1. Introduction

Retention periods for genetic data refer to the legally permitted duration for which governments, hospitals, biotechnology companies, forensic laboratories, research institutions and private organizations may store an individual's genetic information.

Genetic data includes:

DNA profiles and genetic sequences.

Biological samples, including blood, saliva, hair and tissue.

Whole-genome and partial-genome sequencing results.

Genetic information relating to inherited diseases.

Family relationships and ancestry information.

Forensic DNA profiles maintained in criminal databases.

Genetic information collected during medical research and clinical trials.

Genetic information is particularly sensitive because it can reveal not only an individual's identity but also inherited characteristics, potential health conditions and biological relationships with relatives.

The central legal question is:

How long may an organization retain genetic information before it must delete, anonymize, destroy or otherwise cease processing it?

There is no universal retention period applicable to all genetic data. The permissible period depends on the purpose of collection, consent, applicable legislation, public-interest requirements, evidentiary needs and the individual's privacy rights.

The fundamental principle is that genetic data should not be retained indefinitely merely because it was lawfully collected.

2. Legal Principles Governing Retention Periods

A. Purpose limitation

Genetic information must be retained only for the purpose for which it was collected or for another legally authorized purpose.

For example, DNA collected to diagnose a hereditary disease should not automatically be retained for unrelated criminal investigations or commercial genetic profiling.

B. Data minimization

Organizations should retain only the genetic information necessary to achieve a legitimate objective.

A hospital may need to preserve a diagnostic report without retaining every raw sequencing file indefinitely.

C. Storage limitation

The storage-limitation principle requires organizations to establish appropriate retention periods and dispose of personal data when it is no longer necessary.

Under Article 5(1)(e) of the EU General Data Protection Regulation (GDPR), personal data should generally be kept in identifiable form no longer than necessary for its processing purposes.

Genetic data is also expressly classified as a special category of personal data under Article 9 GDPR.

D. Necessity and proportionality

Retention must balance the individual's privacy rights against legitimate public interests, including:

Criminal investigations.

Identification of missing persons.

Medical treatment.

Scientific research.

Public-health protection.

Identification of disaster victims.

A permanent DNA database containing innocent individuals' genetic profiles may raise serious proportionality concerns.

E. Right to deletion

Where applicable legislation provides a right to erasure, individuals may request deletion of genetic information.

However, deletion rights are not absolute. Legal obligations, public-interest purposes, scientific research safeguards and the establishment or defence of legal claims may justify certain exceptions.

3. Retention of Genetic Data Under Indian Law

India provides an important example because genetic information may be collected for forensic identification, medical purposes and scientific research under different legal frameworks.

A. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes general obligations for organizations processing digital personal data.

Although the Act does not create a separate statutory category specifically for genetic data, identifiable genetic information can qualify as personal data.

Section 8(7): Erasure obligation

A Data Fiduciary must erase personal data:

When the individual withdraws consent, where consent is the applicable basis for processing.

When it is reasonable to assume that the specified purpose is no longer being served.

Unless retention is necessary to comply with another applicable law.

Section 12: Right to erasure

An individual may request erasure of personal data, subject to exceptions where retention remains necessary for the specified purpose or compliance with applicable law.

For example, a private genetic-testing company should not retain identifiable genetic information indefinitely after completing a test if there is no continuing lawful purpose for retaining it.

Sources:

IndiaCode+2

B. Criminal Procedure (Identification) Act, 2022

The Criminal Procedure (Identification) Act, 2022 is particularly important for forensic biological information.

Section 2 defines measurements broadly and includes biological samples and their analysis.

Section 4(2): Seventy-five-year retention period

The Act provides for retention of records of measurements in digital or electronic form for 75 years from the date of collection.

However, there is an important exception.

Where a person who has not previously been convicted of an offence punishable with imprisonment is released without trial, discharged or acquitted after exhausting legal remedies, the records must generally be destroyed.

A court or Magistrate may direct otherwise by recording reasons in writing.

This provision is significant because it establishes a long statutory retention period for specified forensic measurement records.

Important distinction: The 75-year period should not be interpreted as a universal retention period for every genetic test, hospital DNA record, ancestry profile or research genome in India. Its application depends on whether the information falls within the statutory forensic-measurement framework.

Source:

IndiaCode+1

C. Constitutional protection under Article 21

Article 21 of the Indian Constitution protects life and personal liberty, including the right to privacy.

The Supreme Court's decision in Justice K.S. Puttaswamy v. Union of India (2017) established privacy as a fundamental right.

The judgment is relevant to genetic-data retention because indefinite storage of genetic information can interfere with informational privacy.

A lawful retention framework should therefore satisfy:

Legality.

Legitimate state purpose.

Necessity.

Proportionality.

Adequate procedural safeguards.

Consequently, government agencies cannot justify unlimited retention merely by arguing that genetic information may become useful in future investigations.

Source:

Indian Kanoon+1

4. Important International Case Laws

The following judgments establish important principles concerning DNA retention, privacy, proportionality and deletion.

Case 1. S. and Marper v. United Kingdom (2008)

Leading authority

Citation: Applications Nos. 30562/04 and 30566/04, European Court of Human Rights, Grand Chamber, 4 December 2008.

Facts:

Two individuals challenged the retention of their fingerprints, cellular samples and DNA profiles after criminal proceedings against them had ended.

One individual had been acquitted, while proceedings against the other had been discontinued.

Despite these outcomes, the police continued retaining their genetic information.

Legal issue:

Whether indefinite retention of DNA profiles and biological samples of individuals who had not been convicted violated Article 8 of the European Convention on Human Rights.

Judgment:

The European Court of Human Rights found a violation of Article 8.

The Court emphasized that:

DNA contains highly sensitive personal information.

Biological samples can reveal considerably more information than identification profiles.

Indefinite retention may interfere with private life.

Blanket retention without meaningful differentiation is disproportionate.

Individuals who have been acquitted should not automatically be treated like convicted offenders.

Legal principle:

Retention of genetic information must be proportionate, purpose-specific and subject to appropriate time limits and safeguards.

Importance:

This judgment is foundational for legislation governing the retention and destruction of forensic DNA records.

Bailii+1

Case 2. Gaughran v. United Kingdom (2020)

Citation: Application No. 45245/15, European Court of Human Rights, 13 February 2020.

Facts:

The applicant had been convicted of a drink-driving offence. Although his conviction subsequently became spent, the police continued retaining his DNA profile, fingerprints and photograph indefinitely.

He challenged the continued retention of this information.

Legal issue:

Whether indefinite retention of DNA profiles and other identifying information, without meaningful review, violated Article 8.

Judgment:

The European Court of Human Rights found a violation of Article 8.

The Court considered the absence of adequate safeguards, particularly:

No meaningful assessment of the need for indefinite retention.

No proper consideration of the seriousness of the offence.

No effective possibility of reviewing the continuing necessity of retention.

The judgment recognized that retaining DNA profiles even after the death of an individual can affect biologically related persons through familial searching.

Legal principle:

Even where an individual has been convicted, indefinite DNA retention requires careful justification and effective safeguards.

Importance:

The decision demonstrates that conviction does not automatically justify permanent retention of genetic information.

Bailii+2

Case 3. Gaughran v. Chief Constable of the Police Service of Northern Ireland (2015)

Citation: [2015] UKSC 29.

Facts:

The applicant challenged the police policy of retaining his DNA profile, fingerprints and photograph indefinitely following his conviction.

Legal issue:

Whether indefinite retention was compatible with the right to private life and proportionality requirements.

Judgment:

The UK Supreme Court allowed the appeal and declared the indefinite retention policy incompatible with Article 8.

The Court emphasized that the usefulness of DNA evidence in criminal investigations does not automatically justify retaining every person's information forever.

Legal principle:

The state must demonstrate a rational connection between the purpose of crime prevention and the particular retention policy.

Importance:

This decision establishes that retention policies must be supported by evidence and proportionality rather than generalized assumptions about future investigative usefulness.

Bailii

Case 4. Maryland v. King (2013)

Citation: 569 U.S. 435 (2013), Supreme Court of the United States.

Facts:

The case concerned the collection of DNA from individuals arrested for certain serious offences under Maryland law.

The DNA profile was used for identification purposes.

Legal issue:

Whether taking DNA samples from qualifying arrestees violated the Fourth Amendment protection against unreasonable searches and seizures.

Judgment:

The US Supreme Court upheld the DNA collection procedure in the circumstances of the case.

However, the Maryland statutory framework also contained provisions concerning destruction of samples when criminal proceedings did not result in conviction or other specified circumstances occurred.

Legal principle:

DNA collection and retention for legitimate identification purposes may be constitutionally permissible, provided the applicable legal framework and safeguards are respected.

Importance:

The judgment demonstrates the need to distinguish between collecting DNA for identification and retaining biological material indefinitely for broader genetic analysis.

LII / Legal Information Institute

Case 5. Selvi v. State of Karnataka (2010)

Citation: (2010) 7 SCC 263, Supreme Court of India.

Facts:

The case concerned the involuntary administration of scientific investigative techniques, including narcoanalysis, polygraph examinations and brain electrical activation profile tests.

Legal issue:

Whether involuntary investigative techniques violated constitutional protections under Articles 20(3) and 21.

Judgment:

The Supreme Court held that involuntary administration of the techniques considered in the case violated constitutional protections.

The Court also discussed DNA profiling and distinguished a DNA profile from the biological sample from which it is generated.

It recognized the evidentiary and identification value of DNA technology while acknowledging the constitutional concerns that may arise from its expanded use.

Legal principle:

Scientific investigative techniques must operate within constitutional protections relating to personal liberty, privacy and compelled testimony.

Importance:

The judgment is relevant to forensic genetic-data governance, although it does not prescribe a general DNA retention period.

Supreme Court

5. Retention Periods Under International Data Protection Frameworks

A. European Union – GDPR

The GDPR establishes strict principles for retaining genetic information.

Relevant provisions include:

Article 9 expressly identifies genetic data as a special category of personal data.

Article 5(1)(e) requires identifiable personal data to be retained no longer than necessary for the relevant purpose.

Importantly, GDPR does not prescribe one universal number of years for retaining genetic data. Retention periods must be determined according to the relevant purpose and applicable legal obligations.

Data Protection Commissioner+1

B. United Kingdom

The United Kingdom's forensic DNA retention framework is influenced by the Protection of Freedoms Act 2012 and amendments to the Police and Criminal Evidence Act 1984.

Different rules apply depending on:

Whether the individual has been convicted.

The seriousness of the offence.

The individual's age.

Whether proceedings resulted in acquittal.

Whether the information consists of a biological sample or a DNA profile.

For example, under the framework discussed in Gaughran, certain DNA samples must generally be destroyed after a profile has been obtained, subject to statutory exceptions.

The distinction between the physical biological sample and the digital DNA profile is particularly important.

Bailii+1

6. Distinction Between Biological Samples and Digital Genetic Profiles

The law should distinguish between different forms of genetic information because they create different privacy risks.

A particularly important legal distinction is between retaining a DNA profile for identification and retaining the original biological sample.

A DNA profile may contain a limited set of identification markers, whereas a biological sample may permit additional testing and extraction of further genetic information.

Therefore, destruction of the original sample does not necessarily mean that the digital DNA profile must also be deleted.

Conversely, retaining a limited identification profile does not automatically authorize indefinite retention of the underlying biological material.

7. Special Legal Problems Associated With Genetic Data Retention

A. Indefinite retention

Indefinite retention creates the risk that genetic information will remain stored even when the original purpose has disappeared.

For example, a person may undergo genetic testing for a medical condition. Ten years later, the organization may still possess the original genome sequence despite having no continuing justification for retaining it.

The principle in S. and Marper is important in assessing this problem.

B. Retention after withdrawal of consent

A patient may withdraw consent for optional genetic research.

The organization must assess whether continued retention is legally justified.

Under the Indian DPDP Act, Section 8(7) generally requires erasure following withdrawal of consent where consent is the relevant processing basis, subject to legally required retention.

C. Retention after death

Genetic data can reveal information about biological relatives even after the individual has died.

For example, a deceased person's DNA profile may be used to identify previously unknown relatives.

The reasoning in Gaughran v. United Kingdom (2020) demonstrates why post-mortem genetic-data retention requires particular consideration.

D. Commercial exploitation after the retention period

Biotechnology companies may retain genetic datasets for commercial research, pharmaceutical development and artificial-intelligence applications.

Problems arise when organizations use old genetic datasets for purposes that were not covered by the original consent or legal authorization.

Retention must not become an indirect method of obtaining unlimited permission for future commercial exploitation.

E. Cross-border retention

Genetic information may be transferred between countries for clinical research, forensic identification or pharmaceutical development.

This creates questions concerning:

Conflicting national retention periods.

Foreign government access.

Data localization requirements.

International research agreements.

Cross-border deletion requests.

Responsibility of overseas data processors.

A transfer to another country should not automatically eliminate the protections applicable to the original data.

8. Institutional Responsibilities for Genetic Data Retention

Different organizations have different legal responsibilities.

A proper retention system should include:

Written retention policies.

Defined storage periods.

Periodic necessity assessments.

Secure destruction procedures.

Anonymization where appropriate.

Access-control mechanisms.

Documentation of deletion.

Independent compliance audits.

9. Emerging Legal Issues

Genetic-data retention creates additional challenges as biotechnology advances.

1. Artificial intelligence and genomic prediction: Old genetic datasets may be used to train predictive systems, raising questions about secondary processing and continuing retention.

2. Predictive genetic information: Genetic data may reveal future disease susceptibility, creating long-term discrimination and confidentiality risks.

3. Familial genetic privacy: Retention of one person's DNA can indirectly expose information about relatives who never consented to the original collection.

4. Synthetic biology: Genetic information may be reused to design biological systems, raising questions about research authorization and data ownership.

5. De-identification: Removing names does not necessarily make genomic information anonymous because genetic information can sometimes be linked back to individuals or relatives.

6. Destruction verification: Organizations must establish whether deletion includes backups, cloud storage, third-party processors and derived identifiable datasets.

10. Suggested Legal Framework for Determining Retention Periods

A comprehensive genetic-data retention framework should classify information according to its purpose.

These are suggested regulatory approaches, not universal statutory deadlines.

A stronger framework would also require periodic independent review of continued retention, especially for sensitive genetic information.

11. Critical Legal Analysis

The principal difficulty in regulating genetic-data retention is balancing individual privacy against legitimate medical, scientific and public-safety interests.

Excessively short retention periods may undermine medical continuity, scientific reproducibility and criminal investigations.

However, excessively long retention periods may create permanent privacy risks, unauthorized genetic profiling and discrimination.

The most important legal distinction is between:

Lawful collection and lawful continued retention.

Physical biological samples and digital DNA profiles.

Medical preservation and commercial exploitation.

Individual genetic privacy and familial genetic privacy.

Temporary research retention and permanent archival storage.

The case law demonstrates that the legality of initial collection does not automatically establish the legality of indefinite storage.

The judgments in S. and Marper and Gaughran are particularly significant because they require governments to justify retention through necessity, proportionality and meaningful safeguards.

12. Conclusion

Retention periods for genetic data are an essential component of modern biotechnology law, privacy law and forensic regulation.

The Indian DPDP Act, 2023 establishes general erasure obligations, while the Criminal Procedure (Identification) Act, 2022 provides a specific 75-year retention framework for covered forensic measurement records.

Internationally, the GDPR establishes storage limitation and special protection for genetic information.

The judgments in S. and Marper v. United Kingdom (2008), Gaughran v. United Kingdom (2020), Maryland v. King (2013) and Selvi v. State of Karnataka (2010) illustrate the constitutional and legal challenges associated with genetic-data collection and continued retention.

Ultimately, genetic information should be retained only for a legally justified period, with appropriate safeguards, transparent policies and effective mechanisms for deletion or destruction.

13. Important Case Law Revision Table

Research note: These cases do not all establish specific retention periods. Some provide constitutional principles relevant to determining whether retention is lawful. The distinction is important when using them in academic or judicial research.

For a further research project, I can develop this topic into an 800–1,000-word comparative legal analysis of India, Australia, the UK, the EU and the USA, with statutory provisions and additional case laws.