Home › Corporate health guide › Data protection and confidentiality

Corporate health guide

Data protection and confidentiality: keeping results with the person

Reviewed by Dr. Daniel Wallerstorfer, molecular biologist and founder of Novogenia · Updated: 15 October 2026 · Reading time: 9 min

In short

Under the GDPR, genetic data belong to the specially protected categories (Art. 9); in Switzerland, they are sensitive personal data (Art. 5 FADP). In an employment relationship, consent given to the employer is rarely truly voluntary – which is why the European Data Protection Board considers it problematic. The cleanest solution: the company processes no genetic data at all. Employees consent directly to the lab or partner, the report goes to them only, and the company receives neither individual results nor aggregated reports. Whether Section 26 BDSG holds up after the 2023 CJEU ruling is an open question – a program built this way does not need it for genetic data.

Like a polling booth – only stricter

Genetic data are not ordinary data. The GDPR describes them as data on a person’s inherited or acquired genetic characteristics that give unique information about their physiology or health (Art. 4(13) GDPR). Whoever knows your genes knows something you carry with you all your life. That is why processing them is prohibited in principle – unless an exception applies (Art. 9(1) and (2)).

A good company program therefore works like an election. The company provides the polling station: the room, the time, the invitation. Nobody looks into the booth. And unlike an election, there is not even an overall result for the company at the end – the results stay with the people they belong to.

Here you will find the legal reasoning behind this, and which questions remain open – as a complement to the overview in Corporate health programs with genetic analyses.

Who sees what: the data flows of a program

Before you talk about legal provisions, map out the data flows. For a lifestyle analysis, a clean program looks like this:

Data	Where they go	What the company sees
Registration and consent	from the employee directly to the lab or partner	Nothing
Saliva sample	straight to the lab, never through the company	Nothing
Genetic data and report	from the lab to the person only, digitally via a secure portal	Nothing
Personalized supplements (optional)	formula, report and delivery go directly to the person	Nothing
Invoice	to the company	The invoice – no results
Program feedback	anonymous, to the company or its workplace-health partner	Satisfaction and suggestions, never genetic content

Two points deserve special attention. A personalized supplement formula reveals something about the genes of the person who receives it. So even if the company pays for it, it should go directly to the person. And billing: design it so that the company learns as little as possible about who took part individually. That is not a detail – whoever knows who joined also knows who did not.

The obvious exception for genetic data is explicit consent for specified purposes (Art. 9(2)(a) GDPR). It can be withdrawn at any time, and withdrawing must be as easy as giving consent (Art. 7(3)). The real problem at work is a different one: voluntariness.

Where there is a clear imbalance between the parties, consent does not provide a valid legal basis if it is therefore unlikely to have been freely given (Recital 43). The European Data Protection Board is explicit in its Guidelines 05/2020: because of the dependency in an employment relationship, it is unlikely that employees can refuse their employer’s request without fearing detrimental effects. They can only consent freely in exceptional circumstances – when it will have no adverse consequences at all whether or not they consent (paras. 21–22).

Two rules follow:

Consent goes to the right address: to the lab or partner that processes the data – not to the company. For medical analyses in Germany, the person gives explicit written consent to the responsible physician (Section 8(1) GenDG).
The setting makes “no” easy: no participant lists with managers, no reminders from supervisors, no perks reserved for participants. How to invite without building pressure is shown in Internal communication: participation without pressure.

Employee data protection: what the 2023 CJEU ruling changed

For employee data, Art. 88 GDPR allows member states to adopt more specific rules. These must include suitable and specific measures to safeguard human dignity, legitimate interests and fundamental rights, particularly regarding transparency (para. 2). Germany created Section 26 of the Federal Data Protection Act (BDSG) for this purpose. Among other things, it provides that the dependency inherent in employment must be taken into account when consent is given, that consent must be in writing or electronic, and that the employer informs employees in text form about the purpose and their right to withdraw (para. 2). For special categories such as genetic data, consent must refer expressly to these data (para. 3).

On March 30, 2023, the Court of Justice of the European Union issued a landmark ruling on this (Case C-34/21). A national provision is a “more specific rule” only if it meets the requirements of Art. 88(2); otherwise it must be disapplied, unless it constitutes a legal basis of its own under Art. 6(3) GDPR. The case concerned teachers in the German state of Hesse and a state provision structured much like Section 26(1) BDSG. The Court indicated that a rule which merely repeats that processing must be necessary does not add a more specific rule. It did not rule on Section 26 BDSG itself; the provision remains unchanged in the statute book.

What does this mean for your program? Less than you might think – if you build it correctly. Under Section 19 GenDG, the company may not receive genetic results in any case. If it processes no genetic data, it needs no legal basis for doing so. The requirements of Section 26(2) remain a good benchmark for every consent in the program all the same: in writing or electronic, with a clear purpose and a note on the right to withdraw.

Anonymous is not always anonymous

“We just want to see the statistics.” The wish is understandable. The GDPR sets a high bar here: whether a person is identifiable depends on all the means reasonably likely to be used to identify them directly or indirectly – such as singling out. Pseudonymized data remain personal data; only truly anonymous information falls outside data protection law (Recital 26).

In a small department, statistics can quickly be traced back to individual people. That is why the rule at Novogenia is: the employer receives no individual results and no aggregated reports either. The program is evaluated through participation, satisfaction and anonymous feedback – never through genetic results. How to turn that into meaningful metrics is shown in Measuring benefits and impact. Even participation figures should only be reported for larger units, not for individual small teams.

Switzerland: the Data Protection Act and the Code of Obligations

In Switzerland, the Federal Act on Data Protection (FADP) applies instead of the GDPR, and the Code of Obligations governs employment. The logic is similar; the details differ:

Sensitive data: genetic data are sensitive personal data (Art. 5(c)(3) FADP).
Consent: it is valid only if given voluntarily for one or more specific processing activities after adequate information; for sensitive data it must be explicit (Art. 6(6) and (7) FADP).
No longer than necessary: personal data are destroyed or anonymized as soon as they are no longer needed for the purpose (Art. 6(4) FADP).
A tight limit for employers: they may process data about employees only insofar as it concerns their suitability or is necessary for the employment contract (Art. 328b of the Code of Obligations, OR). Genetic results have no place with the employer.
Information and testing abroad: for lifestyle analyses, written information covers, among other things, the lab and any companies and labs abroad involved (Art. 32 GUMG). Testing abroad requires, among other things, the person’s written consent (Art. 36 in conjunction with Art. 29 GUMG).

Roles, contracts and impact assessment

A program has several parties: the company, often a workplace-health partner, the lab and, for medical analyses, physicians. Whoever determines the purposes and means of processing is the controller; whoever processes on someone else’s behalf needs a contract under Art. 28 GDPR. Define the roles before the first registration comes in – not afterward.

Anyone who processes genetic data on a large scale must carry out a data protection impact assessment in advance (Art. 35(3)(b) GDPR; in Switzerland, Art. 22 FADP). In a cleanly built program, that task lies with the lab or partner, not with the company. What counts for employees in the end is clear information: who processes which data, who sees the report – and that the company never sees it. In Germany, the works council’s participation rights remain unaffected (Section 26(6) BDSG). More on roles and deletion periods in Genetic data and the GDPR.

Data protection checklist for your program

The data flows are mapped out; the company processes no genetic data.
Consent goes directly to the lab or partner – explicit, for specified purposes and revocable at any time.
Those who do not take part face no disadvantage of any kind; managers keep no lists.
Report, supplement formula and delivery go directly to the person.
Billing reveals as little as possible to the company about individual participants.
No aggregated genetic reports; participation figures only for larger units.
Roles and contracts are settled before the first data flow; the impact assessment lies with the responsible party.
In Switzerland: written information under Art. 32 GUMG and written consent to testing abroad.
The data protection officer and the works council are involved early.

Frequently asked questions

Is it enough if the company only receives anonymous statistics?

No, for two reasons. First, “anonymous” is often not anonymous: under Recital 26 GDPR, every means reasonably likely to be used to identify a person counts – and in small teams that happens quickly. Second, at Novogenia the employer receives no aggregated reports either. Evaluate the program through participation and anonymous feedback, never through genetic results.

Who is the “controller” under the GDPR in such a program?

That depends on the setup – the lab, the partner and, where relevant, physicians can hold different roles. At Novogenia, we set out the roles together in the contract before the first data flow. The goal of every setup: the company itself processes no genetic data.

Can an employee withdraw her consent?

Yes, at any time – and withdrawing must be as easy as giving consent (Art. 7(3) GDPR). For medical analyses in Germany, she can withdraw her consent at any time with effect for the future by telling the responsible physician (Section 8(2) GenDG).

Is Section 26 BDSG still valid?

It remains unchanged in the statute book. In 2023, however, the CJEU ruled that national employee data protection rules are “more specific rules” under Art. 88 GDPR only if they meet paragraph 2 of that article; otherwise they must be disapplied (Case C-34/21). Whether Section 26 BDSG meets that standard, the Court did not decide itself. For your program, this is secondary if the company processes no genetic data.

What else do employees in Switzerland need to know?

For lifestyle analyses, they must receive written information about, among other things, the lab performing the test and any companies and labs abroad involved, with contact details of a professional and of the person responsible for data processing (Art. 32 GUMG). Testing abroad – Novogenia’s lab is in Austria – requires, among other things, their written consent (Art. 36 in conjunction with Art. 29 GUMG).

A health offer for your team?

Tell us about your company – we will show you how a voluntary offer for your employees could look.

Request a project →Corporate health in the longevity guide

Note: This guide is general information for businesses and professionals and does not replace medical or legal advice. The genetic traits determined in a genetic analysis are well documented (each gene included is backed by at least three independent studies); recommendations derived from them are logical conclusions, not scientifically proven. Regulations can change; errors and changes excepted.