ABSTRACT
“The most valuable thing in the twenty-first century may no longer be oil, it may be data. But among all forms of data, none is more personal, permanent, or powerful than the human genome.“
Direct-to-Consumer DNA ancestry testing has fundamentally transformed genetic information from a clinical resource into a consumer commodity you can buy for the price of a nice dinner. Companies such as 23andMe, Ancestry DNA, My Heritage and India’s own Mapmygenome promise consumers insights into their ancestry, ethnicity, and inherited traits in exchange for a tube of saliva. Behind this seemingly harmless exchange, however, lies one of the most valuable datasets in existence-the human genome. Commercial DNA testing raises novel legal questions concerning ownership, consent, genetic discrimination, cross-border data transfers, constitutional privacy and so on. India has made significant strides in recognising and protecting the right to privacy through the landmark Puttaswamy judgment and the Digital Personal Data Protection Act, 2023.[1] India’s one serious attempt at a DNA-specific legislation, the DNA Technology (Use and Application) Regulation Bill, built for police investigations, was withdrawn from Parliament in 2023.[2] However, none of these deal with commercial DNA testing. This article examines that regulatory vacuum, argues that genetic data requires legal treatment distinct from conventional personal data, analyses emerging challenges, draws lessons through comparative international approaches, and proposes the outline of an Indian Genetic Information Protection framework.
Keywords –Direct-to-Consumer DNA Testing; DNA Ancestry testing; Genetic privacy; Genetic Information Protection; Indian Data Protection Law.
INTRODUCTION
Imagine you order a DNA ancestry kit online. A week after spitting into a tube and mailing it off, a glossy report arrives: your ancestors migrated from Central Asia, you have distant cousins in South Africa, and there’s a genetic reason why you can’t stand peanuts.
The transaction appears completed. Or is it?
What happens to your saliva sample after the report is generated?
In India, the honest answer is that nobody has bothered to say.
Over years, Direct-to-Consumer DNA testing has evolved into a billion-dollar global industry. The global DTC genetic testing market was valued at approximately USD 2.3 billion in 2025 and is projected to reach nearly USD 6.8 billion by 2033, growing at a compound annual growth rate (CAGR) of around 14%.[3] While the Indian market is still in its early stages, companies such as MapmyGenome and Xcode Life Sciences have expanded into ancestry, nutrigenomics, and preventive health services, with industry reports identifying the Asia-Pacific region as one of the fastest-growing markets for consumer genetic testing.[4]This growth has transformed DNA into a valuable commercial asset. But there are no laws so as to regulate these companies, which is key issue faced in India.
DISTINCTIVE FEATURES OF HUMAN GENETIC DATA
DNA is permanent: DNA (deoxyribonucleic acid) is the hereditary material in humans and almost all other organisms. Nearly every cell in a person’s body has the same DNA.With very limited exceptions (such as certain immune cells or rare mutations), an individual’s nuclear DNA sequence remains substantially stable and unchanged throughout their lifetime.[5]
DNA is predictive: A genetic test can flag inherited risk for cancer, cardiovascular disease, or neurological conditions years before any symptom shows up.
DNA is relational and not individual: Submitting a saliva sample may unintentionally disclose sensitive genetic information concerning siblings, parents, children, or extended family members who have never consented to testing. This makes DNA different from individual privacy and is based on the assumption that no person holds genetic identity in isolation.
These distinctive characteristics distinguish genetic data from ordinary personal information. When DNA moves from clinical settings into the commercial marketplace, these features create unique legal challenges that India’s current framework, centred on the DPDP Act and general privacy principles, is ill-equipped to address.
[1]Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1; see also Digital Personal Data Protection Act 2023 (No 22 of 2023).
[2]MohanaBasu, ‘What’s in DNA Technology Bill Withdrawn by Modi Govt& Why House Panel Wanted Safeguards in Place’ ThePrint (25 July 2023) https://theprint.in/india/governance/whats-in-dna-technology-bill-withdrawn-by-modi-govt-why-house-panel-wanted-safeguards-in-place/1685328/ accessed 15 July 2026.
[3]Grand View Research, ‘Direct-to-Consumer Genetic Testing Market Size, Growth Report, 2026-2033’ (15 June 2026) https://www.grandviewresearch.com/industry-analysis/direct-to-consumer-genetic-testing-market-report accessed 15 July 2026.
[4]Ibid
[5]National Human Genome Research Institute, ‘DNA, Genes and Chromosomes’ (Fact Sheet, 2024) https://www.genome.gov/about-genomics/fact-sheets/DNA-Genes-Chromosomes accessed 17 July 2026.