UNESCO Recognises Neural Data As Sensitive. What Does It Mean For India?

 

What happens when the data being collected from a neural headset is not just about what you did, but potentially about what is happening inside your mind? That is the significance of UNESCO's 2025 Recommendation on the Ethics of Neurotechnology. The organisation's General Conference adopted the Recommendation, recognising that neural data, and data from which mental states can be inferred, deserve heightened protection.

There is an important legal footnote here. A UNESCO Recommendation is not a binding treaty. It does not automatically become law in India or anywhere else. Instead, it establishes an international benchmark and asks member states to give effect to its principles within their own constitutional and legal systems. UNESCO is essentially saying that information generated from the brain is different enough, and potentially intimate enough, to require serious protection.

 

India's timing makes the issue particularly interesting. Two days after UNESCO adopted its Recommendation, India's Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025, providing the operational framework for the Digital Personal Data Protection Act, 2023.

At first glance, this might look like perfect timing. The world is talking about protecting neural data and India has just operationalised its new data-protection framework. But there's a catch. The Indian framework currently treats personal data as a broad category. It does not specifically create a protected legal category for neural data or information that can be used to infer someone's mental state.

Another catch is that the Rules do not all take effect at once. The provisions establishing the Data Protection Board took effect upon notification, while several provisions that would govern practical aspects such as consent notices, security safeguards and cross-border data transfers have a longer commencement period, described here as taking effect around mid-2027. So the legal machinery exists, but some of the machinery that matters most for data protection is still waiting to switch on.

 

Here's where neurotechnology creates a problem that conventional privacy law wasn't necessarily designed to handle. Suppose an EEG device records a neural signal. Now suppose software analyses that signal and says: this person appears distracted. That's something else. Suppose another system takes that inference and concludes: this person is unsuitable for this job. We have now travelled a considerable distance from just collecting data.

A person might agree to the collection of neural signals without understanding that those signals could later be processed to generate information about their mental state. It is rather like agreeing to someone taking a photograph of your face without realising they will use it to determine your mood, personality or susceptibility to advertising.

 

Modern privacy systems often depend on consent. You scroll past the privacy notice and click “agree”. But how meaningful is that consent when even the user cannot reasonably anticipate what future algorithms might extract from their neural signals?

This is one of the major challenges identified in the material. The law may need to distinguish between consent to collect neural data and consent to use that data to generate mental-state or cognitive inferences. Imagine buying a pair of EEG-enabled earbuds. You might agree that the device needs to collect brain signals for its stated function. That doesn't necessarily mean you have agreed to the company determining your mood or attention level, building a cognitive profile and using it for advertising. The more powerful the inference, the harder it becomes to hide behind a generic “I agree”.

 

There is another important idea here: cognitive security. Traditional cybersecurity asks whether someone has gained unauthorised access to your data. Cognitive security asks a more uncomfortable question: What if the data is collected legally and then used legally but in a way that harms you? Consider a workplace where employees wear devices intended to measure fatigue or attention.

Maybe the system works exactly as advertised. But what happens if an employer begins using those cognitive profiles when making hiring, firing or promotion decisions? Or a consumer device that infers mood and shares those conclusions with another company. Nobody necessarily hacked anything. The problem is that the legitimate use of the data has itself become intrusive. This is why purpose limitation and data minimisation become particularly important for neurotechnology.

 

India's Constitution may offer some protection even before Parliament creates neurotechnology-specific rules.

In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the Supreme Court recognised privacy as part of the fundamental rights framework under Article 21, including dimensions of dignity and autonomy.

Earlier, in Selvi v. State of Karnataka (2010), the Court considered the involuntary extraction of information from a person's mind through techniques such as narco-analysis.

 

Neither judgement explicitly establishes a standalone constitutional right called “cognitive liberty” or “mental privacy”. But they provide an important foundation for arguments that privacy and autonomy should extend to the mind as neurotechnology develops. The legal question then becomes extraordinary: How far can the state go in trying to extract information from someone's brain without violating the person's autonomy and privacy?

 

The device could be sold in India. The company could be headquartered in the United States. The software could be developed elsewhere. The data could be stored on servers in another country. The algorithm making the inference could operate somewhere else entirely.

 

If an Indian consumer believes their mental privacy has been violated, whom do they complain to? UNESCO’s recommendation recognizes these cross-border challenges and calls for stronger accountability mechanisms for providers of high-risk neurotechnology, including accessible grievance mechanisms and transparency about where and how inferences are made. For India, that suggests a possible direction for future regulation: foreign neurotechnology companies serving Indian consumers could potentially be required to provide accessible grievance mechanisms and explain their inference practices.

A future neurotechnology privacy dashboard might show a user not merely what data a company possesses, but what the company has inferred from that data. We are not yet living in a world where consumer devices can simply read people's thoughts like science-fiction machines.