Home › Lab data guide › Data protection and roles

Data protection and roles between lab and manufacturer: who is responsible for what with genetic and blood data

Reviewed by Dr. Daniel Wallerstorfer, molecular biologist and founder of Novogenia · Updated: 13 October 2026 · Reading time: 11 min

Who is directing? Why roles matter in data sharing

A lab measures. A manufacturer calculates and blends. In between travel some of the most personal data a person has: their genome and their current state of health. As soon as these data change hands, data protection law asks a simple question: who is responsible for what?

On a film set, it is clear who directs, who runs the camera and who co-produces. In data sharing between lab and manufacturer, it has to be just as clear – because duties follow the role: Who obtains consent? Who informs the customer? Who answers a request for erasure?

Why genetic and blood data are specially protected

The General Data Protection Regulation (GDPR) uses two terms that are central for labs and data owners:

• Genetic data: personal data relating to the inherited or acquired genetic characteristics of a person which give unique information about their physiology or health and which result, in particular, from an analysis of a biological sample (Art. 4(13)).
• Data concerning health: personal data related to physical or mental health which reveal information about a person’s health status (Art. 4(15)). Recital 35 expressly includes information derived from the testing or examination of a bodily substance – in other words, blood values too.

Both belong to the special categories of personal data. Processing them is prohibited (Art. 9(1)) unless one of the exceptions in Art. 9(2) applies. For a follow-up product, the main option is explicit consent. Member States may also introduce further conditions for genetic data and data concerning health (Art. 9(4)). Additional national rules in Germany and Austria are covered in Genetic data and the GDPR.

Director, crew, co-production: the three GDPR roles

The GDPR assigns responsibility along three roles:

• Controller – the director: decides, alone or jointly with others, on the purposes and means of processing (Art. 4(7)).
• Processor – the crew on set: processes data on behalf of the controller (Art. 4(8)).
• Joint controllers – the co-production: jointly determine the purposes and means (Art. 26(1)).

The role follows from what actually happens, not from the heading in the contract, as the European Data Protection Board stresses in its Guidelines 07/2020. A processor that infringes the GDPR by determining the purposes and means itself is considered a controller in respect of that processing (Art. 28(10)).

Three typical setups between lab and manufacturer

For a follow-up product based on lab or genetic data, three models are possible, depending on who decides what:

No setup is right by default. The role must fit how you actually work together and be in writing before data flow. At Novogenia, we define the roles for your project in the contract.

The legal basis: explicit consent for a specified purpose

Explicit consent has to relate to one or more specified purposes (Art. 9(2)(a)). This is a typical trap for data owners: if the data were collected for a lab analysis, the follow-up product is an additional purpose. And data may not be further processed in a manner that is incompatible with the original purpose (Art. 5(1)(b)).

So check whether your consent covers the follow-up product and, where needed, obtain new consent before passing on data. Four points matter:

• Specific: Name the follow-up product, the data used (for example genes, blood values, questionnaire, body data) and the manufacturer as recipient. At Novogenia, the formula is recalculated for every production run; include that, too.
• Clearly separated: If it sits in a document covering other matters, it must be clearly distinguishable and easy to understand (Art. 7(2)).
• Demonstrable: The controller must be able to demonstrate that the person has consented (Art. 7(1)).
• Revocable: Consent can be withdrawn at any time, as easily as it was given (Art. 7(3)). Define what then happens to the data, the subscription and open production runs.

Your own brand, complete information: who tells the customer what?

Your brand can take center stage; the privacy notice still has no blank spots. If you collect the data from your customers, you inform them at the time of collection about, among other things, the controller, the purposes and legal basis, the recipients or categories of recipients, the storage period and the right to withdraw consent at any time (Art. 13(1) and (2)).

If the manufacturer, as a controller in its own right, receives the data from you rather than from the customers, Art. 14 applies: it informs them within a reasonable period, at the latest within one month, or by the first communication with them or the first disclosure to another recipient (Art. 14(3)). If you are joint controllers, your arrangement defines who meets which information duty (Art. 26(1)).

Contract, security, storage period: what should be in writing

If the manufacturer works as a processor, you need a contract setting out the subject matter and duration, the nature and purpose of the processing, the type of data and the categories of data subjects. In it, the processor undertakes, among other things, to process only on documented instructions, to take the security measures under Art. 32, to assist you with requests from your customers and, at the end of the service, to delete or return all data at your choice (Art. 28(3)(a), (c), (e) and (g)).

Whatever the role, three topics belong in every agreement. First, the storage period: data may be kept in identifiable form only as long as the purpose requires (Art. 5(1)(e)). Because a personalized formula is recalculated for every production run, the manufacturer needs the data while the subscription runs – define what happens after it ends, after withdrawal of consent or at contract end. Second, the record of processing activities: the exemption for organizations with fewer than 250 employees does not apply when special categories of data are processed (Art. 30(5)). Third, the data protection impact assessment: it is required in particular for processing special categories of data on a large scale (Art. 35(3)(b)).

Switzerland: FADP and GUMG instead of the GDPR

Switzerland has its own rules. Since September 1, 2023, the revised Federal Act on Data Protection (FADP) has applied. For genetic testing, the Federal Act on Human Genetic Testing (GUMG) comes on top; for the processing of genetic data, it otherwise refers to data protection law (Art. 10(2) GUMG). You know the basic ideas from the GDPR, but the mechanics differ:

• Sensitive personal data: Data on health and genetic data are sensitive personal data (Art. 5(c)(2) and (3) FADP).
• Different basic logic: The FADP does not start with a prohibition like Art. 9 GDPR. Personal data must be processed lawfully, in good faith and proportionately (Art. 6). But disclosing sensitive personal data to third parties is a breach of privacy (Art. 30(2)(c)). It is unlawful unless justified by consent, an overriding private or public interest, or law (Art. 31(1)).
• Consent: Where consent is required, it must be given voluntarily for specific processing after adequate information, and explicitly for sensitive personal data (Art. 6(6) and (7) FADP).
• Roles: The controller is whoever decides, alone or together with others, on the purpose and means (Art. 5(j)). A processor may only process the data in the way you yourself would be allowed to, and may subcontract only with your prior authorization (Art. 9(1) and (3)). The FADP has no duty for private controllers to conclude an arrangement like the one in Art. 26 GDPR.
• Information: The controller also informs the data subject when the data are not collected from them. It names the recipients and, if data go abroad, the country (Art. 19(1), (2) and (4) FADP).

Under the GUMG, three rules matter most for data owners. Information from a genetic test may only be communicated to another person if the person tested has consented (Art. 7(2)). Samples and genetic data may only be used for another purpose if the person has given free and explicit consent after sufficient information (Art. 12(1)) – exactly the situation of existing genetic data reused for a follow-up product. And for genetic tests outside the medical field, the written information must name the lab performing the test as well as companies and labs abroad that are involved in the test or process the genetic data (Art. 32). Who may initiate nutrition and sport analyses in Switzerland is explained in Who may offer genetic tests?

Checklist: roles and data protection before the first record

• The roles are clear and match how you actually work together.
• The right contract is in place: under Art. 28(3), an arrangement under Art. 26, or rules on the data transfer.
• Consent covers the follow-up product, the data used and the manufacturer as recipient; it is demonstrable and revocable.
• The privacy notice names recipients, purposes, storage period and rights – coordinated among all parties.
• Storage period, erasure and return are defined, including for the end of a subscription and withdrawal of consent.
• For Switzerland: justification for the disclosure, explicit consent under the GUMG, written information naming the lab, and the country named.

Frequently asked questions

Related: Genetic data and the GDPR · Who may offer genetic tests? · Data integration: raw data, interfaces, formats

Note: This guide is general information for businesses and professionals and does not replace medical or legal advice. The genetic traits determined in a genetic analysis are well documented (each gene included is backed by at least three independent studies); recommendations derived from them are logical conclusions, not scientifically proven. Regulations can change; errors and changes excepted.