Jump to content

Neural Data

From Justice Definitions

WHAT IS NEURAL DATA

The term "neural data" refers to the information generated by measuring, recording, processing, and analyzing activity of the human nervous system. In brief, this is the data about how the brain, spinal cord, or peripheral nerves are functioning, in an overall large data body. This include raw EEG signals, fMRI scans, ECoG recordings, deep-brain stimulation data, peripheral nerve signals, EMG readings, brain-computer interface commands, and the AI-generated inferences about attention, emotion, cognitive load, stress, or intention.

Neural data includes special and ethical attention because it sits near to the inner life of a person. Contrasting to the nature of ordinary behavioral data, neural data helps in revealing or inferring the mental state that individual has subconsciously chosen to disclose.

The fingerprint of the individual provides a brief description about the person; neural data might reveal something about what a person is identifying, remembering, feeling, or attempting to do. The neural data is formally recognized not just as a subset of personal data, but in a different category that implicates mental privacy, cognitive liberty, human dignity, and personal autonomy this is by leading international instruments and academic scholarship[1]. According to the OECD Recommendation on Responsible Innovation in Neurotechnology (2019), it explicitly states that "close connection of the brain and cognition to human identity" as the foundational rationale for special governance of neural data[2]. The UNESCO Recommendation on the Ethics of Neurotechnology, adopted at the 43rd session of the General Conference in November 2025[3], it provides the first complete and comprehensive global rights-based framework for the entire lifecycle of neurotechnology, expressly mandating the protection of mental privacy, transparency, consent, and the safeguarding of vulnerable groups.

In the academic writings Marcello Ienca and Roberto Andorno (2017) say that current human rights systems are not good enough to handle the dangers from neurotechnology. They suggest four neurorights": the right to cognitive freedom, the right to mental privacy, the right to mental safety and the right to psychological continuity. This work has been turned into law: in October 2021 Chile was the country in the world to change its Constitution. The new law says that technology must respect peoples body and mind. It also says that brain activity and the information from it must have protection[4]. The Neurorights Foundation, started by a scientist from Columbia University named Rafael Yuste creates five neurorights. These neurorights are privacy, mental identity, free will, fair access to mental augmentation and protection, from algorithmic bias. These five neurorights are the rules that guide how neural data is handled around the world[5].

OFFICIAL DEFINITIONS OF NEURAL DATA

Statutory Definitions

India currently does not have a definition for "neural data," "brain data," "neurodata," or "cognitive biometric data" in any law that has been passed[6]. The Digital Personal Data Protection Act of 2023 ("DPDP Act") does not clearly. List neural data as a separate type[7]. The closest reference in the law is the definition of " data" in Section 2(t) which says: "personal data means any data about an individual who is identifiable by or in relation to such data."[8] This definition covers any data that comes from or relates to an identifiable person, such, as a raw EEG recording a BCI command log, a neurodiagnostic report or an AI-generated cognitive-state profile.

The rules we have now which are called the Information Technology Rules were made in 2011. These rules are also known as the SPDI Rules. They were created using the Information Technology Act from the year 2000. The SPDI Rules say what "sensitive personal data or information" means. This is explained in Rule 3. It includes things like a persons condition. This is mentioned in Rule 3 part 6[9]. The idea of condition is pretty wide. It covers things like brain signals, such, as EEG, fMRI. Ecog. It also covers bodily signals, like heart rate and galvanic skin reaction.. It does not specifically mention the term "neural data" which refers to the Information Technology Rules and the concept of sensitive personal data or information[10].

The Mental Healthcare Act of 2017 does not say what "neural data" is,. It does say that the Mental Healthcare Act of 2017 has to keep mental health records secret. The Mental Healthcare Act of 2017 has a section, Section 23 that says every person with a disease has the right to keep their mental illness and treatment private[11]. The Mental Healthcare Act of 2017 also has a Section 24 that limits who can see this information. When the Mental Healthcare Act of 2017 is talking about brain data that is related to an neurological diagnosis the Mental Healthcare Act of 2017 says that these rules about keeping things secret apply and they are in addition, to the rules that already exist to protect data.

The Rights of Persons with Disabilities Act of 2016 ("RPwD Act") does not define brain data, but it is directly applicable when neural data is acquired from or processed in regard to a person with a disability. Section 2(s) defines "person with disability" using person-first terminology: "a person with long term physical, mental, intellectual or sensory impairment which, in interaction with barriers, hinders his full and effective participation in society equally with others."[12] All references in this article use the person-first formulation in accordance with the RPwD Act and the United Nations Convention on the Rights of Persons with Disabilities, which India adopted on October 1, 2007[13].

The Medical Equipment Rules of 2017 do not explain what " data" means but do say that equipment that can create it is limited. Rule 2(1)(ta) gives a definition of " device" in line, with the Drugs and Cosmetics Act of 1940. The way it is grouped depends on how it's meant to be used how invasive it is and how dangerous it could be.[14] A clinical EEG system, a neurostimulator or a BCI device made for medical use could be considered a medical device that is controlled by these rules. However saying that every neural device is automatically part of a class of medical device is not correct. The right way to handle it requires looking at the devices intended use how invasive it is, the level of risk and the specific rules that apply to it[15].

Legal Provisions Conceptually Relating to Neural Data

The DPDP Act, 2023

The DPDP Act got approval from the President on August 11 2023. It was published in the Gazette of India on the same day. The DPDP Act says that it will start working on a date that the Central Government decides and they can choose dates for different parts of the DPDP Act. The Central Government gave a notice to start the DPDP Act on November 13 2025[16]. As of July 2026 the main rules about protecting data in the DPDP Act from Sections 3 to 17 were not working yet[17]. These rules include things like what's allowed when using someones data telling people how their data will be used, getting permission from people to use their data, what people who handle data have to do how to protect childrens data what big companies who handle data have to do and what rights people have when it comes to their own data, in the DPDP Act[18].

Obligation Exact Section Application for Neural Data
Consent as the basis for processing. Section 4(1) in conjunction with Section 6. Neural data processing will require clear, informed, complete and clear consent.
Notice to the Data Principal s 5(1) A clear itemized notice that describes the categories of data and the purposes must be given before or during the consent process.
Purpose limitation s 4(1) Neural data can only be processed for the purposes that were agreed upon.
Technical and organizational measures. s 8(4) To make sure that the Act is carried out properly the Data Fiduciary must have procedures, in place.
Reasonable security protections. s 8(5) To prevent data breaches the Data Fiduciary must put in place proper security protections. Breaking this rule can lead to a penalty of, up to ₹250 crore according to the Schedule to the Act.
Breach notification s 8(6) If there is a data breach the Data Fiduciary must tell the Data Protection Board and the Data Principal who is affected.
Retention limitations. s 8(7) Neural data must be removed once the purpose is completed or consent is taken back unless it is required by law.
Grievance redressal s 8(8) The Data Fiduciary has to set up a system to deal with complaints from people. This system is important for the Data Fiduciary to resolve grievances.
Children's data s 9 When it comes to the data of children things are a bit different. If someone wants to process the brain data of minors they need to get permission from the parents that can be verified. There are also some rules to follow. If these rules are not followed there can be a penalty of up to ₹200 crore.
Significant Data Fiduciary designation s 10(1) The Central Government has the power to designate a Data Fiduciary or a group of Data Fiduciaries as a Significant Data Fiduciary. This decision is based on how personal data they handle how sensitive this data is and the risk it poses to the people whose data it is. The government also considers factors when making this decision. Just because a Data Fiduciary processes a lot of data or does so in a sensitive context it does not automatically become a Significant Data Fiduciary. The government has to declare it, as such after reviewing the requirements listed in Section 10(1). The Data Fiduciary and Significant Data Fiduciary designation is an one and the Data Fiduciary has to meet certain criteria to be considered a Significant Data Fiduciary.
Additional SDF obligations s 10(2) A notified SDF is required to establish a Data Protection Officer, conduct periodic Data Protection Impact Assessments, and undergo periodic audits by an independent auditor.
Rights of Data Principals ss 11–12 Rights to access, correction, erasure, redress of grievances, and nomination.

Medical Devices Rules, 2017

When a neural device is considered a medical device the Medical Devices Rules of 2017 come into play. These rules deal with registration, manufacturing, importation, sales and monitoring after the device is, on the market[19]. The rules can apply to EEG systems, devices that provide deep-brain stimulation and diagnostic neurotechnology or BCI equipment used in medical settings. EEG headsets that are sold for wellness, meditation or gaming but do not make medical claims may not be seen as medical devices. The classification depends on the intended use that the manufacturer states and the risk level of the device[20].

ICMR National Ethical Guidelines, 2017

When brain data is acquired for biomedical or health research involving human participants, the Indian Council of Medical Research ("ICMR") National Ethical Guidelines for Biomedical and Health Research Involving Human Participants (2017) are applicable[21]. Prior ethics review by an Institutional Ethics Committee, informed consent, risk-benefit assessment, privacy protection, and additional precautions for vulnerable participants, including as those with disabilities, children, and those suffering from mental illness, are all required under these Guidelines[22].

ABDM Health Data Management Policy

In health settings the Ayushman Bharat Digital Mission ("ABDM") Health Data Management Policy is used[23]. It focuses on security and privacy from the start for digital health data and creates a plan for sharing data with the permission of the person, in the digital health system. When brain data is part of a patients health record the consent system and security rules of the ABDM Policy are followed.

Case Laws

The judges in the Justice K.S. Puttaswamy case against the Union of India decided that privacy is a right. This right is closely linked to dignity and autonomy. People have the right to control what happens to their bodies and the information about themselves.

The Justice K.S. Puttaswamy[24] case did not make a ruling about the data from our brains or computers that can read brain signals. The case was actually about whether the Aadhaar program was allowed by the Constitution. The judges made a plan for how to protect peoples privacy. So when we think about how the Justice K.S. Puttaswamy case applies to brain data we have to use the ideas from the case and think about how they might apply because the judges did not directly make a decision about brain data, in the Justice K.S. Puttaswamy case.

The Puttaswamy decision says that people have the right to control what information is shared about them. Neural data is very personal because it shows what is going on in a persons mind. This includes things like health and emotional state[25]. The Puttaswamy decision is meant to protect this kind of information. The court also said that people have the right to be alone and to control what information is shared about them. This means that people should be able to keep their thoughts and feelings private[26]. Neural data is a part of this because it is so personal. The Puttaswamy decision is important for protecting data because it is, about keeping personal information private.

The decision made by the three judges in the case of Selvi v. State of Karnataka[27] is very important for law. This case is about techniques and human freedom. The Supreme Court said that the police cannot force people to take tests. These tests are called narcoanalysis polygraph examinations and Brain Electrical Activation Profile or brain-mapping tests. The Court thinks that making people take these tests is not right. It goes against the right to not say something that can be used against you. The Court also thinks it goes against the right to be free and to be treated like a being[28]. The Court is talking about the Selvi v. State of Karnataka case and the rights that people have in India like the right, to liberty and the right to not be treated badly.

Selvi does not say that all consensual neuroscientific testing is not allowed. It says that it is not allowed to force someone to take part in testing. It also says that the use of these kinds of procedures, as evidence is limited. If a person agrees freely to a test the results might be accepted.. They must meet certain reliability standards. They must be checked by experts. They must be watched by the court. The decision said that permission, free will trustworthiness and court supervision are needed every time neuroscientific methods are used in investigations or court cases.

Government Guidelines and Policy Documents

The Ministry of Electronics and Information Technology, also known as MeitY is in charge of the IndiaAI governance architecture and the DPDP framework[29]. MeitY plays a role when it comes to neural data that is personal and used by Artificial Intelligence systems. As of July 2026 MeitY has not made any rules for neural data[30]. They have not said how to categorize it or how to regulate neurotechnology.

The Data Protection Board of India was formed under Section 13 of the DPDP Act. This board will handle complaints and problems related to data including neural data that can be identified when the laws are in effect. The Data Protection Board of India is not just, for data it will handle all kinds of personal data.[31]

International Definitions

United States State-Level Privacy Law

The laws about brain data are now in the privacy laws of some states in the United States. For example Colorado has a law called HB24-1058 from 2024. This law says that brain data is information that comes from measuring what is happening in a persons system. This information can be used by machines[32]. California also has a law called SB 1223 from 2024. This law says that brain data is a type of personal information. It defines brain data as information that comes from measuring what is happening in a persons system. It does not include information that is guessed from other types of information.

This is important because it makes a difference between information that comes from brain signals and information that comes from parts of the body. The law in India does not address this difference yet. Brain data is a type of information that's very personal. The laws about brain data are still new. Are being developed. The United States is making laws about brain data to protect peoples privacy. Brain data is information that comes from measuring the activity of a person's brain[33]. This information is very sensitive. Needs to be protected. The laws, about brain data are important because they help keep peoples information safe.

European Union

The European Union laws do not have a category for neural data. The General Data Protection Regulation, which is a law, in the European Union says that health data, genetic data and biometric data are kinds of personal data when they are used to identify someone. This is stated in Article 9 of the law[34]. Neural data is covered by Article 9 when it shows something about a persons health or is used to figure out who they are. The European Union law, the General Data Protection Regulation gives extra protection to neural data when it is used in these ways.

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is relevant because Article 5(1)(f) prohibits the sale or use of AI systems to infer the emotions of natural persons in the workplace and educational institutions, with the exception of medical or safety reasons[35]. This limitation has a direct impact on AI systems that use brain or physiological inputs to infer emotional states in the workplace or educational settings.

UNESCO and OECD

The UNESCO Recommendation on the Ethics of Neurotechnology was approved during the General Conferences session in November 2025. This recommendation creates the complete worldwide rights-based framework for neurotechnology, throughout its entire lifecycle. It clearly states the need to protect privacy ensure transparency obtain consent and keep vulnerable groups safe[36]. UNESCO says that brain data shows private parts of a person and must be protected from anyone who is not allowed to access it or use it.

The OECD Recommendation on Responsible Innovation in Neurotechnology that was adopted on December 11 2019 says what neurotechnology is[37]. Neurotechnology is instruments and techniques including ways to use computers to look at, record, check, assess, change or pretend to be the activity or structure of the system. It says that the brain and how we think are closely connected to who we're as people and that is why neurotechnology needs special rules.

These international rules support the idea that information about our brainss very sensitive and should be treated that way in India. This is true even though the DPDP Act does not clearly say that information about our brains is a category of sensitive information. The OECD Recommendation on Responsible Innovation, in Neurotechnology is important here because it talks about neurotechnology and how it should be used[38].

TYPES OF NEURAL DATA

Neural data must be carefully classified because the risk varies depending on how the data is collected, processed, used, and whether it is raw signal data or AI-generated inference.

Signal Origin

Cortical neural data includes EEG, ECG, and intracranial recordings obtained from or near the cerebral cortex. It has applications in epilepsy monitoring, brain-computer interfaces, cognitive neuroscience, and clinical neurology.

Subcortical neural data includes signals from deep-brain stimulation systems as well as recordings from structures beneath the cerebral cortex. It could arise in the treatment of movement disorders, psychiatric research, or advanced neurostimulation.

Peripheral neural data includes nerve conduction signals, EMG, and other peripheral nervous system information. It may not always resemble "brain data," but it can still reveal neural commands, motor intent, or neurological impairment.

Neuroimaging data includes fMRI, PET, and fNIRS results. These are not always raw electrical recordings, but they can still reveal patterns of brain activity or blood flow changes that are associated with cognitive or neurological conditions.

Cortisol-linked stress markers, galvanic skin response, heart-rate variability, eye tracking, pupil dilation, and other signals can be used with AI to predict mental or emotional states. These should not always be referred to as neural data, but they are relevant to the larger category of cognitive biometric or mental-state data.

Processing Stage

Raw signal data is the least interpreted but frequently the most sensitive. It includes raw EEG voltage fluctuations, spike trains, fMRI time-series data, and raw BCI streams. Even if it is difficult to comprehend without processing, it can later be re-analyzed using better AI models.

Feature data that has been processed may include spectral bands, event-related potentials, connectivity matrices, extracted movement-intention signals, or neuroimaging features. This is easier for AI systems to use and could reveal health or cognitive patterns.

Labels for inferred cognitive or emotional state data include "attention," "fatigue," "stress," "deception," "emotional valence," "cognitive workload," and "mental health risk." This category is legally risky because the label can be incorrect but still influence decisions.

Predictive behavioral data predicts future choices, compliance, relapse risk, work productivity, learning ability, criminal risk, and consumer vulnerability. This is the category with the highest risk because it can easily transition from measurement to profiling.

Through Collection Method

Invasive neural data is collected using implanted electrodes or devices placed inside the body. It frequently raises medical device, consent, and bodily integrity concerns.

Semi-invasive neural data consists of recordings from electrodes placed under the skull but outside or near brain tissue, typically in clinical or surgical settings.

Non-invasive neural data sources include EEG headsets, fNIRS wearables, eye-tracking systems, and other external sensors. It may appear less risky because it is easier to collect, but consumer-scale deployment can pose significant privacy and profiling risks.

Derived or combined neural data is created when neural signals are combined with behavioral, biometric, location, health, or educational data. This combination may result in more sensitive inferences than neural data alone.

INDIA-SPECIFIC CLASSIFICATION TABLE

Type of Neural / Cognitive Data Indian Application Context What the Data Actually Captures Localised Risk Vector Applicable Legal / Policy Framework
Raw EEG Signal Data Neurology departments, epilepsy monitoring, AIIMS and teaching hospitals, sleep clinics, psychiatric research and mental-health studies Electrical activity recorded from the scalp; usually raw voltage fluctuations requiring filtering and interpretation Weak consent practices in low-resource settings; later reuse for AI training; privacy breach from hospital systems; possible stigma if linked with mental illness or neurological disorder DPDP Act ss 2(t), 8(5), 8(6); ICMR 2017 Guidelines; Medical Devices Rules 2017 where device is regulated; Mental Healthcare Act 2017 where mental-health records are involved
Processed EEG / ERP Feature Data Brain fingerprinting, BEAP-type forensic testing, cognitive research, clinical diagnosis and AI-assisted neurological classification Processed features such as P300 responses, spectral power, event-related potentials or connectivity patterns Risk of treating investigative neuroscience as proof; unreliable or overinterpreted expert evidence; coercive administration in criminal investigation Selvi v State of Karnataka; Constitution arts 20(3), 21; Bharatiya Sakshya Adhiniyam rules on expert/scientific evidence; ICMR Guidelines for research contexts
fMRI / Neuroimaging Data Clinical neuroimaging, neurological research, psychiatric studies, cognitive neuroscience and medico-legal assessment Blood-flow or metabolic indicators associated with brain activity; imaging metadata and diagnostic interpretation Re-identification from imaging data; diagnostic stigma; use beyond original clinical purpose; uncertain reliability in legal contexts DPDP Act; ICMR Guidelines; ABDM Health Data Management Policy; Medical Devices Rules for relevant devices
BCI Command Data Assistive devices for persons with disabilities, neuroprosthetics, rehabilitation, communication interfaces, wheelchair or cursor control Commands generated from neural or neuromuscular signals to operate a device or software system Exploitation of disability status; loss of agency if device logs are misused; secondary use for profiling; cybersecurity attacks on assistive systems RPwD Act 2016; DPDP Act; Medical Devices Rules where applicable; Article 21 dignity and autonomy
Inferred Emotional State Data Ed-tech proctoring, workplace monitoring, customer-service analytics, mental-health apps, attention-tracking tools AI-generated labels such as stress, attention, fatigue, anger, deception or emotional valence Discrimination against students, workers or applicants; false cheating flags; cultural or language bias; intrusive monitoring of mental states DPDP Act; EU AI Act comparison on emotion recognition; Article 21 privacy and dignity; Rinaldi on emotional AI
Predictive Cognitive State Data Risk assessment tools, policing analytics, workplace productivity tools, mental-health risk scoring and educational prediction Forward-looking predictions about behaviour, risk, attention, ability, compliance or vulnerability Profiling of minorities, tribal communities, disabled persons or economically marginalised groups; automated suspicion; denial of opportunities Constitution arts 14 and 21; DPDP Act ss 8, 10; IndiaAI Governance Guidelines; Puttaswamy
Neurofeedback Training Data Clinical therapy, meditation apps, productivity tools, sports training, defence or high-performance training Data produced while a user receives feedback about brain or physiological activity to change behaviour or performance Manipulation risk; unclear medical claims; behavioural dependence; use in military or workplace contexts without adequate oversight DPDP Act; ICMR Guidelines where research is involved; Medical Devices Rules if medical claims are made; consumer protection law where marketed to users
Aggregate Population Neural Data Neuroscience research, hospital networks, AI model training, AIKosh-type future datasets and public-health research Aggregated or de-identified neural/health datasets used for population-level analysis or AI development Re-identification; underrepresentation of rural/tribal populations; models trained mainly on urban hospital data; caste/gender correlation mining DPDP Act; ICMR Guidelines; ABDM Policy; BIDS as research-data standard; AIKosh policy sources
Mental-Health Linked Neural Data Psychiatric hospitals, digital mental-health platforms, neuropsychiatric assessment, addiction treatment and suicide-risk research Neural or physiological data linked with diagnosis, treatment, symptoms or risk indicators Severe stigma; employment/insurance discrimination; unauthorised disclosure; self-harm vulnerability Mental Healthcare Act 2017 ss 23–25; DPDP Act; ICMR Guidelines; Article 21
Children’s Neural / Cognitive Data Ed-tech, proctoring, attention-tracking classrooms, neurodevelopmental research and paediatric neurology Brain or cognitive data relating to children, including attention, learning, disability or developmental markers Lack of meaningful consent; long-term profiling; labelling children as inattentive, risky or low-performing; parental consent problems DPDP Act s 9; RPwD Act where disability is involved; ICMR Guidelines for children in research; Article 21 dignity
Judicially Submitted Neural Evidence Criminal trials, expert reports, fitness assessments, brain mapping or neuropsychiatric evidence placed on record Neural or neuropsychiatric findings submitted as documents or expert testimony Courts overvaluing scientific-looking reports; AI summarisation errors; privacy of accused/victims/witnesses; language translation errors Selvi; Puttaswamy; Bharatiya Sakshya Adhiniyam expert evidence provisions; Supreme Court AI White Paper

APPEARANCE IN OFFICIAL DATABASES

India does not currently have a dedicated official neural-data registry. Neural data can be found indirectly in hospitals, biomedical research institutions, medical device regulation, forensic laboratories, mental health records, disability-assistive technology, judicial records, and AI governance infrastructure. The document should therefore avoid claiming that neural data has already been formally catalogued in the NJDG, AIKosh, or IndiaAI repositories.

Institutional Architecture

Institution Actual Role Relevance to Neural Data Careful Wording
MeitY Administers the DPDP framework and IndiaAI governance architecture Relevant to neural data where it is personal data and where AI systems process it Say MeitY is relevant through DPDP/IndiaAI; do not say it has a neural-data code yet.
Data Protection Board of India Adjudicatory body under the DPDP Act Relevant for breaches or complaints involving identifiable neural data Do not call it a specialist neural-data regulator.
ICMR Biomedical and health research ethics Relevant for neuroscience, EEG, fMRI, BCI and human-subject research Strong source for consent, ethics review and vulnerable groups.
CDSCO Medical-device regulation Relevant where neural devices qualify as medical devices Avoid saying every consumer EEG headset is Class C/D. Classification depends on intended use and risk.
National Health Authority / ABDM Digital health-data ecosystem Relevant where neural data becomes part of digital health records Use for health-data governance, not all neurotech.
Supreme Court e-Committee / NIC eCourts and judicial technology Relevant where neural evidence appears in case records or AI tools summarise expert reports Do not say eCourts tools directly process neural data unless officially shown.
NJDG Repository of pending/disposed case data Not a neural-data repository Say neural evidence may appear in court records, but NJDG itself is not a neural-data database.
IndiaAI / AIKosh AI datasets, models, sandbox access Future relevance for anonymised or synthetic health/neural datasets Do not say AIKosh currently hosts neural datasets unless verified live.
Mental Health Review Boards / mental-health establishments Mental-health records and patient rights Relevant where neural data is linked with mental illness or treatment Use Mental Healthcare Act confidentiality provisions.

Official Repositories

NJDG: NJDG is a national repository of data on cases pending and resolved in district and taluka courts. It should not be referred to as a neural data repository. At most, neural or neuropsychiatric evidence may appear in underlying case records in specific matters, but NJDG is case-management infrastructure rather than a specialized neuroscientific database. [39]

AIKosh: AIKosh offers datasets, models, a secure API, and an AI Sandbox for model training and experimentation. It is useful as a potential future infrastructure for anonymized health or neural research datasets. However, unless the live AIKosh inventory is checked, the document should not claim that AIKosh is currently hosting neural datasets. [40]

ABDM health-data systems: For neural data that forms part of medical records, the ABDM Health Data Management Policy is applicable. It promotes security and privacy by design for personal digital health data. [41]

Judicial records and forensic reports Expert reports, forensic material and medical assessments may be introduced into court records as neural evidence. In these cases the key legal safeguards are consent, reliability, standards of expert evidence, confidentiality and constitutional due process.

RESEARCH ENGAGING WITH NEURAL DATA IN THE INDIAN JUDICIARY

Indian research on neural data in the judiciary is still limited. The strongest legal anchor is not a recent policy report but the Supreme Court’s decision in Selvi v. State of Karnataka. That case remains central because it deals with narcoanalysis, polygraph and BEAP/brain-mapping techniques, and it places clear limits on involuntary use of such techniques.

A second research strand concerns mental privacy and cognitive liberty. Scholarship on cognitive biometrics argues that law should not focus only on raw neural signals because consumer devices can infer mental states through wearables, XR systems, eye tracking, and behavioral sensors. This is relevant to India because DPDP Act protection will often depend on whether the person is identifiable, while the rights harm may arise from the inference itself. [42]

A third strand concerns global neurotechnology governance. UNESCO has warned that brain data can reveal deeply private information and has called for ethical and legal safeguards for neurotechnology. This is useful for an Indian legal argument because India currently lacks a specific neural-data statute and therefore must rely on DPDP, medical ethics, disability law, mental-health confidentiality, and constitutional privacy. [43]

A fourth strand concerns representation and dataset bias. Much behavioral and cognitive science research has historically relied on WEIRD populations—Western, Educated, Industrialized, Rich, and Democratic societies—which are not representative of humanity as a whole. This supports a cautious Indian argument: AI systems trained on foreign neural datasets should not be assumed reliable for Indian populations without local validation, ethics review and bias testing.

The research gap is therefore clear. India needs careful empirical work on judicial use of neuroscientific evidence, reliability of BEAP-type reports, treatment of neural evidence in trial courts, privacy protection for neuropsychiatric records, AI-assisted analysis of neurological reports, and bias in neural AI models trained outside Indian contexts. Until such research exists, the document should avoid precise claims about error rates or caste/gender performance disparities unless the underlying study is publicly available.

DATA CHALLENGES

Data Quality

Neural data is technically fragile. EEG signals can be affected by electrode placement, movement, muscle activity, eye blinks, device quality and environmental noise. Neuroimaging data depends on scanning protocols and preprocessing choices. If these differences are not documented, AI models trained on such data may produce unreliable results.

Standardisation

India does not yet have a national neural-data standard. Internationally, the Brain Imaging Data Structure, or BIDS, is a widely used community-driven standard for organizing neuroimaging and related metadata.[44] A future Indian neural-data framework should align with such standards instead of creating fragmented hospital-wise or lab-wise formats.

Privacy and Re-identification

Neural data is difficult to anonymize completely because it may contain unique patterns, rare diagnoses, or links with other health and demographic data. Re-identification risk becomes higher in small communities, rare disorders, forensic records or mental-health datasets.

Representation

Indian neural datasets must not be built only from elite urban hospitals. A model trained mainly on metropolitan data may fail for rural, tribal, low-income, disabled, or linguistically diverse populations. This is especially serious if the model is later used in healthcare, education, employment or criminal justice.

Scientific Reliability

Courts and regulators must be careful with technologies that appear scientific but have uncertain reliability. Brain-based deception detection, emotional inference, and cognitive prediction should not be treated as conclusive proof. The legal standard should insist on consent, expert scrutiny, scientific validation and human review.

Vendor Opacity

Many neural AI systems are proprietary. If vendors do not disclose training data, error rates, limitations, validation methods, and uncertainty measures, courts and regulators cannot meaningfully evaluate the system. Any high-stakes deployment should require documentation, auditability and independent validation.

WAY AHEAD

  1. First, India should recognize neural data as a high-sensitivity category within policy, even if the DPDP Act does not create a separate statutory class. This can be done through guidance for significant data fiduciaries, health-data processors, neurotechnology firms and AI developers.
  2. Second, neural-data processing should require privacy-by-design. Devices and platforms should use data minimization, on-device processing where possible, encryption, audit logs, limited retention, consent dashboards and clear deletion mechanisms.
  3. Third, India should create specific guidance for neural data in medical and research settings. ICMR, CDSCO, MeitY, and the National Health Authority should jointly clarify how neuroscience research, neurodiagnostics, BCI devices, and AI-assisted neural analysis should comply with consent, ethics review, device safety and data protection.
  4. Fourth, judicial use of neural evidence should remain tightly controlled. No BEAP, brain mapping, neurodiagnostic, or AI-interpreted neural evidence should be used without consent, scientific validation, expert scrutiny, and compliance with Selvi. AI tools should not be allowed to summarise or classify such evidence without human verification.
  5. Fifth, India should develop a neural-data standard aligned with international standards such as BIDS. The standard should require metadata on device type, sampling frequency, preprocessing method, consent status, demographic limitations, data quality and intended use.


Finally, neural-data governance must remain anchored in Articles 14 and 21. The point is not to block beneficial neurotechnology. Assistive BCIs, epilepsy diagnostics, rehabilitation tools, and neurological research may greatly improve lives. But the closer a technology comes to the mind, the stronger the legal duty must be to protect consent, dignity, equality, privacy and human agency.

Contributors & review status
Curated / edited bynot yet recorded
Peer reviewpending
Project reviewpending
Expert reviewpending
Page created 2026-08-21  ·  Last updated 2026-08-22
  1. ↑ Marcello Ienca and Roberto Andorno, 'Towards New Human Rights in the Age of Neuroscience and Neurotechnology' (2017) 13(1) Life Sciences, Society and Policy 5.
  2. ↑ OECD, 'Recommendation of the Council on Responsible Innovation in Neurotechnology' (adopted 11 December 2019) OECD/LEGAL/0457, Preamble.
  3. ↑ UNESCO, 'Recommendation on the Ethics of Neurotechnology' (adopted November 2025, 43rd General Conference) para 1.
  4. ↑ Constitución Política de la República de Chile, art 19(1) (as amended by Ley 21.383, 25 October 2021).
  5. ↑ Neurorights Foundation, 'The Five Neurorights' (2021) https://www.neurorightsfoundation.org/ accessed 30 July 2026
  6. ↑ Digital Personal Data Protection Act 2023, s 2 (definitions). No entry for "neural data," "brain data," "neurodata," or "cognitive biometric data" appears in the Act.
  7. ↑ ibid. The Act does not expressly define or enumerate neural data.
  8. ↑ ibid s 2(t).
  9. ↑ Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, SI 2011/313, r 3(vi). https://prsindia.org/files/bills_acts/bills_parliament/2011/IT_Rules_2011.pdf
  10. ↑ ibid r 3. The definition encompasses "physiological condition" without distinguishing neural from non-neural physiological data.
  11. ↑ Mental Healthcare Act 2017, s 23. https://www.indiacode.nic.in/bitstream/123456789/2249/1/A2017-10.pdf
  12. ↑ Rights of Persons with Disabilities Act 2016, s 2(s).https://www.indiacode.nic.in/bitstream/123456789/15939/1/the_rights_of_persons_with_disabilities_act%2C_2016.pdf
  13. ↑ United Nations Convention on the Rights of Persons with Disabilities (adopted 13 December 2006, entered into force 3 May 2008) 2515 UNTS 3, art 1. India ratified on 1 October 2007.
  14. ↑ Medical Devices Rules 2017, SI 2017/790, r 2(1)(ta). https://cdsco.gov.in/opencms/resources/UploadCDSCOWeb/2022/m_device/Medical%20Devices%20Rules,%202017.pdf
  15. ↑ ibid r 4 and Sch I (classification of medical devices).
  16. ↑ ibid s 10(1).
  17. ↑ ibid ss 8(5)–(6).
  18. ↑ ibid, Schedule, Entry 1: "Failure to take reasonable security safeguards to prevent personal data breach—monetary penalty which may extend to two hundred and fifty crore rupees."
  19. ↑ Medical Devices Rules 2017, SI 2017/GSR 648(E), issued under the Drugs and Cosmetics Act 1940.https://www.indiacode.nic.in/bitstream/123456789/15278/1/drug_cosmeticsa1940-23.pdf
  20. ↑ ibid rr 3–4 and Sch I (classification of medical devices by risk: Class A, B, C, D).
  21. ↑ Indian Council of Medical Research, National Ethical Guidelines for Biomedical and Health Research Involving Human Participants (ICMR 2017). https://ethics.ncdirindia.org/asset/pdf/ICMR_National_Ethical_Guidelines.pdf
  22. ↑ ibid rr 3–4 and Sch I (classification of medical devices by risk: Class A, B, C, D).
  23. ↑ National Health Authority, Ayushman Bharat Digital Mission: Health Data Management Policy (2021). https://abdm.gov.in/strapicms/uploads/health_management_policy_bac9429a79.pdf
  24. ↑ Justice K.S. Puttaswamy v Union of India (2017) 10 SCC 1.
  25. ↑ Bharatiya Sakshya Adhiniyam 2023, ss 39–45 (expert and scientific evidence).
  26. ↑ The application of Puttaswamy to neural data is an analytical extension. See Marcello Ienca and Roberto Andorno, 'Towards New Human Rights in the Age of Neuroscience and Neurotechnology' (2017) 13(1) Life Sciences, Society and Policy 5, para 3.2 (applying informational self-determination principles to neural data).
  27. ↑ Selvi v State of Karnataka (2010) 7 SCC 263.
  28. ↑ ibid [160]–[170] (K.G. Balakrishnan CJ, delivering the judgment of the Court).https://indiankanoon.org/doc/338008/
  29. ↑ Ministry of Electronics and Information Technology, 'India AI Governance Guidelines' (Government of India, 2025).
  30. ↑ Supreme Court of India, e-Committee, White Paper on AI and the Judiciary (2025).
  31. ↑ National Judicial Data Grid, https://njdg.ecourts.gov.in accessed 30 July 2026. The NJDG is a case-management and pendency-tracking repository; it does not store neural data.
  32. ↑ Colorado HB24-1058, 'Concerning the Protection of Neural Data' (2024), s 2(1)(a). Full text: Colorado General Assembly, https://leg.colorado.gov/bills/hb24-1058 accessed 30 July 2026.
  33. ↑ California SB 1223, 'California Consumer Privacy Act: Sensitive Personal Information: Neural Data' (2024), amending Cal Civ Code § 1798.140(ae). Full text: California Legislative Information, https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB1223 accessed 30 July 2026.
  34. ↑ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation), OJ L 119/1, art 9(1).
  35. ↑ Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), OJ L 2024/1689, art 5(1)(f).
  36. ↑ UNESCO, 'Recommendation on the Ethics of Neurotechnology' (adopted November 2025, 43rd General Conference) https://www.unesco.org/en/ethics-neurotech/recommendation accessed 30 July 2026.
  37. ↑ ibid para 1 and Preamble.
  38. ↑ OECD, 'Recommendation of the Council on Responsible Innovation in Neurotechnology' (adopted 11 December 2019) OECD/LEGAL/0457, Preamble https://legalinstruments.oecd.org/api/print?ids=658&Lang=en accessed 30 July 2026.
  39. ↑ e-Committee, Supreme Court of India, ‘National Judicial Data Grid’ https://ecommitteesci.gov.in/service/national-judicial-data-grid/ accessed 29 June 2026.
  40. ↑ Ministry of Electronics and Information Technology, ‘AI models developed under IndiaAI Mission represent important progress in building India’s own AI capabilities tailored to local languages and use-cases’ (Press Information Bureau, 13 March 2026) https://www.pib.gov.in/PressReleasePage.aspx?PRID=2239614 accessed 29 June 2026.
  41. ↑ National Health Authority, Health Data Management Policy (n 7).
  42. ↑ Patrick Magee, Marcello Ienca and Nita A Farahany, ‘Beyond Neural Data: Cognitive Biometrics and Mental Privacy’ (2024) 112 Neuron 3017 https://pubmed.ncbi.nlm.nih.gov/39326392/ accessed 29 June 2026.
  43. ↑ Joseph Henrich, Steven J Heine and Ara Norenzayan, ‘The Weirdest People in the World?’ (2010) 33 Behavioral and Brain Sciences 61 https://pubmed.ncbi.nlm.nih.gov/20550733/ accessed 29 June 2026.
  44. ↑ Russell A Poldrack and others, ‘The Past, Present, and Future of the Brain Imaging Data Structure (BIDS)’ (2023) arXiv:2309.05768.
Retrieved from "https://www.lawandjusticewiki.org/w/index.php?title=Neural_Data&oldid=15403"
Cookies help us deliver our services. By using our services, you agree to our use of cookies.