Data protection and consent in pharmacogenetics: the rules in Germany, Austria and Switzerland

Reviewed by Dr. Daniel Wallerstorfer, molecular biologist and founder of Novogenia · Updated: 13 October 2026 · Reading time: 10 min

In short

Pharmacogenetic results are genetic data and therefore specially protected under the GDPR (Art. 4(13), Art. 9). In Germany, consent must be explicit and in writing, given to the responsible physician (Section 8 GenDG); the result is kept for ten years and then destroyed, unless the person requests longer retention (Section 12). In Austria, the GTG requires written confirmation under Section 69 only for type 2 to 4 analyses, but a legal basis under Art. 9 GDPR is still needed. Switzerland requires free and express consent after adequate information (Art. 5 GUMG) and applies its Federal Act on Data Protection instead of the GDPR. In Germany and Switzerland, the result goes to third parties only with consent.

A package insert written for one person only

Your inherited genes do not change. Yet Germany’s Genetic Diagnostics Act requires the responsible physician to destroy the result of a genetic examination after ten years (Section 12(1) GenDG). Unless the person examined requests longer retention in writing or electronic form – then the result is not destroyed but its processing is restricted.

This one section shows the tension pharmacogenetics lives with. A pharmacogenetic result is like a personal package insert: it does not apply to a single prescription but can matter again with every new one. So it should be well protected – and still easy to find when the physician needs it. This article shows you how to do both: consent, information, sharing, storage and destruction in Germany, Austria and Switzerland. Who may offer a pharmacogenetic analysis in the first place is explained in Law: who may offer pharmacogenetics?

GDPR: genetic data are specially protected

The General Data Protection Regulation (GDPR) defines genetic data as personal data relating to the inherited or acquired genetic characteristics of a person which give unique information about their physiology or health and which result, in particular, from an analysis of a biological sample (Art. 4(13)). A pharmacogenetic result from a saliva sample clearly falls under this definition.

Processing such data is prohibited in principle (Art. 9(1)) and allowed only under one of the exceptions in Art. 9(2). For pharmacogenetics, two matter most:

Explicit consent for one or more specified purposes (Art. 9(2)(a)). You must be able to demonstrate it (Art. 7(1)), and the person can withdraw it at any time – as easily as it was given (Art. 7(3)).
Medical diagnosis and treatment by professionals subject to professional secrecy (Art. 9(2)(h) and (3)).

In addition, member states may maintain or introduce further conditions for genetic data (Art. 9(4)). That is why it pays to look at national law – it is often stricter.

Consent: three countries, three keys

Consent is the key that opens the door to testing. What that key must look like differs from country to country:

Country	What the law requires	Good to know
Germany	explicit and in writing, given to the responsible physician; consent covers the scope of the examination, whether the result is disclosed or destroyed, and the processing of the genetic data (Section 8(1) GenDG)	may be withdrawn at any time, in writing or verbally (Section 8(2)); information with adequate time to reflect beforehand (Section 9)
Austria	written confirmation after specialist information only for type 2 to 4 analyses (Section 69 GTG); the GTG does not require it for purely pharmacogenetic testing	a legal basis under Art. 9(2) GDPR is still needed, for example explicit consent
Switzerland	free and express consent after adequate information, withdrawable at any time (Art. 5 GUMG)	a lab abroad only with written consent (Art. 29(d) GUMG)

In practice: Obtain explicit, documented consent in all three countries. Written form is mandatory in Germany, and in Switzerland when the lab is abroad. In Austria, documented consent is the simplest way to demonstrate it under Art. 7(1) GDPR.

Information: what your patient should know beforehand

Consent is only as good as the information before it. The GenDG (Section 9(2)) and the GUMG (Art. 6) list similar points. For a pharmacogenetic test, in plain language:

Purpose and informative value: The test shows how the body is likely to process certain active substances. It does not replace a medical decision – changes to medication are made only by the treating physician.
Handling of sample and data: what happens to the sample and the result and how long they are kept (Section 9(2) No. 3 GenDG, Art. 6(c) GUMG).
Possible surplus information: whether results may arise that are not needed for the purpose (Art. 6(d) GUMG) – important for genes that say something about a disease as well as about drug response.
Meaning for the family: A result may also be significant for relatives (Art. 6(f) GUMG).
Rights: withdrawal at any time (Section 9(2) No. 4 GenDG, Art. 5(2) GUMG) and the right not to know – the right to refuse to learn the result in whole or in part (Section 9(2) No. 5 GenDG, Art. 8 GUMG).
Sharing: who receives the result and whether it may go to other treating physicians or to the pharmacy.

In Germany, the responsible physician documents the content of the information before the examination (Section 9(3) GenDG). On top come the general information duties under Art. 13 GDPR, or Art. 19 FADP in Switzerland.

Who may see the result – and how it reaches the next prescription

A pharmacogenetic result shows its value where prescribing happens. The laws regulate exactly this route strictly:

Germany: The lab discloses the result only to the commissioning physician (Section 11(2) GenDG), who discloses it to the person examined (Section 11(1)). It may be disclosed to others – another physician or a pharmacy, say – only with explicit consent in writing or electronic form (Section 11(3)).
Austria: Anyone who performs or orders genetic analyses within the meaning of the GTG, or processes the resulting data, must keep them confidential (Section 71(1) GTG). The data may be transmitted to, among others, the person examined and the ordering and treating physicians, and to others only with explicit written consent (Section 71(2)). The act does not say expressly whether purely pharmacogenetic testing is covered – following these rules anyway keeps you on the safe side.
Switzerland: Information from a genetic test may be disclosed to other persons only if the person concerned has consented (Art. 7(2) GUMG).

In practice: Ask when you obtain consent whether the result may go to other treating physicians or to the patient’s regular pharmacy, and record the answer. Also give your patient an understandable summary so they can raise their result at the next prescription. How to do that well is covered in Understanding and communicating results.

Storage and destruction: what happens to the result and the saliva sample

The GDPR sets the frame: data may be kept in identifiable form only as long as the purpose requires (Art. 5(1)(e)) and must not be processed further for incompatible purposes (Art. 5(1)(b)). Germany and Switzerland get more specific:

Country	Result	Saliva sample
Germany	keep for ten years, then destroy; at the person’s request in writing or electronic form, restrict processing instead; destroy earlier if the person has decided so or withdrawn consent (Section 12(1) GenDG); applies to the lab accordingly (Section 12(2))	only for the original purpose; destroy without delay once no longer needed or consent is withdrawn; other purposes only with explicit written consent (Section 13 GenDG)
Switzerland	only as long as necessary for the test including quality assurance, for another use or for cantonal rules on patient records (Art. 11(1) GUMG)	the same rule; other use only with consent, in anonymized form only after information and without objection (Art. 12 GUMG)

The Austrian GTG sets no retention period of its own for genetic analyses. The GDPR principle of storage limitation applies.

Tip for pharmacogenetics: Because a result may matter again for later prescriptions, discuss with your patient whether they want to request longer retention in Germany (Section 12(1) GenDG) – and document their decision.

Switzerland: the FADP instead of the GDPR

For processing genetic data, the GUMG refers to federal and cantonal data protection provisions (Art. 10(2)). Private persons – including practices and pharmacies – are covered by the Federal Act on Data Protection (FADP) (Art. 2(1)(a)). You know the core ideas from the GDPR; the details differ:

Sensitive: Genetic data are sensitive personal data (Art. 5(c)(3) FADP).
Explicit consent: Where consent is required, it must be explicit for such data (Art. 6(7)) – given voluntarily, for specific processing and after adequate information (Art. 6(6)).
No longer than needed: Data are destroyed or anonymized as soon as they are no longer needed for the purpose (Art. 6(4)).
Data abroad: allowed to countries with adequate data protection (Art. 16(1) FADP); Austria and Germany are on the list in Annex 1 of the Data Protection Ordinance. The person is told which country the data go to (Art. 19(4) FADP).
Technical protection: The GUMV requires appropriate measures, such as access only for people who need the data for their tasks, logging and secure transmission (Art. 3(2) GUMV).
Impact assessment: For extensive processing of sensitive personal data, the controller prepares a data protection impact assessment in advance (Art. 22(1) and (2) FADP).

Checklist: data protection and consent in pharmacogenetics

The legal basis under Art. 9 GDPR or the FADP is clear.
Consent is explicit and documented – in Germany, in writing to the responsible physician.
Information before sampling covers the purpose, handling of sample and data, withdrawal and the right not to know.
It is recorded who receives the result and whether it may go to other treating professionals or the pharmacy.
Roles with the lab are set out in writing, with a contract where processing is done on your behalf (Art. 28 GDPR).
Retention and deletion periods are set; in Germany, any request for longer retention is documented.
Samples from Switzerland go to a lab abroad only with written consent, and the person knows the destination country.
Reports travel only by secure routes (Art. 32 GDPR).

Frequently asked questions

Is verbal consent enough for pharmacogenetics?

Not in Germany: consent is given explicitly and in writing to the responsible physician (Section 8(1) GenDG). In Switzerland, consent must be free and express (Art. 5 GUMG), and a lab abroad requires written consent (Art. 29 GUMG). In Austria, the GTG does not require written confirmation for purely pharmacogenetic testing, but you must be able to demonstrate GDPR consent (Art. 7(1)). Documented consent is therefore the safe route everywhere.

May I share the result with the family doctor or the pharmacy?

In Germany, the responsible physician may disclose the result to others only with the explicit consent of the person examined, in writing or electronic form (Section 11(3) GenDG). In Switzerland, the person concerned must consent (Art. 7(2) GUMG). In Austria, for analyses within the meaning of the GTG, Section 71(2) allows transmission to the ordering and the treating physician, and to others only with explicit written consent. Ideally, ask when you obtain consent.

How long is a pharmacogenetic result kept?

In Germany, the responsible physician keeps the result for ten years and then destroys it. If the person requests longer retention in writing or electronic form, processing of the result is restricted instead (Section 12(1) GenDG). In Switzerland, data may be kept only as long as necessary, for example for the test, an agreed other use or cantonal rules on patient records (Art. 11(1) GUMG).

What happens to the saliva sample after the analysis?

In Germany, the sample may only be used for the purpose for which it was obtained and must be destroyed without delay once it is no longer needed or consent has been withdrawn (Section 13(1) GenDG). Any other purpose requires explicit written consent (Section 13(2)). In Switzerland, samples follow the same storage rule as data (Art. 11 GUMG), and use for another purpose requires consent (Art. 12 GUMG).

Does the GDPR apply in Switzerland?

No, Switzerland has its own Federal Act on Data Protection (FADP). Genetic data are sensitive personal data there (Art. 5(c)(3) FADP); where consent is required, it must be explicit (Art. 6(7)). Data may go to countries with adequate data protection – Austria and Germany are on the list in Annex 1 of the Data Protection Ordinance – and the person is told which country (Art. 19(4) FADP).

Pharmacogenetics in your practice or pharmacy?

Tell us about your setting – we will show you how the offer can work for you.

Request a project →Offer for physicians

Note: This guide is general information for businesses and professionals and does not replace medical or legal advice. The genetic traits determined in a genetic analysis are well documented (each gene included is backed by at least three independent studies); recommendations derived from them are logical conclusions, not scientifically proven. Pharmacogenetic results do not replace a medical decision: any change to medication is made only by the treating physician. Regulations can change; errors and changes excepted.