Medical Oncologist
CION Cancer Clinics
Your genetic data and India's data protection law | CION Cancer Clinics
India's Digital Personal Data Protection Act 2023 gives you rights over your genetic data once it is held in digital form. You can ask what is held, withdraw consent and ask for data to be corrected or erased. The Act does not treat genetic data as a special category, and many duties are still coming into force. This page explains what that means for a genetic test report. At CION Cancer Clinics, our team helps carriers and their families plan checks, next steps and support after a genetic result.
NG
Medically reviewed by Dr. Naresh GunduConsultant Medical Oncologist · MBBS, DNB (Internal Medicine), DM (Medical Oncology, AIIMS) · last reviewed September 2026, next review due September 2027
17+specialists on panel
15,000+patients treated
35+centres across Telangana & AP
4.8★ / 800+Google rating
On this page
- Does the DPDP Act protect my genetic test result?
- What rights does the Act give me over my genetic data?
- What happens to my genetic data, step by step, under the Act?
- The words you will meet in the Act
- What the Act covers, and what it leaves out
- Four things people assume about the DPDP Act
- What this page cannot tell you
- Common questions about genetic data and the DPDP Act
The short answer
Does the DPDP Act protect my genetic test result?
Yes, as personal data. Once your result is held digitally by a laboratory, hospital or company, the Digital Personal Data Protection Act 2023 applies to it. The organisation needs a lawful basis to use it, usually your consent, and must keep it secure.
What the Act does not do
It does not give genetic or health data extra protection. Earlier drafts of the law had a stricter category for sensitive data that included genetic data. The final Act dropped it, so your genetic result is treated in the same way as your other personal data.
When it applies in full
The government notified the rules under the Act in November 2025. Some parts took effect straight away, and most duties on organisations phase in over the following eighteen months. Until then, medical confidentiality and the older IT rules still carry much of the weight.
The Act protects how your data is handled. It says nothing about what your result means.Your rights
What rights does the Act give me over my genetic data?
Four rights matter most when a laboratory holds your genetic report.
To be told
Before collecting your data, an organisation must give a notice saying what it will collect, why, and how you can use your rights. You can ask for that notice in English or in any language listed in the Constitution, which includes Telugu.
To withdraw consent
You can withdraw at any time, and it should be as easy as giving consent was. Withdrawing stops future use. It does not undo lawful use already made.
To see and correct
You can ask for a summary of the data held about you and who it has been shared with, and ask for mistakes to be corrected or for data to be erased when it is no longer needed.
To complain and to nominate
You complain to the organisation first. If that fails, you can go to the Data Protection Board of India. You can also name someone to use your rights if you die or cannot act.
Keep a record of
- The notice and consent you were given
- Every request you send, and the date
Not sure whether this applies to you?
Ask an oncologistFrom sample to deletion
What happens to my genetic data, step by step, under the Act?
-
Notice and consent
Before the test, the laboratory or hospital explains what it will do with your sample and data. Your consent should be free, specific to that purpose and given by a clear action.
-
Use for that purpose
The data may be used for your test and your care. Using it for something unrelated, such as marketing, needs fresh consent.
-
Security and breach notice
The organisation must protect the data with reasonable safeguards. If a breach happens, it must tell the Data Protection Board and each person affected.
-
Erasure when no longer needed
Once the purpose is served and no law requires the data to be kept, it should be erased. Medical records often must be kept for a set time, so erasure is not always immediate.
-
Research is treated differently
Much of the Act steps back for research and statistics where the data is not used to make decisions about you, provided set standards are met. Research consent forms and ethics committees do most of the protecting there.
In the Act
The words you will meet in the Act
- Data principal
- You, the person the data is about. For a child under eighteen, a parent or lawful guardian acts for them.
- Data fiduciary
- The organisation that decides why and how your data is used, such as a laboratory, hospital or app company.
- Data processor
- An organisation that handles data on the fiduciary's behalf, such as a cloud company storing results.
- Consent manager
- A registered platform through which you can give, review and withdraw consent in one place.
- Personal data breach
- Any unauthorised access, sharing, loss or destruction of your data that puts it at risk.
- Data Protection Board of India
- The body set up under the Act to hear complaints and impose penalties.
Leave a number, we will call you
One field. No form to fill in, and no charge for the call.
Side by side
What the Act covers, and what it leaves out
Covered
Not covered, or not settled
Digital genetic reports held by labs and hospitals
Paper records that are never digitised
Your rights to access, correct and erase
A special, higher category for genetic data
Consumer DNA companies serving people in India
Clear protection from insurance or job discrimination
Breach notices to you and to the Board
Much research use, if set standards are met
Consent for children, through a parent
Data you have made public yourself
Commonly believed
Four things people assume about the DPDP Act
"The DPDP Act stops insurers using my genetic result."
It governs how data is handled, not whether an insurer may consider a result you disclose. Insurance questions fall under insurance law and IRDAI rules, which our page on genetic testing and insurance explains.
"My data can never leave India."
The Act allows transfers abroad except to countries the government restricts by notification. Separate rules on sending biological samples abroad may also apply.
"Withdrawing consent deletes everything instantly."
Withdrawal stops further use and should lead to erasure, but data the law requires to be kept, such as some medical records, may stay. Ask in writing what will be deleted and what must remain.
"The Act already protects me in full today."
The rules were notified in November 2025, and most duties phase in over time. Some protections are live now and others are still coming. Check the current position before relying on a particular right.
Being straight with you
What this page cannot tell you
It cannot give you legal advice on a particular dispute. Whether an organisation broke the Act depends on its notice, your consent, the dates involved and which parts of the law were in force at the time. A lawyer who works in data protection can judge that properly.
It cannot interpret your genetic result
The Act protects the data. It says nothing about what the data means. What your specific variant means is a question for the counsellor who ordered the test.
Who this does not apply to
If your test was done on paper and never entered into a computer system, the Act may not reach it, though medical confidentiality still does. Tumour testing reports are personal data too, but the clinical questions about them are covered under targeted therapy. For most families the practical step is simpler than the law: keep your report private and share it on purpose.
Questions we are asked
Common questions about genetic data and the DPDP Act
Is genetic data sensitive personal data under Indian law?
Not as a separate legal category under the DPDP Act 2023. It is treated like other personal data. Earlier drafts of the law had a sensitive category that included genetic data, but it was not kept in the final Act.
How do I ask a laboratory what data it holds about me?
Write to the contact named in the laboratory's notice or privacy policy. Ask for a summary of your data, how it has been used and who it has been shared with. Keep a copy of your request and note the date you sent it.
Can I get my genetic data deleted?
You can withdraw consent and ask for erasure. The organisation must erase data it no longer needs unless a law requires it to be kept. Medical records often must be kept for a set time, so ask which parts can be deleted and which cannot.
What happens if there is a data breach?
The organisation must inform the Data Protection Board and each affected person. The notice should say what happened, the likely effect and what you can do. If you receive one, change passwords linked to the account and watch for misuse.
Can someone act for me if I cannot?
Yes. The Act lets you nominate a person to use your rights if you die or become unable to act. It is sensible to name someone in the family, especially if your data sits with a consumer company.
Does the Act apply to foreign DNA companies?
It applies to processing outside India when it is connected to offering goods or services to people in India. Enforcing it against a company based abroad may be harder in practice, and that has barely been tested.
What can the Data Protection Board do?
It hears complaints once you have used the organisation's own grievance process, and it can direct steps to limit harm and impose large financial penalties. It does not award you compensation in the way a court might.
Do I have duties under the Act as well?
A few. You must not file false or frivolous complaints, must not pretend to be someone else, and must give accurate information when asking for a correction. Breaking these duties can lead to a penalty.
Your Specialists
Meet CION's oncologists. Bring your family history or genetic report to them.
Our medical oncologists see people with a strong family history of cancer, arrange genetic counselling and testing where it fits, and plan the checks that follow.
Medical Oncologist
Dr. C. Raghavendra Reddy
MBBS(Gold Medal), DNB(General Medicine), DM(Medical Oncology)(Gold Medal)
Medical Oncologist
Dr. Bharati Devi Gorantla
MBBS, MD(General Medicine), DM(Medical Oncology)(Adyar,Chennai), ECMO, MRCP SCE(UK)
Medical Oncologist
Dr. Owais Mohammed
MBBS, MD (General Medicine), DrNB (Medical Oncology), ECMO, MRCP SCE (Medical Oncology) (UK)
Medical Oncologist
Medical Oncologist
Want a specific doctor for your case? Mention them when booking.
Book Free ConsultationBook an appointment with our specialist
Share your name and number — we'll call you back within 30 minutes to schedule your consultation.
Sources
- Ministry of Electronics and Information Technology — The Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
- Press Information Bureau — Digital Personal Data Protection (DPDP) Rules, 2025
- Indian Council of Medical Research — National Ethical Guidelines for Biomedical and Health Research Involving Human Participants, 2017
- National Cancer Institute — Genetic Testing for Inherited Cancer Susceptibility Syndromes
This page is general information, not a prescription. Do not change or stop any treatment based on what you read here. If anything is worrying you, contact your own treating team — or call our helpline and we will help you reach the right specialist.
Keep reading
Related pages
Who can see your genetic result?Everyone who may handle your report, and who may notGenetic data and direct-to-consumer companiesWhat DNA kit companies can do with your dataSample storage, destruction and withdrawalWhat happens to the physical sample, not just the dataIs there an Indian equivalent of GINA?Why data protection is not the same as protection from discrimination
Talk to us
Want to know who will hold your genetic data?
Ask us before you test. A counsellor can explain where your sample goes, who sees the report and how to raise a concern about your data. One helpline serves every CION centre.