Strengthening legal safeguards against genetic discrimination: review and recommendations for Malaysia

Abstract

The increased pace of genomic research and precision medicine on a global scale has heightened the risk of genetic discrimination and underscored the critical importance of genetic data protection. Leading jurisdictions, including the U.S., the European Union, Japan, China and Hong Kong among others, have enacted laws as solution to these issues. These regulations explicitly outlaw the misuse of genetic information in insurance, employment, or health-related domains in addition to robust data protection measures, which include defined opt-in requirements and proper governance by auditors and ethics committees. Malaysia, however, is yet to have legal safeguards specifically against genetic discrimination, currently relying on general data protection laws that does not explicitly classify genetic information as sensitive or protected data, thus making it vulnerable to discriminatory misuse. This gap has implications towards the general population, especially with the rise of genetic testing in healthcare and large-scale genomics studies. This review examines existing international legal guidelines and policy infrastructure relevant to genetic discrimination and genetic data governance, through which key mechanisms of anti-discrimination legislation, data privacy schemes, and bioethics criteria are identified. The consistently repeated tenets such as explicit prohibitions on discriminatory uses of genetic data, expanded safeguards and strong supervisory mechanisms, when applied to the Malaysian context, serve as a legislative blueprint for the country to establish its own framework in preventing genetic discrimination, addressing current protection gaps, and governing genetic data in the spheres of research, insurance, employment, and commercialisation.

Introduction

Developments in genomic science have opened the door for implementation of precision medicine, population health, and biomedical innovation around the world. For instance, large-scale national population genomics initiatives like Malaysia’s MyGenom Project (www.mygenom.gov.my) have potential to support better and more precise healthcare solutions while positioning the country as among the key contributors in advancing a comprehensive understanding of the region’s diverse ethnic groups (Park et al. 2024). However, the growing application of genetic data inherently raises ethical, legal, and social concerns; chief among those the risk of genetic discrimination, where people are subjected to prejudicial practices or systematic bias based on their genetic predispositions. (Kim et al. 2021; Cowan et al. 2022; Kuru and Beriain 2022; Tiller et al. 2024). Such discrimination is present in different fields, such as job opportunities, insurance coverage, and social engagements, and may prevent people from obtaining important services or possibilities (Kim et al. 2021; Edemekong et al. 2025).

Genetic discrimination is focused on life and health insurance underwriting, employment decisions, and social services (Reveiz et al. 2025; Posey and Thistle 2021). In empirical research, fear of discrimination has been suggested to discourage individuals from participating in genetic testing or genomic research, and this may reduce public health benefits and trust in scientific investigations (Dalpé et al. 2021). Moreover, international experiences demonstrate that lacking legal support can perpetuate inequities, social bias, and socio-economic segregation among vulnerable populations (Johnson and Shaw 2023; Ramanan et al. 2025). Whereas genetic discrimination has been widely discussed in North America and Europe beginning in the late 1990s, discourse has been notably less frequent in Asia, despite shared and special concerns (Kim et al. 2021; Akash and Sarker 2023). However, current scholarly discussion indicates that genetic discrimination is more widely acknowledged in Asian jurisdictions, requiring a comparative legal and policy framework to elaborate on current and emergent forms of genetic discrimination (Kim et al. 2021).

Worldwide, some jurisdictions have tried to curb genetic discrimination in legal, moratoria, or industry standards. These include the United States’ Genetic Information Nondiscrimination Act (GINA) (Rothstein, 2008; Becker et al. 2024), Canada’s Genetic Non-Discrimination Act, (Hammond, 2019), and Australia’s Life Insurance Moratorium, 2019, (Tiller et al. 2024). These frameworks are significant and represent valuable case studies for countries developing their own protections, despite being varied in their scope and enforcement efficacy. The approaches taken by most Asian countries though fall under the category of overarching anti-discrimination laws or data protection regimes as opposed to precise genetic discrimination laws (Akash and Sarker 2023), the latter of which is needed to address the distinctive cultural and socioeconomic aspects of each country (Kim et al. 2021). Such intricacies must be considered if the new frameworks are to redress existing disparities rather than cause new ones.

At present, it is significant to note that Malaysia has no specific laws against genetic discrimination (Gerard et al. 2025). However, there are several laws such as the Personal Data Protection Act 2010 or the Employment Act 1955, which provide some protects however they do not guarantee protection from the misuse of individual’s genetic data in insurance, jobs, and research (Saifuddeen and Mohamad 2014; Aizuddin et al. 2021). Alongside its continued execution of national genomics initiatives, Malaysia would do well to implement a legal framework to protect its citizens against genetic discrimination and for ethical governance of genetic data, that are in alignment with international ethical standards. This review, therefore, provides analysis of regulations in this area worldwide as well as in the Asian region. It also provides recommendations and a checklist regarding legislation for Malaysia that aims to strike the balance between the rights of individuals and promotion of genomics science.

Methodology

This review uses a doctrinal legal analysis approach to analyse genetic discrimination laws and policies. The main sources used in this work consist of legislation, regulations, policy documents, and authoritative statements from the respective regulatory bodies in each country. The secondary sources consist of scholarly literature published in peer-reviewed academic journals, reports issued by governments, and documents issued by international organizations.

Criteria for selecting jurisdictions The following criteria were used to select the jurisdictions to be studied: (1) It was a necessary condition to choose a country that already has a functioning genetic discrimination or genetic data protection system, as well as other mechanisms related to the legal context in which the study will take place; (2) It had to have available on the Internet the text of the law written in English or some other language, or a reliable English translation of the legislation in question; (3) there should be some accounts or experiences of its application and enforcement; (4) it should be connected in some way to the institutional and legal tradition of Malaysia (common law countries, civil law countries, neighbours, and so on).

Analytical framework of the selected criteria: Each jurisdiction was analysed based on (1) scope of protection (for example, covered actors, definition of genetic protection and covered domains); prohibited conduct; (3) exclusion criteria; (4) enforcement method; (5) penalties; and (6) institutional oversight of the said legislation. This scheme allows making a structured comparison and making general conclusions and lessons that can be drawn.

Comparative legal models relevant to Malaysia

Legal frameworks, genetic discrimination and genetic data protection legal frameworks differ between countries in terms of scope, enforcement, and relation to broader privacy regulation (Table 1). As there are many different approaches, this comparison does not aim to describe all the existing international laws in detail. Instead, selected jurisdictions are discussed to illustrate regulatory models that are relevant to Malaysia, including dedicated genetic non-discrimination legislation, privacy-centred genetic data protection frameworks, and emerging genomic governance approaches. Detailed discussions of specific applications, including employment, insurance, and research governance, are further examined in subsequent sections.

Table 1.

Summary of national acts and policies governing genetic discrimination and genetic data protection

Country	Act, policies or law regarding to GD	Specific clause regrading to GD	Act, policies or law regarding to genetic data protection	Specific clause regrading to genetic data protection	Notes	Reference
USA	• Genetic Information Nondiscrimination Act (GINA) 2008	GINA: Title I (health insurance) and Title II (employment) prohibit group health plans and employers from using genetic information to make eligibility, coverage, underwriting or employment decisions; also restricts requests/requirement of genetic information and limits disclosure	Health Insurance Portability and Accountability Act (HIPAA)	Under HIPPA, genetic information is health information protected by the Privacy Rule. (45 C.F.R 160.103 and 164.501.)	• GINA does not cover life insurance, long-term care, or disability insurance; it also has limited applicability to the military, VA, and certain other contexts. • HIPAA protects privacy/security of genetic data in the healthcare context but does not by itself prohibit discrimination	Genetic Discrimination, (2022)
Canada	• Genetic Non-Discrimination Act (GNDA) S.C. 2017, c. 3 • Canada Labour Code (CLC) Division XV.3 (post-GNDA amendments)	• GNDA Sects.  3–5: prohibits requiring an individual to undergo a genetic test or disclose results as a condition of providing goods, services, contracts, employment, or insurance; criminal penalties for contravention • CLC: Sect.  247.98(2)– (4): employees cannot be required to undergo a genetic test, disclose results, or be penalized/dismissed due to refusal or results	Personal Information Protection and Electronic Documents Act (PIPEDA) & OPC guidance	• PIPEDA is the principal federal data-protection instrument for private sector commercial activities • OPC guidance clarifies that organizations should treat genetic information as especially sensitive, obtain express consent for collection and use	GNDA is Canada’s landmark statute directly addressing GD. Parliamentary amendments to CHRA and Canada Labour Code accompanying Bill S-201 expanded protections in federal contexts	Consolidated Federal Laws of Canada, Genetic Non-Discrimination Act, 2017; The Personal Information Protection and Electronic Documents Act (PIPEDA), (2025)
EU	• General Data Protection Regulation (GDPR, EU 2016/679) • Charter of Fundamental Rights of the European Union 2000	• Under GDPR: Article 4(13) defines genetic data” (as personal data relating to inherited or acquired genetic characteristics that give unique info about physiology or health). (Article 9 prohibits processing of special categories of personal data (including genetic data) except under strict conditions. • Under Charter, Article 21(1) prohibits discrimination on various grounds, including “genetic features	The European Data Protection Board Guidelines (2025)	Guidelines on processing health/genetic data, pseudonymization, anonymization, research exemptions, and consent mechanisms (non-binding).	The GDPR offers strong data protection for genetic data across ALL member states. Also, Member States may adopt additional / more protective rules (or allow certain exceptions under national law) for health/genetic data	Wolff and Atallah (2021)
France	Loi du 4 mars relative aux droits des malades (Loi Kouchner) 2002	Art. L.1110‑3 CSP, prohibits discrimination in access to prevention and care. Interpreted to cover genetic characteristics.	• French Data Protection Law (Loi Informatique et Libertés, 1978, amended 2018 to integrate GDPR) • Bioethics Law (Loi de Bioéthique 2011 & 2021 revisions)	• French Data Protection law provides explicit data protection for all personal data, including genetic/health data. • Bioethics Law, protects genetic data generated in research and clinical settings	GDPR applies across EU; the Commission Nationale de l’Informatique et des Libertés supervises implementation in France. Provides the backbone for data protection in research and healthcare.	Zalnieriute (2020)
Germany	Bundesdatenschutzgesetz (BDSG) Federal Data Protection Act 2021	BDSG defines “genetic data” as a special category of personal data. BDSG supplements GDPR: special category data processing (including genetic data) is subject to stricter rules.	Gendiagnostikgesetz, GenDG) Genetic Diagnostics Act (2010)	Regulates genetic testing (human) and related genetic data. Provides protections against misuse, forced testing/disclosure, and restricts employer/insurer use.	The BDSG applies generally to both public authorities and private bodies	Buchner (2023)
China	Measures for the Administration of Health Insurance (MAHI) 2019	Under MAHI 2019, Article 17 (for premium/underwriting) and Article 38 (for data collection when selling health insurance)	• Personal Information Security Specification (2020) (PISS/ GB/T 35273 − 2020) • Regulation of the People’s Republic of China on the Administration of Human Genetic Resources (HGR) (2019)	• Under PISS, Personal biometric information e.g., personal genes as sensitive information • Under HGR Regulation Article 3, the collection, preservation, utilization and external provision of China’s human genetic resources shall comply with this Regulation	Existing MAHI 2006 was expanded from 53 articles to 72 articles in MAHI 2019	National Health Commission of People’s Republic of China (2019)
Hong Kong SAR	Disability Discrimination Ordinance (DDO) 1996	Under DDO, Sect.  2 Interpretation: “illness or disease that exists at present, existed in the past, may exist in the future, or is imputed to a person.” Part 2 prohibits discrimination based on Sect.  2	Personal Data Privacy Ordinance (DPO 1996)	DPO does not contain a separate or special category such as “sensitive personal data” that enumerates genetic information as a special typo, later in 2017 acknowledge genetic data as physiological data	In 2017, PCPD responded to a media enquiry and explicitly said: “Genetic data is a physiological data … unique and immutable … our Office considers that genetic data collected from individuals constitutes personal data under the Ordinance.	Response to Media Enquiry or Report, (2017)
Japan	Genome Medicine Promotion Act 2023	Article 15 “the government shall take necessary measures to ensure appropriate responses to unjust discrimination based on an individual’s innate and inheritable genomic information”	• Act on the Protection of Personal Information (APPI) (2017)	• Article 2: APPI and Cabinet Order list categories requiring special care (medical/health history; items that may lead to discrimination). Amendments (2017–2022) clarified stricter handling and PPC enforcement powers	Practically, APPI gives strong privacy protection to genetic data as sensitive information, but it focuses on data protection rather than expressly banning discrimination (employment /insurance)	Center A.P.R (2023)

The United States and Canada represent jurisdictions that have adopted dedicated genetic non-discrimination legislation. Specifically, the US Genetic Information Nondiscrimination Act (GINA) 2008 prohibits discrimination concerning genetic information by putting restrictions in place for employers and health insurers from asking, receiving, and releasing genetic information for discrimination purposes. The existence of GINA alongside the Patient Protection and Affordable Care Act 2010 creates a great level of protection against the misuse of genetic information in the field of healthcare. Nevertheless, since GINA does not cover life insurance, disability insurance, or long-term care insurance, one can see the limitations of such law (Feldman 2012; Genetic Discrimination, 2022). The Health Insurance Portability and Accountability Act (HIPAA) further protect genetic information as protected health information under the Privacy Rule, although its primary focus is confidentiality, security, and appropriate data handling rather than prevention of discriminatory practices (Edemekong et al. 2025).

Canada provides a broader legislative approach through the Genetic Non-Discrimination Act (GNDA) 2017, which prohibits individuals and organisations from requiring genetic testing or disclosure of genetic test results as a condition for obtaining goods, services, contracts, or employment. Complementary amendments to the Canada Labour Code introduced additional protections for employees by restricting employers from requesting genetic testing or using genetic information without consent. Furthermore, genetic characteristics were incorporated as a prohibited ground of discrimination under the Canadian Human Rights Act, strengthening the human rights framework addressing genetic discrimination (Nicholls and Fafard 2016; Hammond, 2019).

In contrast, European jurisdictions have primarily adopted privacy-centred approaches, where genetic information is protected through comprehensive data protection frameworks. The General Data Protection Regulation (GDPR, EU 2016/679) recognises genetic data as a special category of personal data requiring enhanced protection. Under Article 4(13), genetic data are defined as personal data relating to inherited or acquired genetic characteristics that provide information regarding an individual’s physiology or health, while Article 9 restricts processing of genetic data unless specific legal conditions are satisfied (Kuru and Beriain 2022; Becker et al. 2024). Although GDPR provides extensive safeguards against unauthorised processing, access, and disclosure of genetic information, it primarily regulates data governance rather than directly prohibiting genetic discrimination. Similarly, Article 21 of the Charter of Fundamental Rights of the European Union identifies “genetic features” as a prohibited ground of discrimination; however, its application functions mainly within a broader equality framework rather than as a dedicated genetic non-discrimination mechanism (Custers 2023).

Germany demonstrates a complementary European approach by combining general data protection legislation with genetic-specific regulation. The Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) supplements GDPR requirements by providing additional safeguards for sensitive personal data, including genetic information. In addition, the Genetic Diagnostics Act (GenDG) 2010 specifically regulates genetic testing and restricts the use of genetic information by employers and insurers (Heidemann & Schillhorn). This approach highlights the distinction between genetic data protection and genetic discrimination prevention, demonstrating that privacy legislation alone may not fully address discriminatory use of genetic information.

Asian countries exemplify how emerging governance strategies in genomics can be executed, which have concentrated mostly on managing genetic data and human genetic resources as well as protecting the privacy of individuals rather than on regulating genetic discrimination. In China, for example, genetic information is governed by legislation such as the Regulation on the Administration of Human Genetic Resources 2019 as well as general legislation on personal data protection. This legislation regulates the usage, storage, and transfer of genetic information but is still mainly focused on the governance of genetic information rather than prohibiting genetic discrimination (Chen and Li 2024). Additionally, Hong Kong operates within existing legal frameworks concerning personal data protection, with the recognition that genetic information falls under the umbrella of personal data as outlined in the Personal Data (Privacy) Ordinance, but there has been no legislation providing for genetic discrimination (Response to Media Enquiry or Report, 2017). Japan’s approach represents a changing phase in the application of technology in laws to prevent discrimination based on genetic data as stipulated in the Genome Medicine Promotion Act 2023. Nevertheless, the personal data protection framework continues to concentrate on the protection of individual privacy rather than on the prevention of discrimination based on genetic data in terms of employment or insurance (Center (APRC), 2023).

Overall, international experiences indicate that protection of genetic information and prevention of genetic discrimination are separate but mutually reinforcing regulatory goals. For instance, the U.S. and Canada adopted laws that provide mechanisms for dealing with the misuse of genetic information for discriminatory purposes. In contrast, privacy-based laws in Europe, such as the GDPR, and in Asian countries, mostly focus on genetic data collection and processing. By applying the findings from these experiences in Malaysia, it can be concluded that both protection of genetic data and separate anti-discrimination measures are required. Currently, the protection of genetic data is spread across the laws governing personal data protection, healthcare regulation, and ethics. The following sections therefore examine specific areas where genetic discrimination risks may arise, including employment, insurance, and genetic research governance.

Legislative protections against genetic discrimination in employment

In Canada, safeguards against genetic discrimination are established through several complementary legal frameworks. The Genetic Non-Discrimination Act (S.C. 2017, c. 3) provides broad protection by prohibiting individuals and organizations from requiring genetic testing or disclosure of genetic information as a condition for accessing goods, services, or entering into contractual agreements (Cowan et al. 2022). The limited exemptions in application of this Act primarily relate to healthcare professionals and researchers. It also establishes provisions addressing the handling and use of genetic information to reduce the risk of misuse.

In the context of employment, specific protections for employees in federally regulated sectors are provided via amendments to the Canada Labour Code, specifically by denying employers the right to request or use genetic test results of employees, and protecting individuals who refuse to provide genetic information from adverse employment-related repercussions (Nicholls and Fafard 2016; Hammond, 2019).These provisions, however, apply only to federally regulated employment settings and do not extend to all employment relationships across Canada, as employment regulation is shared between federal and provincial jurisdictions. Non-compliance with the Genetic Non-Discrimination Act may result in significant penalties, including fines of up to CAD 1,000,000 upon indictment, imprisonment of up to five years, or both, with lesser penalties applicable for summary convictions (Hammond, 2019; Joly et al. 2020).

Additionally, the Canadian Human Rights Act was amended through the Genetic Non-Discrimination Act (S.C. 2017, c. 3) to incorporate “genetic characteristics” as a prohibited ground of discrimination, thereby strengthening the human rights framework for addressing genetic discrimination (Nicholls and Fafard 2016). Section  3(1) of the Canadian Human Rights Act recognizes genetic characteristics alongside other protected grounds, including race, national or ethnic origin, colour, religion, age, sex, sexual orientation, marital status, family status, disability, and other legally recognized categories. This provision places genetic characteristics among the protected grounds under federal human rights law, covering discrimination that arises from genetic testing or the disclosure of genetic information.

Within the European Union, the General Data Protection Regulation (GDPR, 2016/679) treats genetic data as a special category of personal data and guards it against unauthorised processing, access, and disclosure (Kuru and Beriain 2022). Article 9 sets a general prohibition on processing genetic data, lifting it only where specific legal grounds apply, such as healthcare, research, or public interest purposes (Becker et al. 2024). When organisations fail to comply, Article 83 allows for considerable administrative fines, reaching €20 million or 4% of global annual turnover, whichever is greater (Wolff and Atallah 2021). As a whole, GDPR, however, is concerned mainly with the protection and privacy of genetic data rather than with genetic discrimination.

At the EU level, there is currently no specific legislation dedicated to prohibiting discrimination based solely on genetic information. Nevertheless, Article 21 of the Charter of Fundamental Rights of the European Union recognizes “genetic features” as a prohibited ground of discrimination, providing a broader equality framework rather than a specific genetic non-discrimination mechanism:

The GINA 2008 safeguards individuals in the United States against discrimination arising from their genetic information in employment contexts (Willard et al. 2025). In Title II of GINA (enforced by the Equal Employment Opportunity Commission), employers cannot use genetic information in hiring, promotion or promotion applications, termination, or employment relations. Furthermore, it prohibits employers from asking for or mandating genetic information in employees or job seekers (Becker et al. 2024; Willard et al. 2025). Despite its broad protections, GINA has few exceptions. The Act does not apply to employers less than 15 employees (Feldman 2012) nor it covers the United States military (Raines and Rohena 2025). Beyond this scope-based exclusions, the GINA permits six specific circumstances under which an employer may acquire genetic information from the workers. These includes inadvertent acquisition where those information obtained accidently; voluntary wellness programmes where only aggregate data is required rather than individual results (Willard et al. 2025); Family and Medical Leave Act Compliance; publicly available sources such as newspapers, book or website; genetic monitoring required by the law or offered voluntarily and forensic purposes. Furthermore, under Title 1, group health plans are allowed for requesting genetic testing for research purposes, provided the benefits are unaffected, voluntary and obtained data not used for underwriting. Notably, GINA does not apply to life insurance, disability insurance, or long-term care insurance, leaving these sectors unprotected (Prince and Roche 2014).

Furthermore, GINA encompasses other entities, such as employment agencies, labour organizations, joint labour-management committees, and apprenticeship programs, and which also cannot ask for or obtain genetic information or genetic testing results as prerequisites of employment. Labour laws adopting GINA regulations were adopted on 10 January 2011. Under the GINA, employers are allowed to ask for genetic information only in voluntary wellness programs (Feldman 2012). However, participation must be entirely voluntary, with employees protected from coercion, financial incentives to disclose, rewards for disclosure and penalties for not revealing. Unlike criminal penalties in Canada’s Genetic Non-Discrimination Act, GINA prescribes solely civil monetary sanctions and remediation measures, avoiding imprisonment.

Legislative protections against genetic discrimination in insurance

In Australia, insurance companies offering policies for death, permanent disability, trauma, and income protection are generally authorized to request genetic test results, which could affect premiums, policy terms, or eligibility for coverage. To address this, the Australian government introduced moratorium in 2019 on genetic testing in life insurance provides key protections, ensuring that individuals are not unfairly penalized for undergoing predictive genetic testing until at least June 2024 (Tiller et al. 2024). Specifically, it exempts applicants from mandatory genetic testing during risk assessments for life insurance applications. Furthermore, insurers are barred from soliciting or employing pre-existing genetic test results to escalate premium costs. However, this moratorium applies only to predictive genetic tests, and financial limits are applied based on the premium coverage. For instance, if an insurance application exceeds AUD 500,000 for death and total permanent disability cover, AUD 200,000 for trauma cover, or AUD 4,000 per month for income protection, the insurance company has the right to access genetic test results or request a test (Dowling et al. 2022). Recently, the government has established new protections against genetic discrimination in the insurance sector with the passage of the Treasury Laws Amendment (Genetic Testing Protections in Life Insurance) Act 2025 (Tiller, 2026). As effective April 1 2026, the legislation unconditionally prevents life insurers from using predictive genetics results for underwriting purposes, removing previous policy threshold. While aligning the Disability Discrimination Act 1992 with these new standards, the legislation maintains existing underwriting practices based on known family history and symptomatic diagnoses, and continues permits consumers the ability of voluntarily disclosing favourable genetic results to negotiate better policy terms.

Similarly, Singapore’s moratorium follows a comparable approach depending on the premium coverage amounts (Table 2) (Kim et al. 2021). The moratorium prohibits insurers from requesting predictive test results with exceptions policies with larger sum, such as life insurance exceeding SGD 2 million, total permanent disability insurance exceeding SGD 2 million or disability benefits compensating SGD 3,000 monthly (Moratorium on Genetic Testing and Insurance, 2025). If the said policy exceeds these limits, insurers may opt in requesting genetic test results but for specific conditions, such as BRCA1/BRCA2 mutations or Huntington’s disease.

Table 2.

Policy against genetic discrimination in ASEAN country

Country / region	Human genome project / genome-era reference	Legislation / policy name (genetic / genomic / personal data)	Notes	Reference
Malaysia	MyGenom (10 K)	Personal Data Protection Act 2010 (PDPA); Garis Panduan Etika Bioteknologi Malaysia (2025)	Covers personal / sensitive data; no dedicated genetic nondiscrimination law; relies on soft-law guidelines for genomics.	Garis Panduan Etika Bioteknologi Malaysia (2025)
Singapore	PRECISE SG10K, SG100K	Moratorium on Genetic Testing and Insurance (2025)	Protects personal data (including genetic); lacks explicit genetic nondiscrimination statute particularly to insurance.	Use of Genetic Test Results in Insurance Underwriting, (2025)
Thailand	Genomics Thailand (50 K)	Personal Data Protection Act 2019 (PDPA Thailand)	Covers personal and sensitive data, which also specifically mentions “genetics”. no specific laws or regulations that prohibit the use of genetic data in the life insurance business	Chatsuwan et al. (2023)
Philippines	Filipino Genome Research Project (FGRP)	Genetic Information Nondiscrimination Health Insurance Act 2004 (Pending)	A dedicated act on genetic nondiscrimination data was presented in Senate Bill No. 1698, 13th Congress of the Republic (pending on decision)	Kim et al. (2021)
Indonesia	National Genome Project (10 K); Biomedical Genome Science Initiative (BGSi)	Law on Protection of Personal Data (Law No. 27/2022)	Sensitive data protection; classifies “genetic data” (or “genetic information”) as “sensitive personal data; no explicit genetic nondiscrimination statute.	Resti et al. (2025)
Vietnam	VinBigData (1 K)	Personal Data Protection 2026 (replaces Decree No. 13/2023/ND-CP)	Protects personal data (biometric data, health and genetic information); no explicit genetic nondiscrimination statute	Huynh (2024)

These policy limitations, evident in both Australia and Singapore, point to an obvious dilemma of balancing between actuarial risk assessment and ethical anti-discrimination principles. While the implementation of the moratoria does protect low-income consumers, the inclusion of the financial thresholds applied in Australia (AUD 500,000) and Singapore (SGD 2 million) creates a two-tiered system of ethical protection, penalizing individuals seeking higher and more comprehensive coverage, effectively forcing them to choose between adequate insurance or genetic privacy. Australia’s decision to drop financial limits in its 2025 legislation signals a move toward general protection, recognizing that genetic data is fundamentally different from standard risk factors. In contrast, Singapore’s choice to keep its tiered system reflects a mindset that still treats genetic traits similarly to occupational hazards or a smoking habit. This divergence highlights a larger global issue: without a shared ethical framework, genetic privacy laws remain deeply fragmented, where the right to privacy is constantly negotiated against the actuarial demands of pricing and risk assessment.

The UK’s Code of Practice likewise allows insurers to use Huntington’s disease test results for life insurance policies over £500,000. Germany and Switzerland use a similar approach but with lower financial caps (Dixon et al. 2024). Hong Kong’s Best Practice Guidelines also restricts the use of predictive testing to high-value policies, but strictly limits it to specific conditions like Alzheimer’s, Lynch syndrome, hypertrophic cardiomyopathy, and Huntington’s. The US takes a firmer stance with GINA, completely banning the use of predictive genetic data for setting premiums. However, this ban has major exceptions: it does not apply to life, disability, or long-term care insurance (Feldman 2012). Even with these omissions, GINA’s blanket prohibition for health coverage offers more robust protection than the partial moratoriums seen elsewhere.

Laws regulating the collection and use of genetic information have to strike a careful balance in safeguarding individual privacy without creating roadblocks for scientific progress. These protections are well defined in the UNESCO International Declaration on Human Genetic Data (2003), which lays the foundation for collection, processing, utilisation and storage of human genetic data and as well as associated biological samples such as blood. (Abbing 2004; Ponomareva and Kubyshkin 2022). The Declaration stipulates that research with genetic information can be conducted with informed and explicit consent of the participates and with strict confidentiality (Abbing 2004; Gaydarska et al. 2024). In addition to requiring consent, dissemination of genetic data in any manner that results discrimination or stigmatization of individuals, families, ethnic groups, or populations strictly prohibited. Recognising the heightened vulnerability of certain groups, the Declaration enforces stricter protection for research involving minors, individual with intellectual disabilities or incapable of providing consent. In such cases, research is permissible only if: (a) it directly benefits the individual’s health, or (b) it poses minimal risk and no foreseeable harm. While the Declaration is technically a non-binding “soft law”, its real-world impact has been significant. It acts as a baseline for international research ethics, with countries like the United States, the United Kingdom, France, and China actively embedding its principles into their domestic laws (Joly et al. 2010).

The United States has multiple jurisdictions governing the genetic information pertaining to research area such as GINA, the Health Insurance Portability and Accountability Act 1996 (HIPAA), and the federal Common Rule for carrying out research on human subjects. HIPAA requires de-identification, data minimization, coding of the dataset, and access controls. It considers genetic information generated from clinical and research settings to be protected health information (Edemekong et al. 2025). In addition to existing jurisdiction, The Common Rule mandates Institutional Review Board oversight, informed consent, and protections for identifiable biospecimens (Gartel et al. 2020). Federal funders, such as the National Institutes of Health (NIH), sets rules regarding to data sharing which includes controlled-access repositories, data management plans, and documentation for secondary use. However, while these frameworks provide strong global governance for genetic research, it still lacks protections against risks related to life and disability insurance and re-identification risk management.

Genetic research in France is governed by the Patients’ Rights Law 2003 and other bioethics related frameworks (Gaille and Horn 2021). All studies requiring genetic testing must obtain explicit informed consent from the participants. As such, resulting data must comply with strict security and confidentiality requirements during processing and storage. Researchers are also required to inform the Commission Nationale de l’Informatique et des Libertés, France’s national data protection authority, of data collection and data storage activities (Zalnieriute 2020). Additionally, individual genetic results cannot be shared with the family, insurers, employee or any third parties without prior participant’s consent. The regulations protect individuals and ensure the ethical conduct of genetic research while minimizing possible data misuse.

In Germany, the Human Genetic Examination Act, which came into force in 2010, governs both clinical and research involving testing of human genes (Heidemann and Schillhorn 2011). Similar to France’s Patients Law 2002, it mandates researchers to obtain informed consent from participants and adhere to follow strict confidentiality protocols for all genetic information. Output generated through research regarding to genetic information cannot be used for discrimination by employers, insurers, or third parties against individuals. While federal and state anti-discrimination laws along with the National Health and Medical Research Council (NHMRC) guidelines offer baseline protections for genetic research participants in Australia (NHMRC, 2013), a significant gap remains: the lack of comprehensive national framework specifically addressing genetic discrimination in research. As a result, preventing the misuse of genetic data relies heavily on researchers strictly adhering to ethical guidelines to protect participants’ employment and service access. The NHMRC strongly advocates for informed consent and rigorous privacy protocols, but the inconsistent rules across different states often create a fragmented and confusing system for researchers to manage.

China’s existing human genetic resources have an official regulatory framework that is particularly relevant, specifically for the research area (Yang and Chu 2012). The Regulations on the Management of Human Genetic Resources (2019) define the rules for the collection, preservation, use, and transfer of human genetic material. These regulations are in line with the Biosecurity Law (2020), the Data Security Law (2021) and the Personal Information Protection Law (2021) to include an inclusive framework for monitoring and protection of genetic data (Song and Joly 2021). Genetic information research requires adequate permissions and compliance for storage, sharing, and security Violation of the regulation such a case of unauthorized human genetic resource export or wrong use would lead to a severe administrative punishment including but not limited to fines and collection of illegal genetic material. In case of breaches, the government is authorized to instruct the parties responsible to discontinue their operations, confiscate unlawfully obtained human genetic resources and affiliated illicit proceeds, and impose fines from CNY 1 million to CNY 10 million (Chen and Li 2024). Entities who collect, stores, or experiments with human genetic materials from China could be fined up to a maximum of CNY 5 million (Song and Joly 2021).

Where else, in Hong Kong, the Personal Data Ordinance is the main protective law for personal data when comes to genetic data (Cheung et al. 2021). In addition, the interpretation of the Disability Discrimination Ordinance also acts as a mechanism to prevent discrimination on the basis of certain genetic circumstances has taken on a judicial interpretational aspect. Since no explicit statute for genetic discrimination exists, these laws conjoin and provide protections for those involved in genetic research by laying forth stringent privacy requirements and forbidding discriminatory activities, as well as a mechanism for ethical and secure management of research-generated genetic data.

Safeguards for participants in genetic research are characterized by varying patterns among countries in Southeast Asia (Akash and Sarker 2023). Singapore is advancing safeguards through proposed measures, including the Health Information Act that would regulate the acquisition, storage and dissemination of private health information, including genetic data (Health Information Bill - Singapore Statutes Online, 2025). In many of the other ASEAN countries, genetic data protections are typically based on prevailing data privacy statutes or biomedical research ethical guidelines, rather than on specialized law targeting genetic discrimination. This creates a situation in which individuals taking part in genetic research in such countries may have relatively modest legal protection in comparison to the same individuals in legal jurisdictions with holistic legal frameworks. A closer look at how different regions manage genetic resources reveals a major blind spot: while there are plenty of guidelines for biobanking and data security, very few jurisdictions have actual, enforceable laws against genetic discrimination.

Potential for genetic discrimination among Malaysia’s multi-ethnic population based on disease-associated genetic profiling

The genetic diversity leads to differential prevalence and susceptibility rates of diseases in different populations and requires that healthcare system development be directed to these populations. To conduct sound case-control studies and accurately characterize disease predisposing alleles, we first need a thorough understanding of population genetic substructures.

The genetic heterogeneity across different ethnic groups means we cannot simply import risk-prediction models developed for European populations and expect them to work for Malaysia. As seen with the strong link between the HLA-B58:01 allele and allopurinol-induced adverse reactions, disease risk fluctuates heavily between ethnicities, reinforcing the need to base clinical predictions on domestic genomic data rather than imported models. For example, 100% of Chinese patients with AIS-SJS/TEN were positive for HLA-B58:01 while rates were less for Malays (odds ratio(OR) = 78), suggesting discrepancies in genetic predisposition (Low et al. 2020).

Ethnic characteristics are also relevant in the case of haematological diseases such as anaemia where Abdullah et al. (2020) reported that 13.8% of 102,388 participants aged 35–70 years presented with anaemia, most frequently microcytic-hypochromic, with the predominance of the Indian subpopulation, followed by the Malays and Chinese. Similar ethnic trends are seen in metabolic and cardiovascular disorders. In 30,721 Malays, 10,865 Indians, 25,296 Chinese, and 413,737 White subjects, Chinese were more likely to have low BMI and low fat, than Whites, with more appendicular lean mass, and BMI and fat mass were associated most strongly with systolic blood pressure and HbA1c among Chinese and Malay subjects, and less so among Whites (Carter et al. 2023). Additionally, Mohamed et al. (2024) found increased epicardial adipose tissue thickness in acute coronary syndrome patients, determined by type 2 diabetes and dyslipidaemia, and the thickest Epicardial adipose tissue in Chinese patients, in addition to age and diastolic blood pressure were also significant predictors.

Neurological diseases, such as myelin oligodendrocyte glycoprotein antibody-associated disease (MOGAD), present stark ethnic disparities (Ong et al. 2022). A very high percentage of all patients with MOGAD in Malaysia, who were mostly Indian, with a prevalence of 0.5 per 100,000 is recorded in the dataset. Most patients were relapsing rather than monophasic, with severe manifestations being particularly common in children and Chinese. Moreover, cognitive impairment indicates coexisting ethnicity and socioeconomic factors relating to older adults living in hardcore poor households reported 1.425-fold higher prevalence among Malays than non-Malays (Chinese and Indians), thus underscoring the cumulative impact of poverty and ethnicity on cognitive health (Foong et al. 2021). The disease burden among the Orang Asli is above that among the general population with respect to the soil-transmitted helminthiases and malnutrition (Mahmud et al. 2022). In face of socioeconomics changes, the academic research focus has increasingly turned to diseases not associated with infectious diseases, particularly in these communities.

This heterogeneity contributes to differing disease prevalence and susceptibilities among ethnic groups, which in turn raises the risk of genetic discrimination if disease-associated genetic profiling is used without appropriate safeguards. For instance, HLA-B*58:01 and other risk alleles seem to be highly linked with severe ADR in a subset of ethnic groups (e.g., those of certain ethnic communities, Chinese subjects in the allopurinol‑induced AIS study and haematological, metabolic, cardiovascular, neurological, and cognitive disorders with differing prevalence among ethnic populations. These findings demonstrate biological variation rather than discriminatory practice. Nevertheless, if interpreted without appropriate scientific, legal, or ethical safeguards, disease-associated genetic profiling could reinforce existing stigma or inequities by disproportionately categorising certain ethnic groups as genetically “high-risk.“Broader ethnic or socioeconomic disparities may further influence how genomic information is applied, although these should not be interpreted as evidence of genetic discrimination.

In a large U.S. study using the Medical Expenditure Panel Survey, minority racial/ethnic minorities (non-Hispanic Black and “Other” racial groups) reported more discrimination while receiving healthcare than non-Hispanic Whites (OR = 3.85 and OR = 3.07, respectively)(Kim et al. 2025). Similarly, another recent analysis combining data from a national research program documented that racial and ethnic minorities who reported discrimination in medical settings had higher odds of reporting poor health outcomes (Sabater M et al. 2025). At the same time, access to advanced medical technologies including genetic testing is still unevenly spread among certain minority populations, with one study finding that self-identified Black individuals were much less likely than Whites to go through with genetic testing, even after adjusting for sociodemographic and other confounding factors (Saylor et al. 2023). These international findings illustrate how existing social and ethnic inequities may affect the implementation of genomic medicine. However, they should not be regarded as direct evidence of genetic discrimination in Malaysia. Although the documented cases of genetic discrimination are still not evident in Malaysia, this lack of data presents an opportunity for anticipatory governance. Instead of waiting for problems to arise amidst the rise of genomic medicine, policymakers can craft the necessary ethical, regulatory, and legal frameworks to address possible risks. Such an approach can help ensure that disease-associated genetic profiling supports equitable precision medicine while minimising the potential for future discrimination or stigma.

Current state of genetic data protection in Malaysia

While neighbouring countries and several Western nations have established defined legal and policy frameworks for genetic protection, Malaysia continues to lack comprehensive safeguards in this area. (Gerard et al. 2025). It remains limited in terms of the legislations or policy or suggestions that form a part of it (Tables 3 and 4). Such example is The Personal Data Protection Act (PDPA) that was implemented in 2010. It provides most overall privacy protection by regulating the processing of all sensitive personal data, including health data that may be interpreted to encompass genetic data and portraited as sensitive data (Azuan et al. 2025). As stated in Sect.  4 (Definitions) of PDPA 2010, “sensitive personal data” defined as:

• “any personal data consisting of information as to the physical or mental health or condition of a data subject …”

Table 3.

Analysis of Malaysian laws, regulations, and ethical guidelines relevant to genetic data protection and genetic discrimination

Law / Guideline	Public Sector	Private Sector	Research	Insurance	Employment	Coverage of Genetic Data	Enforcement Authority
Personal Data Protection Act 2010 (Act 709)	No (generally does not apply to the Federal and State Governments)	Yes	Partially (private research institutions, private universities, private hospitals)	Yes (private insurers processing customer data)	Yes (private employers processing employee data)	Implicit only. Genetic data is not expressly defined but may be interpreted as “sensitive personal data” through health information.	Personal Data Protection Commissioner (Department of Personal Data Protection)
Personal Data Protection (Amendment) Act 2024	No	Yes	Partially	Yes	Yes	Improves personal data protection through breach notification, DPO requirements and stronger compliance obligations but still does not explicitly define genetic data.	Personal Data Protection Commissioner
Medical Act 1971 (Act 50)	Yes (government hospitals and registered practitioners)	Yes (private practitioners)	Indirectly	No	No	Genetic information is protected only as confidential medical information obtained during clinical practice.	Malaysian Medical Council (MMC)
DNA Identification Act 2009 (Act 699)	Yes	No	No	No	No	Covers forensic DNA profiles only; does not regulate clinical or predictive genetic testing.	Minister of Home Affairs. Royal Malaysia Police
Biological Resources and Benefit Sharing Act 2017 (Act 795)	Yes	Yes	Yes	No	No	Regulates access to biological resources but largely excludes human genetic resources, except limited ethical provisions.	National Competent Authority and relevant State Authorities
Biosafety Act 2007 (Act 678)	Yes	Yes	Yes	No	No	Does not regulate human genetic data; focuses on Living Modified Organisms (LMOs).	National Biosafety Board
Garis Panduan Etika Bioteknologi Malaysia (2025)	Yes (government agencies adopting the guideline)	Yes (where voluntarily adopted)	Yes	Indirectly	Indirectly	Explicitly recognises privacy, confidentiality and responsible use of genetic information.	Institutional adoption through research institutions, ethics committees and funding agencies

Table 5.

Summary of Malaysian studies addressing genetic testing, public perception, and implications for insurance

Date	Scope	Title	Genetic conditions	outcome	Study specific to life insurance	Reference
2025	56 participants were successfully recruited for this study, including 20 PD patients, 20 caregivers, and 16 healthcare professionals	Genetic testing for Parkinson’s disease in an underrepresented population: Knowledge, attitudes, and ethical considerations from a Malaysian perspective	Parkinson’s disease	Low genetic literacy, alongside the lack of established guidelines and genetic protection laws in Malaysia, significantly impedes the implementation of PD genetic testing in clinical settings	Privacy and confidentiality of genetic information: Many were hesitant to disclose results to employers and insurers as they feared being passed over for promotions or job opportunities, while others feared denial of insurance policies, adequate coverage, and increased premiums:	Gerard et al., (2025)
2023	384 responses in this study. Respondents who participated in this study were within the age range of 18–50 years old, Malaysian, and from different fields of profession	Knowledge, Awareness, and Perception of Genetic Testing for Hereditary Disorders Among Malaysians in Klang Valley	inherited diseases	Awareness of Genetic Testing for Hereditary Disorders: 155 respondent (34.8%) strongly agrees, 208 (44.6%) agree on the implementation of government laws and policies is needed to ensure the safe and effective use of genetic testing	most respondents were concerned about a person’s ability to obtain health insurance after receiving genetic tests. However, these factors were not discussed in this study.	Chin and Tham (2020)
2024	The study was conducted with a total of 15 parents.	Knowledge, awareness, and perception on genetic testing for primary immunodeficiency disease among parents in Malaysia: a qualitative study	Primary Immunodeficiency Disease (PID), also known as Inborn Errors of Immunity (IEI)	n/a	One primary challenge mentioned by the participants in the diagnostic journey is the financial aspect, as genetic testing can be costly, and insurance coverage may be limited or unavailable	Ahmad Azahari et al. (2024)
2014	Ethical, legal, and Islamic perspectives on genetic discrimination in medical takaful (Islamic medical insurance) in Malaysia	Addressing Genetic Discrimination in the medical Takaful System in Malaysia	Includes: single-gene disorders, multifactorial disorders, somatic mutations and mitochondrial disorders	Genetic screening affects underwriting decisions in medical takaful insurance.	concern relates mainly to the practice of the insurance industry whereby the latter use the applicant’s genetic information as a selection criterion in granting insurance coverage and as a determinant of the insurance premium	Saifuddeen and Mohamad (2014)

Section 4 defines ‘sensitive personal data’ as ‘any personal data consisting of information as to the physical or mental health or condition of a data subject.’ While ‘genetic data’ is not explicitly listed, it can reasonably be interpreted as falling within ‘health or condition’ data. However, several limitations exist:

• (1) The PDPA applies only to the private sector;

• (2) The PDPA does not prohibit discriminatory practices; it regulates processing but does not prevent insurance companies, employers, or service providers from using genetic information in a discriminatory manner;

• (3) The PDPA's 'express consent' requirement applies to processing but does not establish that genetic data requires heightened protections beyond other sensitive data;

• (4) The 2024 amendments, while strengthening the overall framework through data breach notification requirements and increased penalties, do not address genetic discrimination specifically."

As the PDPA’s Sect.  40 stipulates, users of data must obtain “express consent” from the data subject before processing their personally-secured information about him or her (Kamaruddin et al. 2025). Thus, as long as the users agree to the 3rd party’s use of such information, such information is free to be subjected to research regardless of the result. Furthermore, the new PDPA amendment in 2024 further follows these stricter regulations by de-designating data users as data controllers; designating biometric data as sensitive; raising penalties; imposing legal obligations on data processors; obligating organizations to appoint a Data Protection Officer (DPO) and ensuring that the new privacy regulation applies; requiring organisations to report breaches, establish a data portability right; modifying rules for transferring data among countries (cross-border), reforming specific definitions; and implementing each rule step-by-step; all of which effective since 2025 (Hamin et al. 2025). However, in light of these changes, the PDPA does not contain specific statements on genetic discrimination.

Malaysia’s closest protective measure against genetic discrimination is the newly established Garis Panduan Etika Bioteknologi Malaysia, which came into effect in 2025. Notably, this guideline draws upon various international frameworks, including the Canada Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans 2022, Australia’s Victorian Statement of Ethical Principles for Biotechnology in Victoria, the UK Policy Framework for Health and Social Care Research, the USA NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules, South Africa’s General Ethical Guidelines for Biotechnology Research, the Philippines National Ethical Guidelines for Research Involving Humans, Indonesia’s Pedoman dan Standar Etik Penelitian dan Pengembangan Kesehatan Nasional, Singapore’s Ethical Guidelines for Human Biomedical Research, and Thailand’s National Policy and Guidelines for Human Research.

Therefore, it presents a harmonized ethical framework for biotechnology practitioners, researchers, industries, and regulatory bodies. In particular, principles in the guidance include respect for human rights, protection of privacy, responsible use of genetic information, fair access to benefits, environmental protection, and protection against the misuse of biotechnology. Section  5.4, “Ethical principles”, states that all activities in biotechnology whether it is research, development, commercial and broad application must in some manner always follow the principles of dignity, rights and well-being of the individual.

In its place it is the responsibility of researchers and institutions to hold society not to discriminate, exploit or treat human beings at the expense of their dignity. At the same time, the data of individuals and genes must also be handled with strict compliance of privacy and confidentiality measures. It is suggested that data (for example, a person’s specific data) will not be sent to third-party suppliers, made available to them for any purpose with or without their consent that is not authorized in law nor is it disclosed or used for any purpose without their consent. Together, they should be the cornerstones to ensure that biotechnology is applied in a responsible, ethical, and with full respect for stakeholders. Collectively, these principles aim to guarantee that research in biotechnology is steered responsibly, ethically, and with due respect for all stakeholders.

“2. Menghormati maruah dan hak asasi manusia: Maruah dan hak asasi setiap individu hendaklah dihormati dalam semua penyelidikan, pembangunan, pengkomersialan dan penggunaan bioteknologi, termasuk memastikan tiada diskriminasi, eksploitasi, atau perlakuan yang merendahkan martabat manusia. 6. Privasi dan Kerahsiaan: Maklumat peribadi dan genetik individu hendaklah dilindungi daripada sebarang pendedahan atau penyalahgunaan tanpa keizinan yang sah.

Translated as:

“2. Respect for human dignity and human rights: The dignity and fundamental rights of every individual must be respected in all research, development, commercialisation, and use of biotechnology. This includes ensuring that no form of discrimination, exploitation, or treatment that undermines human dignity occurs. 6. Privacy and Confidentiality: Personal and genetic information of individuals must be protected from any disclosure or misuse without lawful consent.”

However, several limitations exit. Although these guidelines are ethically comprehensive and morally right, they are not binding under the law, hence making them incapable of fully preventing and countering genetic discrimination. Moreover, these guidelines promote fairness as ethical standards without consequences, as violations do not incur legal penalties unless supported by separate constitutional requirement. Consequently, their implementation is contingent upon the discretionary adoption by institutional frameworks, research governance entities, funding organizations, and ethical review boards, which may integrate them into their internal operational prerequisites.

The Medical Act 1971 serves as Malaysia’s primary legislation governing medical practice and the registration of medical professionals (Hidayani et al. 2023). This Act enables the Malaysian Medical Council (MMC), the responsibility for registering physicians, formulating professional and ethical guidelines, overseeing conduct and discipline, and ensuring the competency of medical practitioners. Because it is established only by the Act, the only legal persons entitled to practice medicine in Malaysia are registered medical doctors, and the MMC is empowered to conduct investigations and to carry out penalties on any practitioners who meet the above-mentioned ethical practice or professional standards. Moreover, the Act lays down how licensing, yearly practicing certificates, and medical qualifications will be issued. Under this Act, practicing in a medical state without registration is a fine-connected and a punishable offense (Hidayani et al. 2023). Like the Personal Data Protection Act 2010, both legislations are grounded against the principle of consent which implies the affirmative consent of an individual or a patient to disclose their genetic or personal information to third parties. However, there may be an apparent gap in both regulations since mismanagement or misuse of such genetic or personal data are not expressly covered in the provisions.

Although several Malaysian statutes regulate DNA or genetic resources, their primary objectives differ substantially from preventing genetic discrimination. These laws therefore provide only indirect or limited relevance to the governance of human genetic information. The DNA Identification Act 2009 establishes the legal framework for the collection, storage, and use of forensic DNA profiles for criminal investigations and identity verification (Karunanithi and Rajamanickam 2024). While it imposes confidentiality obligations and penalties for unauthorized disclosure of forensic DNA information, its scope is confined to law enforcement purposes and does not regulate clinical genomics, predictive genetic testing, employment, insurance, or research-related genetic discrimination. Therefore, under these reasons, the DNA Identification Act 2009 cannot be used a protection against genetic discrimination in general.

The Biological Resources and Benefit Sharing Act, 2017 is equally unsuited for this purpose either as it was created for the effective management of biodiversity conservation and establishment of the method of state regulation of biological resources (Tong 2020). Most of human genetic data is not covered by this law, with the exception of a few general regulations concerning permits allowing access to this data. Hence, neither of two laws can provide a sufficient mechanism for protection of people from genetic discrimination.

Table 4.

Malaysia laws, policies, and guidelines related to general genetic data protection, and privacy

Year Enacted	Type of legislation	Protection mechanism	Covered Entities	limitations	Reference
2010	Personal Data Protection (PDPA)	Regulates processing of personal data, including sensitive personal data (which covers health information; interpreted to include genetic data).	Private sector organizations handling personal data, including private hospitals, genetic testing companies, insurance companies, private labs	Sensitive data definition does not explicitly list genetic data, requires interpretation through “health information.” Does not address genetic discrimination in insurance or employment.	Kamaruddin et al. (2025)
2024	Personal Data Protection (PDPA) Amendment 2024	Introduces a legal definition of “personal data breach”, covering unauthorized access, loss, misuse	Same as Personal Data Protection (PDPA) 2010		Azuan et al. (2025)
2017	Biological resources and Benefit Sharing Act 2017	Regulates access to biological resources, including genetic material. Prevents unregulated bioprospecting and supports sovereign control of genetic resources.	Researchers, universities, foreign institutions, companies, collectors of biological/genetic material; state authorities; local communities	Does not regulate human genetic data, the Act applies only to non-human biological resources (plants, animals, microbes).	Tong (2020)
2025	Garis Panduan Etika Bioteknologi Malaysia 2025	Provides ethical standards for handling biological materials, including genetic and genomic data	Researchers, universities, biotech companies, healthcare institutions, government agencies involved in biotechnology policy	Not legally binding as compliance depends on institutions and funders; offers only ethical guidance.  No enforcement mechanism comparable to legislation (e.g., PDPA or Medical Act).	Garis Panduan Etika Bioteknologi Malaysia (2025)
2009	DNA Identification Act 2009 (Act 699)	Establishes the Forensic DNA Databank of Malaysia for criminal identification. Regulates the collection, storage, use, and retention of DNA profiles for law enforcement purposes	Police, authorised officers, forensic laboratories, individuals whose DNA is collected under investigation	Focuses solely on forensic DNA, not clinical or research genomic data. Does not regulate genetic discrimination, health genomics, or personal genomic testing	Karunanithi and Rajamanickam (2024)
2007	Biosafety Act 2007 (Act 678)	Regulates Living Modified Organisms (LMOs) and products containing LMOs. Requires risk assessment, risk management, and approval before import, export, release, or contained use of LMOs.	Researchers working with GMOs, universities, biotech companies, importers/exporters, laboratories, containment facilities, and any entity handling LMOs.	No protection of human genetic data as it does not regulate genomic information or genetic discrimination	Kalidasan and Theva Das (2021)
1971 (substan-tially revised in 2012)	Medical Act 1971	Indirect protection only, requiring doctors to maintain patient confidentiality, which implicitly includes genetic information collected during medical practice.	Medical practitioners	Confidentiality obligations do not extend to insurers, employers, researchers, or non-medical entities. - Enforcement mechanism focuses on professional misconduct.	Hidayani et al. (2023)

Why Malaysia does not yet have a dedicated law for genetic discrimination

Now with significant advances in genomics and extensive applications of genetic information to health, research, and private testing services, Malaysia does not have a separate law banning genetic discrimination specifically. In its previous legislation, such as the PDPA, Medical Act, and DNA Identification Act, it dealt with aspects around privacy, confidentiality and handling of forensic DNA. However, none prevents misuse in specific areas, for instance personal insurance decisions, career protection laws from employers, or service provision. This legislation gap sterns from a combination of interlinked structural, socio-economic and policy barriers.

Firstly, the Malaysian genomics ecosystem is nascent and large-scale participation in genomic medicine is an emerging phenomenon with the only recent development emerging over the last 10 years, via efforts such as MyGenom, and academic-led health-genomics initiatives. In particular, MyGenom represents Malaysia’s first large-scale population genomics initiative, sequencing the genomes of citizens from diverse ethnic backgrounds. The project is now in Phase II, with a target of 10,000 sequenced genomes by 2028, and aims to build a representative national genomic dataset to support the advancement of Precision Medicine in the country.

Despite that, Malaysia, as opposed to the US or Europe, where commercial and personal genomics saw early adoption, has not yet reached a threshold in which there is a need for public discussion about the use of genetic material or regulatory involvement. As a result, the scarce number of published instances of Consequently, the limited documentation of genetic discrimination cases in Malaysia may have contributed to the lower visibility of this issue within public and policy discussions. However, the absence of reported cases should not be interpreted as an absence of potential risk, as demonstrated by jurisdictions such as the United States, where dedicated genetic non-discrimination legislation was introduced despite limited documented cases of discrimination. Secondly, genetic testing in Malaysia is relatively low as it is significantly influenced by cost, which remains a major factor contributing to the limited uptake of such testing in Malaysia where prices are quite high. Aizuddin et al. (2021) reported individuals who hold private health insurance are more willing to pay for genetic testing for screening cancer in the absence of public insurance since the rich are in a better position to bear the cost of testing (Table 5). The result also supports the findings of Padmanabhan et al., (2025). In a study related to willing to pay out of pocket for genetic testing among ovarian cancer patients, Padmanabhan et al., (2025) found that individuals who were willing to pay for the test, only 50% proceeded, suggesting that even if they were willing to pay, there were other considerations against genetic testing. According to the author of studies, 58% stated willingness to pay for BRCA genetic test at a median of MYR1,000, only 17% completed the BRCA genetic test when receiving no subsidy showing that an important prohibitive factor for the uptake of genetic tests is cost (Padmanabhan et al. 2025). The above-mentioned circumstances, when combined with the high cost of genetic testing and heavy reliance on public health care, still hinder the use of genetic testing in Malaysia. Limited demand and economic constraints have consequently diminished the perceived urgency for a genetic discrimination policy.

Aspects of public awareness and genetic literacy apparent among populations are second major contributing factors (Young et al. 2021; Kutanan et al. 2022; Tran et al. 2025). Most of the community of Malaysians has been shown to not understand much about how genetic identification information may be misused for discriminatory practices in insurance, job disparities, job-disadvantages, or social stigma (Ahmad Azahari et al. 2024). For instance, a study of genetic testing for hereditary disorders among Malaysians in the Klang Valley found that almost half of respondents (50.2%) indicated for wanting to undergo genetic testing, while 24.5% were negative and 25.3% remained neutral (Chin and Tham 2020). In this view, the awareness is not confined by development of a country as nation such as the US also shown that a large portion (43%) of the general public lacks’ awareness toward genetic testing (Krakow et al. 2017). Chin and Tham (2020) also reported that the 75.5% respondent agrees that necessary to raise awareness of genetic testing is much needed in Malaysia.

In addition, Malaysia has relied on framework-based governance rather than standalone Acts in emerging fields (Ahmad et al. 2025). In such fast-moving technologies, bioethics guidelines, research standards and ministry-issued policies are often favoured to prevent legal inflexibilities (Kalidasan and Theva Das 2021; Kendal 2022; Gopalan et al. 2025). According to the Garis Panduan Etika Bioteknologi Malaysia (2025), the same approach provides guidance but is not legally enforceable. Yet, these soft-law mechanisms do not provide adequate deterrent capacity or accountability, therefore a pressing need for statutory protection as genome science is widely developed (Chapman et al. 2020; Kim et al. 2021).

Recommendation: integrating genetic non-discrimination into Malaysia’s legal framework

Following the international guidelines, Malaysia should gradually implement the protection of genetic in stages. Rather than making a sudden overhaul, the country could implement few quick measures and later develop the legislation gradually, leading towards the passing of a complete Genetic Non-Discrimination Act that will ensure effective enforcement of the provisions. The proposed act contains the prohibition for insurance companies to require the implementation of predictive genetic testing, except for the cases when insurance agreements with coverage exceeding MYR 500,000 are to be signed. There are several rare diseases such as Huntington’s disease and BRCA1/2 mutations that will be allowed for the purpose of predictive genetic testing (Table 6). Therefore, it should be noted that in insurance underwriting genetic data can only be used after a customer gives his or her consent.

Table 6.

Recommended financial limits approved predictive genetic tests based on international moratoria

Insurance type	Financial limits	Approved predictive genetic test / Approved genetic marker
Life insurance	Insurance coverage exceeding MYR 500,000; total sum of all life insurance from different policy (cumulative) exceeding MYR 500,00	Huntington’s disease
Total Permanent Disability Insurance	Insurance coverage exceeding MYR 500,000
Long-term Care Insurance under (X month)	Insurance pays out exceeding MYR 6,000 monthly benefit	Huntington’s disease (HTT) Breast cancer (BRCA1) Breast cancer (BRCA2)
Long-term Care Insurance under (Y month)	Insurance pays out exceeding MYR 12,000 monthly benefit
Critical Illness Insurance	Insurance coverage exceeding MYR 500,000
Disability Income Insurance	Insurance pays out exceeding MYR 10,000 monthly benefit

For policies above these thresholds, insurers have the right to request genetic data only with the consent of an applicant who has given explicit and informed written documentation. Examples of such provisions might include:

• "No insurer shall request, require, or use predictive genetic test results as a condition for the provision, continuation, or pricing of any insurance policy, except where:

• (a) the total sum assured exceeds MYR 500,000 for life insurance, total permanent disability insurance, or critical illness insurance;

• (b) the monthly benefit exceeds MYR 6,000 for short-term long-term care insurance or MYR 12,000 for long-term care insurance; or

• (c) the monthly benefit exceeds MYR 10,000 for disability income insurance.

• Where such exceptions apply, the insurer may request genetic test results only with the explicit, free, and informed written consent of the applicant, and only for a prescribed list of clinically validated genetic conditions, including “X” and “Y” mutations.”

Although the proposed MYR 500,000 threshold for high-value life insurance represents a solid baseline, it should not necessarily be perceived as permanent. In determining the ideal limit for Malaysia, it is essential for policymakers to conduct several consultations with key regulators, insurers, healthcare professionals, and civil society stakeholders while examining the dynamics of the Malaysian market as illustrated by average policy amounts, rate of penetration of life insurance in society, and socio-economic determinants. Such an approach maximizes the chances of creating a comprehensive framework that safeguards genetic information and balances it with the necessity of ensuring the industry’s ability to reduce adverse selection.

In the short run, Bank Negara Malaysia could (BNM) place a temporary moratorium on using genetic information or proposing relevant regulations guided by the provisions of the Financial Services Act 2013. In particular, the enforcement provisions in Sect.  123 that relates to business conduct and Sect.  133 which requires customer privacy could create a sufficient legal base for controlling the use of genetic information by insurers (Bank Negara Malaysia 2013). In terms of enforcement mechanisms, BNM could require insurance companies to provide audit trails and compliance reports with the purpose of applying fines or license withdrawal in case of violation of established regulations.

In addition to the regulation in the insurance industry, it is also necessary to protect employees from being forced to undergo genetic tests. Thus, it would be appropriate to amend the Employment Act 1955 that would make it illegal for employers to compel applicants to undergo the genetic testing.

Recommending clause would be:

• “An employer shall not require an employee or job applicant to undergo genetic testing, nor shall employment decisions be made based on genetic information, except where legally required for specific occupational health and safety reasons”.

Enforcement could be undertaken by the Ministry of Human Resources, the Labour Department, and the Industrial Court through existing employment dispute mechanisms. These protections would include employment agencies, traineeship initiatives and labour unions, and most importantly should be supported by enforcement mechanism which includes civil penalties, grievance channels and compensation for people who are affected. In addition to that, introducing legally binding legislation could significantly encourage responsible understanding and ethical use of genetic data, similarly seen in international governance. In relevance to research and discovery field, Malysia should make the enforcement of the Garis Panduan Etika Bioteknologi Malaysia compulsory and incorporate it with the UNESCO International Declaration on Human Genetic Data as a standard for the adoption of legal binding consent, participants privacy, ethical use of human genetic material and access by 3rd party. Proposed portions of the guidelines could be:

• “All research involving human genetic material must obtain free, informed, and express consent from participants. Data shall be anonymized, securely stored, and may not be shared with third parties without explicit consent, except as authorized under law”

Compliance should be overseen by the Ministry of Health, the Medical Research and Ethics Committee (MREC), and institutional research ethics committees through ethics approval, monitoring, and periodic audits. A central oversight institution could be set up at ministry level to act as a check on compliance, and monitor handling of data, audit breaches, as well as coordinate with institutional ethics committees. Other wording might impose sanctions for unauthorized export, misuse or sale of genetic material, inspired by China’s stringent regulatory regime. There are certain amendments which do integrate into current law very effectively. The Personal Data Protection Act 2010 would be amended to include genetic information in a ‘sensitive’ personal data category, adding:

• Processing of genetic information shall require express consent, and any unauthorized disclosure or discriminatory use in insurance, employment, or service provision shall constitute an offense subject to civil and criminal penalties”.

These provisions should be enforced by the Personal Data Protection Commissioner through investigation, administrative enforcement, and statutory penalties.

The current Medical Act 1971 could also be amended by applying provisions requiring medical practitioners to protect the confidentiality of patients’ genetic information and particularly the disclosure of that information to third parties with prior consent. Professional compliance could be monitored by the Malaysian Medical Council.

On contrary, if immediate amendments to the current existing laws and policies to prevent genetic discrimination prove unfeasible, a standalone moratorium as an interim measure should be implement, reminiscent of Singapore and Australia. The implementation of this interim measure would protect the citizens of Malaysia in the fields of insurance, employment, and research, while providing lawmakers with sufficient time to create and discuss an effective legislative measure, intended to resolve the problem in the long-term perspective. In order to make this process faster, a moratorium could be issued in the form of a ministerial order from the Ministry of Health, which would allow such moratorium’s immediate implementation and give an opportunity to refine its regulations in accordance with the arising ethical and operational problems.

This phased approach makes it possible for Malaysia to provide immediate regulatory protection and make gradual adjustments of the current legislation leading to the adoption of the Genetic Non-Discrimination Act. By establishing an effective system of enforcement and distributing the responsibilities among the institutions, this approach is intended to create trust and ensure safe use of genomic medicine in the country.

Conclusion

While the MyGenom Project marks a big step in Malaysia’s efforts in genomic medicine, there is still a significant gap in the protection of its citizen from genetic discrimination. The absence of effective laws puts the public in a vulnerable position when dealing with employment, insurance, and research. The result could lead to low participation in genomic studies and the erosion of trust in Malaysia’s genomic projects. There are laws now, but they are generic and refer to unrelated areas such as privacy concerns and business conduct. Thus, insurance companies and employers operate in grey areas.

The solution suggests a multi-faceted plan which would be executed in steps rather than a single reform. The first step can be made by the Bank Negara Malaysia issuing interim instructions or a moratorium within the framework of The Financial Services Act 2013 in order to give lawmakers time to create a valid law. There should be amendments to The Employment Act 1955, The Personal Data Protection Act 2010, and The Medical Act 1971 in order to close the gaps in relevant areas such as workplace, data, and medical confidentiality. The safety of research participants must be uniform, which means that Malaysia’s bioethics regulations must be implemented and meet international norms on consent, protection, and usage of genetic information.

The ultimate aim would be to formulate a comprehensive Genetic Non-discrimination Act, which puts together all the safeguards in one statutory instrument and guarantees the enforcement of responsibility as well as the existence of monitoring and effective penalties for violations of the legislation. In order for this system to work, decisive action on the part of the government is much needed. In case Malaysia implements these targeted measures, it will not have to merely catch up with international standards but will be able to act as a model for genome ethics in the region as well.

Author contributions

Conceptualization, M.M., S.A., R.A.R and B.A.Z.Writing, original draft preparation, M.M. and Y.M.N. Writing, review and editing, M.M, S.A., Y.M.N and B.A.Z.

Funding

Not applicable, no funding received.

Data availability

No datasets were generated or analysed during the current study.

Declaration

Competing interests

The authors declare no competing interests.

Conflict of interests

The authors declare no conflict of interest.