Authored By: Shreya Sahu
National Law Institute University, Bhopal
INTRODUCTION
A person’s genes carry information about them that they may not even know themselves yet: a disease that hasn’t shown up, a condition that might never develop, or something about a relative who was never tested. Genetic testing has become cheap and common enough that the real question is no longer just who gets to see this data. It’s what happens to a person once someone else has seen it.
That second problem is harder to notice. A person can hand over genetic information lawfully and still have it resurface years later in a decision about a job, an insurance policy, or something else entirely. Nothing about the collection was wrong; the harm sits in what came after, and Indian law has very little to say about that part.
It isn’t as though India has done nothing. Constitutional guarantees of privacy and equality, the Digital Personal Data Protection Act, 2023, and a handful of sector-specific rules each address a piece of this. But none of these pieces meet each other. Privacy law worries about how information is gathered and processed; equality law worries about unfair treatment once it happens. What falls between the two genetic information obtained legally, then used as grounds for treating someone worse has no real home in either.
This article argues that closing this gap doesn’t require turning every instance of genetic discrimination into a crime. It requires a layered response instead: privacy safeguards at the foundation, civil and regulatory remedies for ordinary cases, and a narrowly defined criminal offence held in reserve for deliberate, knowing discrimination where the stakes are highest.
THE EXISTING LEGAL FRAMEWORK
Constitutional Protection: Equality, Dignity, Privacy
Article 14 does more work here than it might first appear to. Courts have moved past the idea that discrimination only counts when someone says the discriminatory thing out loud and increasingly look at arbitrariness and substantive unfairness instead. No employer is going to tell a candidate they were rejected because of a genetic marker; what happens is subtler: the information quietly shapes a decision dressed up as an ordinary judgment about fitness or risk. Article 14 at least gives a foothold for questioning decisions of that kind. Article 15 is narrower and doesn’t list genetic traits as a protected ground, but that silence doesn’t take genetic discrimination out of reach.
Article 21 is where the privacy argument really lives. In Justice K.S. Puttaswamy (Retd.) v Union of India, the Supreme Court recognized privacy, including informational privacy, as protected under Article 21, and held that any interference must clear three hurdles: legality, a legitimate aim, and proportionality.[1]A decision-maker cannot simply point to a statistical association between a gene and some future risk and treat it as sufficient justification; the link to the specific decision must still hold up on its own.
Selvi v State of Karnataka dealt with narcoanalysis and polygraph testing rather than genetics, but the reasoning still matters: extracting personal information without consent engages both liberty and privacy.[2]Genetic information raises a sharper version of this problem, since a single test reveals not just facts about the person tested but predictive and familial information about relatives who were never asked at all. Even so, someone can consent to a genetic test entirely lawfully, and the result can still be turned against them later. Privacy law governs how information is handled; equality law governs what’s legitimately done with it once it exists, and that gap is exactly where genetic discrimination becomes hardest to address, one Indian law currently leaves empty.
Data Protection and Sector-Specific Regulation
The Digital Personal Data Protection Act, 2023 (DPDP Act) governs how digital personal data is collected and processed and places obligations on data fiduciaries,[3] but it’s silent on what happens once genetic information is used to justify a discriminatory decision. An employer could collect and store an applicant’s genetic information entirely within the rules and still reject that applicant years later because a test flagged a possible future illness; the storage broke no rule; the unfairness lies entirely in the decision that followed.
Insurance has seen some sector-specific movement, discussed below, but employment and education remain without any general rule against decisions made on genetic grounds. Nor does the Rights of Persons with Disabilities Act, 2016 fill this hole; it protects against discrimination on the ground of an existing disability, but a person carrying a marker for a future condition may be perfectly healthy today.[4] Taken together, this isn’t really an absence of protection so much as a mismatch between two kinds of it, one for the information and another for what gets done with it. India has made real progress on the first; the second has barely been touched.
III. CASE LAW AND THE INDIAN GAP
Puttaswamy and Selvi are both relevant, though neither deals with genetic discrimination directly. Together they establish that genetic data isn’t just another category of personal information, since it exposes present health, future risk, and facts about relatives all at once, but it would overstate what either case decided to treat them as already providing a remedy to someone who loses a job or a benefit because of their genes. They lay constitutional groundwork; they don’t resolve what happens once information is used unfairly.
The closest Indian authority is United India Insurance Co Ltd v Jai Prakash Tayal.[5] The case arose from a claim for hypertrophic obstructive cardiomyopathy, where the insurer relied on a policy exclusion for “genetic disorders,” despite having paid claims for the same condition before. The Delhi High Court found the exclusion too sweeping to be read literally; it could capture ordinary conditions like diabetes and hypertension, and held it arbitrary under Article 14, directing the regulator to examine similar clauses.[6] What makes Tayal worth noting is that the Court didn’t treat the dispute as purely contractual, recognizing that relying on a genetic classification to decide who gets insurance raises a real equality concern, and flagging the broader absence of any framework on genetic discrimination. That said, the judgment must be read carefully; it was challenged before the Supreme Court, which stayed part of it and directed that IRDAI be added as a party.[7] It isn’t, at this point, a settled or nationwide rule.
Some regulatory follow-through has occurred since, with IRDAI examining “genetic disorder” exclusions in health insurance,[8] but this only reinforces the point: protection has developed in one sector, under one regulator, rather than as a general principle.
The greater difficulty is that genetic discrimination rarely announces itself as discrimination. There’s usually no written rule excluding a trait, just a quiet influence on a judgment about health, reliability, or future risk, buried inside a decision that looks neutral. By the time a person suspects their genes play a role, proving it is close to impossible. Indian law protects genetic information to some degree; it doesn’t yet protect people from what that information is used to justify.
COMPARATIVE PERSPECTIVES
The United States addresses the problem closer to its source. GINA, passed in 2008, restricts how employers and health insurers may use genetic information and limits when they can obtain it at all,[9]sensible, given how hard it is to prove influence after a decision is made. Its reach, though, is narrow: employment and health insurance only, and it assumes an employer-employee relationship a large share of India’s workforce doesn’t fit into.
France goes further, treating genetic discrimination as potentially criminal. Its Penal Code lists genetic characteristics among prohibited grounds, and specified refusals in employment and in the provision of goods and services can attract criminal liability.[10]What matters here is less the drafting and more the message: serious genetic discrimination is harmful enough to justify punishment, not merely a data-protection lapse worth a fine. India shouldn’t import this wholesale, though criminal law needs sharply defined edges, with room for medical decisions and approved research to fall outside it.
The EU takes yet another emphasis, protecting the information itself rather than policing how it’s used. Under the GDPR, genetic data sits in a special category subject to stricter processing conditions.[11] That’s a useful reminder that genetic information isn’t ordinary personal data, but tightening data protection alone doesn’t touch the problem here: once an employer lawfully holds someone’s genetic information and later uses it to that person’s disadvantage, the question is no longer whether the data was processed correctly.
Each jurisdiction captures a different piece of the same puzzle: the US limits access before the fact, France treats deliberate discrimination as criminal, the EU treats the information as unusually sensitive. India’s answer probably lies in combining elements of all three within its own constitutional structure.
PROPOSAL: A THREE-TIER FRAMEWORK
Bolting one more clause onto the DPDP Act won’t fix this. Genetic discrimination arises at different points: sometimes the information should never have been collected at all, sometimes it’s collected legitimately and misused only later, and occasionally it’s used deliberately to exclude someone. A single provision can’t reach all three, which is why this article proposes three tiers operating together.
Tier One: protect the information itself.
Genetic data should carry safeguards proportionate to its risks, broadly along the lines of the GDPR’s special-category treatment.[12]Consent needs to mean more than a signature on a form; permission given to a hospital for treatment shouldn’t automatically stretch to cover an employer or insurer years down the line. Institutions holding this information should record why it was collected, who has access, how long it’s kept, and whether it can lawfully be used beyond its original purpose.
Tier Two: address the decision, not merely the breach.
This is where privacy law runs out of road. Parliament should introduce a statutory prohibition covering employment, insurance, education, and other high-impact goods and services, focused on the actual effect of a decision rather than requiring proof that a decision-maker openly admitted to relying on genetics. The test: whether genetic information was a motivating factor behind the adverse decision, broad enough to catch the half-hidden forms this discrimination usually takes.
A simple procedural rule would help where an institution has obtained a person’s genetic information and later makes an adverse decision affecting that person, it should have to give a written explanation, once challenged, naming the actual factors relied on, not a vague placeholder like “not suitable.” This wouldn’t make every adverse decision unlawful; it would just stop an institution sitting on the one piece of evidence that matters. The burden of proof would still rest with the claimant. There should be practical remedies: compensation, orders against continued discrimination, reinstatement where appropriate, regulatory penalties for repeat conduct.
Tier Three: reserve criminal law for cases that genuinely cross a line.
This should sit at the top of the framework, not its center. The offence would apply only where someone knowingly and intentionally used genetic information as a motivating factor behind a prohibited outcome, in a clearly defined high-impact setting. The prosecution would have to establish, beyond reasonable doubt, access to the information, knowledge of what it revealed, deliberate use of it, and the absence of any lawful justification.
That threshold is deliberately high. Doctors need genetic information to treat patients, researchers need it for approved studies, and legislation may reasonably permit narrow risk assessment, so the law must separate all this from deliberate exclusion, with the burden of disproving a statutory justification falling on the prosecution rather than the accused. Whether the offence sits inside the Bharatiya Nyaya Sanhita, 2023 or a standalone statute is secondary; a separate statute probably offers more flexibility, since this offence doesn’t map cleanly onto any existing category of crime.
Making this work in practice.
The hard part was never defining what genetic discrimination is; it’s proving what happened behind a decision already made. Take a job applicant rejected shortly after an employer learns of a genetic predisposition, told only that another candidate was “better suited.” That applicant, as things stand, has almost no way to test whether this is true. Under the framework proposed here, the employer would have to preserve records and give a documented explanation once challenged. If that explanation shifts over time, or ignores that genetic information was already in hand, it becomes evidence supporting a civil claim, not proof by itself, but enough to let the dispute be properly examined.
Is a narrow criminal tier too weak to matter?
The obvious objection is that proving knowledge and intent beyond reasonable doubt is genuinely hard, and institutions will simply hide behind neutral-sounding justifications instead. There’s something to that, but the answer isn’t to lower the criminal threshold; doing so risks making ordinary medical decisions and legitimate research legally dangerous. It’s better to make Tier Two hard to evade than Tier Three easy to invoke: record-keeping duties, mandatory written reasons, and regulatory penalties create real day-to-day pressure to comply, without turning every disputed decision into a criminal trial. Criminal law’s job here is narrower: marking out conduct where someone deliberately used another person’s genetic information against them, with no legitimate basis for it.
CONCLUSION
India isn’t starting from a blank page. The Constitution, the DPDP Act, and various sector-specific rules already cover real ground. What none of them do is meet at the exact point where genetic information gets used to decide something about a person’s life. The law protects the information reasonably well; it has much less to say about what happens once that information is turned against the person who provided it.
That’s precisely why criminalizing every instance of misuse would be the wrong response. Most misuse of genetic information doesn’t call for a criminal offence, particularly where it serves a genuine medical, scientific, or legally recognized purpose. What’s needed is a graduated response: data-protection rules to prevent unnecessary access, civil and regulatory remedies backed by a workable causation standard for ordinary cases of discriminatory use, and criminal liability held back for cases where someone knowingly and intentionally discriminates in a high-impact setting such as employment or insurance.
The comparative picture makes clear that India doesn’t have to choose between protecting information and protecting people. The US shows how to limit unnecessary access, France shows deliberate discrimination can justify criminal consequences, and the EU shows why genetic data deserves special handling. India can draw on pieces of all three without adopting any of them in full.
A law against genetic discrimination isn’t meant to stop people from using genetic information; that information saves lives, improves treatment, and drives research forward. The problem begins the moment information about someone’s biological possibilities becomes a reason to limit their present opportunities. As genetic testing becomes routine, Indian law needs to stop asking only who may hold this information and start asking the harder question underneath it: when does using it against a person become discrimination?
REFERENCE(S):
Cases
Justice K.S. Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.
Selvi v State of Karnataka (2010) 7 SCC 263.
United India Insurance Co Ltd v Jai Prakash Tayal, 2018 SCC OnLine Del 7415.
United India Insurance Co Ltd v Jai Prakash Tayal, SLP(C) No 19767 of 2018 (order dated 27 August 2018).
Legislation and International Instruments
Bharatiya Nyaya Sanhita 2023 (India).
Constitution of India 1950.
Digital Personal Data Protection Act 2023 (India).
Digital Personal Data Protection Rules 2025 (India).
Genetic Information Nondiscrimination Act of 2008, Pub L No 110-233, 122 Stat 881, 42 USC § 2000ff et seq.
General Data Protection Regulation (EU) 2016/679.
Rights of Persons with Disabilities Act 2016 (India).
Code pénal (Fr), arts 225-1–225-2.
Convention for the Protection of Human Rights and Dignity of the Human Being about the Application of Biology and Medicine, art 11, 4 April 1997.
Official and Secondary Materials
Insurance Regulatory and Development Authority of India, circular on exclusionary clauses relating to genetic disorders, issued following United India Insurance Co Ltd v Jai Prakash Tayal (2018).
Ministry of Electronics and Information Technology, Government of India, notification of the Digital Personal Data Protection Rules 2025.
Council of Europe, Explanatory Report to the Convention on Human Rights and Biomedicine.
[1] Justice K.S. Puttaswamy (Retd) v Union of India (2017) 10 SCC 1 (Chandrachud J, for four judges), applying a three-fold test of legality, legitimate aim, and proportionality to any invasion of the right to privacy under Article 21.
[2] Selvi v State of Karnataka (2010) 7 SCC 263.
[3] Digital Personal Data Protection Act 2023 (India).
[4] Rights of Persons with Disabilities Act 2016 (India).
[5] United India Insurance Co Ltd v Jai Prakash Tayal, 2018 SCC OnLine Del 7415 (Pratibha M Singh J).
[6] United India Insurance Co Ltd v Jai Prakash Tayal, SLP(C) No 19767 of 2018, order dated 27 August 2018 (partially staying the Delhi High Court’s judgment and directing that the Insurance Regulatory and Development Authority of India be impleaded as a respondent).
[7] Insurance Regulatory and Development Authority of India, circular directing insurers not to reject health-insurance claims solely based on exclusions relating to ‘genetic disorders’, issued following the Delhi High Court’s direction in Tayal (2018).
[8] Genetic Information Nondiscrimination Act of 2008, Pub L No 110-233, 122 Stat 881, codified at 42 USC § 2000ff et seq.
[9] Code pénal (Fr) art 225-1.
[10] Code pénal (Fr) art 225-2.
[11] General Data Protection Regulation (EU) 2016/679, art 9.
[12] Convention for the Protection of Human Rights and Dignity of the Human Being about the Application of Biology and Medicine, art 11, 4 April 1997.
