operated through information systems.

Important distinction: Chinese law does not automatically require every genomic database to be stored exclusively within China. Localization and cross-border restrictions depend on the applicable statutory category, operator status, data classification, and transfer rules.

3. Governance and Compliance Requirements

National genomic database governance generally requires institutions to consider the following obligations:

Lawful collection: Obtain appropriate consent and satisfy the applicable human genetic resources and research ethics requirements.

Secure storage: Implement access controls, encryption, cybersecurity measures, and appropriate data-management procedures.

Restricted access: Prevent unauthorized disclosure of identifiable genetic information.

International collaboration: Assess whether foreign participation, access, provision, or transfer triggers human genetic resources approval, filing, or data-security review.

Accountability: Maintain appropriate documentation and respond to regulatory inspections, security incidents, and lawful governmental requests.

The competent authority for human genetic resources administration was transferred from the Ministry of Science and Technology to the National Health Commission under China's institutional reforms in 2024. Other authorities retain responsibilities under their respective data protection, cybersecurity, and biosecurity mandates.

4. Important Cases and Their Legal Significance

A. He Jiankui Case (2019)

The Shenzhen court convicted scientist He Jiankui and two collaborators for illegally conducting human-embryo gene-editing activities involving the birth of gene-edited children. He received a three-year prison sentence and a fine.

Relevance: The case illustrates that genetic research remains subject to ethical oversight, professional qualifications, and legal controls even when conducted in scientific institutions. However, it was not a direct ruling on national genomic database governance or cross-border genetic-data transfers.

B. Lack of Direct Database-Governance Precedents

Publicly reported Chinese judgments specifically addressing national genomic database access, genetic-data localization, or unauthorized transfers under the PIPL are limited. Consequently, it would be misleading to present the He Jiankui case as a direct database precedent or invent a judicial ruling on genomic databases.

The strongest legal analysis therefore relies on the applicable statutes and administrative rules, alongside cases concerning research ethics, privacy, and data security where relevant.

5. Conclusion

China's national genomic database governance is based on overlapping systems of biosecurity, human genetic resources administration, personal information protection, and data security. The framework seeks to balance scientific development with individual privacy and national security. Institutions managing genomic databases must therefore assess not only consent and confidentiality, but also research authorization, international collaboration, data classification, and cross-border transfer restrictions.