Home › Nutrigenetics guide › Genetic data and the GDPR

Genetic data and the GDPR: what you need to know in your practice

Reviewed by Dr. Daniel Wallerstorfer, molecular biologist and founder of Novogenia · Updated: 12 October 2026 · Reading time: 11 min

A password you can never change: why genetic data are special

If your password is stolen, you change it. Your genes you cannot change. They stay with you for life – and reveal something about your parents, siblings and children. That is why data protection law guards them so closely.

The General Data Protection Regulation (GDPR) defines genetic data as personal data relating to the inherited or acquired genetic characteristics of a person which give unique information about their physiology or health and which result, in particular, from an analysis of a biological sample (Art. 4(13)). A saliva sample for a nutrition analysis clearly falls under this – whether the analysis is medical or not.

Genetic data are a special category of personal data. Processing them is prohibited (Art. 9(1)) unless one of the exceptions in Art. 9(2) applies. For a genetic analysis in nutrition counseling, the main option is explicit consent. Member states may also introduce further conditions for genetic data (Art. 9(4)) – which is why Germany and Austria partly have their own rules. Switzerland has its own law; more on that below.

Consent: a key your client can take back at any time

Consent is the key that opens the door to processing. For genetic data, it must be explicit and relate to one or more specified purposes (Art. 9(2)(a)). And your client can take the key back at any time. What matters:

• Explicit: a clear statement of its own. According to the European Data Protection Board’s Guidelines 05/2020, a signed written statement is an obvious way; online, the person can also fill in an electronic form, send an email, upload a signed document or use an electronic signature. A pre-ticked box is not consent (Recital 32).
• Demonstrable: You must be able to show that the person consented (Art. 7(1)).
• Revocable: The person can withdraw consent at any time, withdrawing must be as easy as giving consent, and you tell them about this beforehand (Art. 7(3)).
• Purpose-bound: The data must not be further processed in a manner incompatible with the original purposes (Art. 5(1)(b)). If a new purpose is added, the EDPB says you need fresh consent.

National rules add more. For genetic examinations for medical purposes, Germany requires explicit written consent given to the responsible physician (Section 8 GenDG). In Switzerland, every genetic test requires free and express consent after adequate information (Art. 5 GUMG). In Austria, data from genetic analyses within the meaning of the GTG may only be passed to persons other than those listed in the act with the express written consent of the person tested (Section 71(2) GTG).

No surprises: what your clients need to know first

Transparency is a duty, not small print. When you collect data, you tell your client at that time, among other things (Art. 13 GDPR):

• who the controller is, with contact details, and where applicable the contact details of the data protection officer,
• the purposes and legal basis of the processing,
• the recipients or categories of recipients – such as the lab,
• where applicable, the intention to transfer data to a third country,
• how long the data will be stored or the criteria used to determine this,
• their rights, including the right to withdraw consent at any time and the right to lodge a complaint with a supervisory authority.

The information must be concise, transparent, intelligible and easily accessible, in clear and plain language (Art. 12(1)). In Switzerland, Art. 32 GUMG adds written information duties for non-medical tests, such as naming the lab and any companies and labs abroad involved.

Client or contractor? Who plays which role between consultant and lab

A genetic analysis involves at least two players: you and the lab. The GDPR asks: who decides on the purposes and means of processing? That is the controller – like the client of a building project who decides what gets built (Art. 4(7)). Whoever processes data on the controller’s behalf is a processor – like the contractor who builds to plan (Art. 4(8)). If two parties jointly determine purposes and means, they are joint controllers (Art. 26).

Roles follow from what actually happens, not from the contract heading: according to the EDPB’s Guidelines 07/2020, the concepts are functional and allocate responsibilities according to the parties’ actual roles.

Practical tip: Agree in writing with your lab who has which role and duty before the first sample is sent – especially who informs your clients under Art. 13 and who answers requests for access or erasure.

Pack like for a mountain hike: take only what you need

Pack your data like a backpack for a mountain hike: whatever you do not need stays at home. The GDPR calls this data minimization – data must be adequate, relevant and limited to what is necessary for the purpose (Art. 5(1)(c)). And they may only be kept in identifiable form for as long as the purpose requires (storage limitation, Art. 5(1)(e)).

• Ask yourself honestly: Do you need the full report – or are the results you discuss with your client enough?
• Secure channels: Protect reports with appropriate technical and organizational measures (Art. 32) – a secure portal beats an unprotected email attachment.
• Data protection by design: Build data protection principles into processes and default settings, for example through pseudonymization (Art. 25).
• Deletion deadline: Decide when you delete records – and stick to it.

For some cases, the law sets deadlines. In Germany, the responsible physician keeps the results of genetic examinations for medical purposes for ten years and then destroys them (Section 12 GenDG). In Switzerland, samples and data from other tests under Art. 31(2) GUMG must be destroyed two years after testing at the latest, unless the person has consented to another use or has not objected to anonymization (Art. 11(2) GUMG).

Your clients’ rights

Your clients keep control. Their key rights under the GDPR:

• Access to the data processed (Art. 15) and rectification of inaccurate data (Art. 16)
• Erasure, for example after consent is withdrawn and there is no other legal basis (Art. 17)
• Restriction of processing (Art. 18) and data portability (Art. 20)
• Withdrawal of consent at any time (Art. 7(3))

You respond to requests without undue delay and in any event within one month; for complex cases, the period can be extended by two months (Art. 12(3)). On top of this comes a right that only exists in genetics law: the right not to know. In Switzerland, every person has the right to refuse to take note of information about their genome, in whole or in part (Art. 8 GUMG). In Germany, it is part of the information given for examinations for medical purposes (Section 9(2) No. 5 GenDG); in Austria, it is part of counseling for type 2 to 4 analyses (Section 69(5) GTG).

Corporate health programs: the employer stays outside

If you offer genetic analyses in companies, you need a solid wall between the results and the employer. The law builds that wall in all three countries:

• Germany: The employer may neither require employees to undergo genetic examinations or analyses nor require disclosure of results, receive such results or use them (Section 19 GenDG).
• Austria: Employers are prohibited from collecting, requesting, accepting or otherwise using results of genetic analyses of employees or job seekers (Section 67(1) GTG).
• Switzerland: Employers may neither require non-medical genetic testing nor request medically irrelevant genetic data, nor make use of such data (Art. 37 GUMG).

So design such an offer so that participation stays voluntary, results go only to the employee and the employer receives no individual results. Consent must be freely given (Art. 4(11) GDPR) – watch this closely at work.

Switzerland: the FADP instead of the GDPR

Switzerland is not an EU member. For processing genetic data, Art. 10(2) GUMG refers to federal and cantonal data protection law. For private persons – including you as a consultant – that is the revised Federal Act on Data Protection (FADP, in German DSG), in force since 1 September 2023 (Art. 2(1)(a) FADP). The core ideas match the GDPR; the details differ:

• Sensitive data: Genetic data are sensitive personal data (Art. 5(c)(3) FADP).
• Explicit consent: Where consent is required, it must be given explicitly for sensitive personal data (Art. 6(7)) – voluntarily, for specific processing and based on appropriate information (Art. 6(6)). For the test itself, Art. 5 GUMG requires free and express consent anyway.
• Data abroad: Data may go to states the Federal Council has found to provide adequate protection (Art. 16(1) FADP). The list is in Annex 1 of the Data Protection Ordinance (DPO, in German DSV); all EU states, including Austria and Germany, are on it. Other states require appropriate safeguards (Art. 16(2)) or an exception, such as the data subject’s explicit consent (Art. 17(1)(a)).
• Transparency: If data go abroad, you also tell the data subject the state concerned (Art. 19(4) FADP).
• Impact assessment: If processing is likely to result in a high risk, the controller carries out a data protection impact assessment beforehand – in particular for extensive processing of sensitive personal data (Art. 22(1) and (2) FADP).

Checklist: data protection in your practice

• Roles clarified in writing with the lab – with a data processing agreement (Art. 28) or a joint controller arrangement (Art. 26) where needed.
• Explicit consent for specified purposes obtained and documented (Art. 9(2)(a), Art. 7(1)).
• Complete, understandable privacy information under Art. 13 provided.
• Record of processing activities kept – the exemption for organizations with fewer than 250 employees does not apply if you process special categories of data (Art. 30(5)).
• Reports only through secure channels, access only for those who need it (Art. 32).
• Deletion deadlines set and kept (Art. 5(1)(e)).
• Plan for data breaches: notify the supervisory authority where feasible within 72 hours (Art. 33).
• For large-scale processing of genetic data: a data protection impact assessment (Art. 35(3)(b)) and, if this is your core activity, a data protection officer (Art. 37(1)(c)).

Frequently asked questions

Related: Who may offer genetic tests? · Explaining a genetic report clearly · Partner and white-label models

Note: This guide is general information for professionals and does not replace medical or legal advice. The genetic traits determined in a genetic analysis are well documented (each gene included is backed by at least three independent studies); recommendations on nutrition, micronutrients and lifestyle derived from them are logical conclusions, not scientifically proven. Regulations can change; errors and changes excepted.