Beyond Consent: Ensuring Meaningful Protection of Genetic Data Under India’s Digital Personal Data Protection Act, 2023

India’s Digital Personal Data Protection Act (DPDPA) adopts a notice-and-consent-based framework for data protection; it treats all personal data, including genetic data, as a singular category without accounting for its unique characteristics. Unlike ordinary personal data, genetic data is inherently relational; it reveals information not just about an individual but also their biological relatives. Moreover, the risks associated with the processing of genetic data extend beyond identifiability, such as the potential for its misuse in law enforcement or to discriminate in matters of employment or insurance. Despite these concerns, the DPDPA fails to offer a nuanced regulatory approach, lacks a clear definition of genetic data, and does not impose heightened safeguards for its processing. This article identifies the limitations of the DPDPA’s notice-and-consent-based model in regulating genetic data processing and argues for a shift toward a harm-based framework. It proposes key reforms, such as the classification of genetic data into categories based on sensitivity, an expanded definition of the data principal to include affected blood relatives, and risk-based processing guidelines that categorize genetic data processing into prohibited, high-risk, medium-risk, and low-risk processing. Additionally, this article advocates for stronger privacy by design and by default requirements, mandatory data protection impact assessments (DPIAs), and the introduction of rights such as data portability and right to restrict processing. Further, to ensure effective enforcement, it recommends strengthening grievance redressal mechanisms, introducing compensation for privacy harms, and imposing proportionate criminal liability for negligent handling of sensitive genetic data. By addressing these gaps, this article underscores the need for a strong legal framework that moves beyond notice and consent to provide meaningful privacy protections for genetic data in India’s evolving digital landscape.