Home › White-label genetic testing guide › Data protection

White-label genetic testing guide

Data protection for white-label genetic tests: roles, consent, retention

Reviewed by Dr. Daniel Wallerstorfer, molecular biologist and founder of Novogenia · Updated: 13 October 2026 · Reading time: 12 min

In short

Under the GDPR, genetic data are a special category of personal data (Art. 9) – in lifestyle analyses too. In a white-label setup, several parties process the same data: your brand, the lab and, for medical analyses, physicians. Before launch, clarify who is controller, who is processor and who is joint controller (Arts. 4, 26 and 28), obtain explicit consent, set deadlines for keeping and destroying samples and data, and use data for research only with separate consent. In Switzerland, the FADP and the GUMG apply.

A relay race with DNA: why every handover counts

What happens to your customers’ genetic data if a company becomes insolvent? At Novogenia, the answer is in the terms and conditions: among the principles carried over into the privacy information on the genetic analysis is the deletion of genetic data in the event of insolvency. Questions like this sound theoretical – until you build a brand on genetic data.

A white-label genetic test is a relay race. Your brand takes the order, the kit travels to the customer, the sample to the lab, the result into the report and onto the platform; for medical analyses, a physician runs one leg. The baton is genetic data – and at every handover, it must be clear who is running and who answers for that leg.

The General Data Protection Regulation (GDPR) defines genetic data as personal data relating to the inherited or acquired genetic characteristics of a person which give unique information about their physiology or health and which result, in particular, from an analysis of a biological sample (Art. 4(13)). Processing them is prohibited in principle (Art. 9(1)) unless an exception in Art. 9(2) applies – for consumer genetic tests, mainly explicit consent. This applies to lifestyle analyses just as much as to medical ones. The basics for counseling practice are in Genetic data and the GDPR; here we focus on what an own brand adds.

Who runs which leg? The roles of brand and lab

The GDPR knows three roles. The controller is whoever, alone or jointly with others, determines the purposes and means of processing (Art. 4(7)). The processor processes data on the controller’s behalf (Art. 4(8)). If two or more controllers jointly determine purposes and means, they are joint controllers (Art. 26). Who has which role follows from what actually happens – not from the contract heading. That is how the European Data Protection Board describes it in its Guidelines 07/2020.

Setup	How to recognize it	What you put in place
Brand as controller, lab as processor	Your brand decides what happens to the data; the lab processes only on your documented instructions.	Data processing agreement under Art. 28(3), in writing or electronic form (Art. 28(9))
Joint controllers	Brand and lab determine purposes and means together.	Arrangement under Art. 26: who informs, who answers requests; the essence is made available to the data subject
Each responsible for its own part	The lab decides on purposes and means for part of the processing itself.	clear allocation of which processing belongs to whom; each informs about its own part
Medical analyses in Germany	The responsible physician performs the examination and assigns the lab (Section 7(2) GenDG); the lab reports the result only to that physician (Section 11(2)).	Consent and communication of the result go through the physician, not through your brand

A data processing agreement is more than a form. Among other things, it specifies that the lab processes only on your documented instructions, that the people involved are bound by confidentiality, which security measures apply, that further processors are only added with your authorization, and that at the end all data are deleted or returned at your choice (Art. 28(2) and (3)). And a processor that determines purposes and means itself is considered a controller in respect of that processing (Art. 28(10)).

Practical tip: Before launch, write down who informs the customer under Art. 13, who answers access and erasure requests, and who deletes which data when. At Novogenia, the privacy information on the genetic analysis sets out who is responsible for which processing.

Consent: the starting signal for every analysis

Without explicit consent for specified purposes, nothing moves in consumer genetic testing (Art. 9(2)(a) GDPR). You must be able to demonstrate consent (Art. 7(1)), and the customer can withdraw it at any time (Art. 7(3)). A pre-ticked box is not consent (Recital 32).

White label adds a practical question: consent is usually given in your shop or when the kit is registered – but the lab needs it too. So plan how proof of consent reaches the lab and how a withdrawal gets there. National rules add more:

Germany, medical: Consent is given explicitly and in writing to the responsible physician and also covers the processing of the genetic data; the assigned lab only analyzes once it has proof of consent (Section 8(1) GenDG).
Austria: Data from genetic analyses within the meaning of the GTG go to persons other than those listed in the act only with express written consent, which can be withdrawn in writing at any time (Section 71(2) GTG).
Switzerland: Every genetic test requires free and express consent after adequate information (Art. 5 GUMG).

Who sees what? Only those who really need it

Your own brand tempts you to want to see everything: every result, every report. The GDPR puts on the brakes: data must be limited to what is necessary for the purpose (Art. 5(1)(c)), and by default, only the data necessary for each specific purpose are processed (Art. 25(2)). So ask yourself: what does your brand need insight for? For customer service, order status and shipping data are often enough. At Novogenia, you decide as a partner whether you see your customers’ reports.

Employers: They may neither request nor use their employees’ genetic results (Section 19 GenDG, Section 67 GTG, Art. 37 GUMG). More on designing such programs: Corporate health.
Insurers: As a rule, they too may neither request nor use genetic results (Section 18 GenDG, Section 67 GTG, Art. 37 GUMG) – with narrow exceptions in Germany and Austria.
Security: Protect reports with appropriate technical and organizational measures (Art. 32 GDPR) – a secure portal beats an email attachment. How reports and platform look under your brand is covered in Reports and platform under your brand.

Keep and destroy: samples have an expiry date too

Personal data may only be kept in identifiable form for as long as the purpose requires (Art. 5(1)(e) GDPR). For genetic samples and results, some laws get more specific:

Framework	What applies	Reference
Germany, medical samples	use only for the purpose for which they were obtained; destroy without delay once no longer needed for it or once consent is withdrawn	Section 13(1) GenDG
Germany, medical results	keep for ten years, then destroy; applies accordingly to the assigned lab	Section 12 GenDG
Switzerland, all tests	samples and genetic data only as long as needed for the test including quality assurance, for another use, or for cantonal rules	Art. 11(1) GUMG
Switzerland, other tests	destroy two years after testing at the latest, unless the person consented to another use or did not object to anonymization	Art. 11(2) GUMG
End of processing on behalf	The lab deletes or returns all personal data – at the controller’s choice, unless storage is legally required	Art. 28(3)(g) GDPR

Where no specific law sets a deadline, you set it yourself – justified by the purpose – and write it into the privacy notice and the contract. Think of both: the sample in the lab and the data on the platform.

Research and product development: only with separate consent

The genetic data of many people are valuable for research and product development. That is exactly why any use beyond the original purpose needs its own sound basis:

GDPR: Further processing for scientific research purposes is not considered incompatible with the original purpose (Art. 5(1)(b)), but it needs appropriate safeguards such as data minimization and, where possible, pseudonymization (Art. 89(1)). For genetic data, Art. 9 still applies: explicit consent (para. 2(a)) or a basis in Union or national law (para. 2(j)) – in Germany, for example, Section 27 BDSG with a balancing of interests.
Consent to areas of research: Because research purposes often cannot be fully specified at collection, data subjects should be able to consent to certain areas of scientific research, in keeping with recognized ethical standards (Recital 33).
Germany, medical: A genetic sample may only be used for other purposes if a law permits it or the person has given express written consent after being informed (Section 13(2) GenDG).
Austria: Genetic analyses for scientific purposes may only be performed on de-identified samples (Section 66(1) GTG).
Switzerland: In uncoded or coded form, samples and genetic data may only be used for another purpose with free and express consent after adequate information; in anonymized form if the person was informed in advance and did not object (Art. 12 GUMG).

For your brand, this means: make research consent a separate, voluntary decision – apart from the order and revocable at any time. How studies with a genotyping lab work is covered in Genotyping for research and studies.

Switzerland: the FADP and the GUMG instead of the GDPR

For customers in Switzerland, the GDPR does not apply; the Federal Act on Data Protection (FADP, in German DSG) does, and Art. 10(2) GUMG expressly refers to it for genetic data. You know the core ideas from the GDPR; the details differ:

Sensitive data: Genetic data are sensitive personal data (Art. 5(c)(3) FADP); where consent is required, it must be given explicitly (Art. 6(7)).
Processor: The processor may only process data in the way you yourself would be permitted to; you make sure it can guarantee data security, and it may only pass processing on to a third party with your prior authorization (Art. 9 FADP).
Lab in Austria: Personal data may be disclosed to states the Federal Council has found to provide adequate protection (Art. 16(1) FADP); Austria and Germany are listed in Annex 1 of the Data Protection Ordinance (DPO, in German DSV). You tell the data subject the state concerned (Art. 19(4) FADP).
Additionally under the GUMG: The written information names the lab, any companies and labs abroad involved, and the contact details of the person responsible for data processing (Art. 32 GUMG). Anyone processing genetic data limits access to the people who need it for their tasks, logs the processing steps relevant for traceability and transmits data securely (Art. 3(2) GUMV).
Impact assessment: For extensive processing of sensitive personal data, the controller carries out a data protection impact assessment in advance (Art. 22 FADP).

Checklist: data protection for your genetic-test brand

The roles of brand, lab and, where relevant, physician are clarified in writing – with a data processing agreement (Art. 28) or an arrangement under Art. 26.
Consent is explicit, purpose-specific and demonstrable; proof of consent and any withdrawal reach the lab.
The privacy notice names the controllers, purposes, recipients or categories of recipients and the storage period (Art. 13); in Switzerland, also the lab and the state (Art. 32 GUMG, Art. 19 FADP).
Your brand sees only what it needs for its purpose; employers and insurers receive no genetic results.
Samples and data have fixed deadlines for keeping and destruction; the end of the contract is covered (Art. 28(3)(g)).
Research or product development with customer data only with separate, voluntary consent.
For extensive processing of genetic data: a data protection impact assessment (Art. 35(3)(b) GDPR, Art. 22 FADP).

How we do it at Novogenia

How we handle genetic data at Novogenia:

Analysis in Austria: We analyze samples in our own lab in Eugendorf near Salzburg, Austria – under European data protection law.
Clear responsibilities: Who is responsible for which processing of personal and genetic data is set out in our privacy information on the genetic analysis.
Firm principles: access to one’s own data, purpose limitation, use for other purposes only with express written consent, and deletion of genetic data in the event of insolvency.
You decide what you see: As a partner, you choose whether or not you see your customers’ reports. Reports are delivered digitally through a secure portal and printed on request.
Employers and insurers stay outside: With lifestyle analyses, the employer gets no insight into genetic results; medical analyses are only available with a company physician, and only that physician sees the results. In the insurer model, the member receives the results and the insurer only the invoice.

Frequently asked questions

Is my brand the controller, or is the lab?

That depends on who actually decides on the purposes and means of processing (Art. 4(7) and (8) GDPR). If your brand determines what happens to the data and the lab acts only on your instructions, the lab is a processor. If you decide together, you are joint controllers (Art. 26). In its Guidelines 07/2020, the European Data Protection Board stresses that actual activities count, not the label in the contract.

What must the data processing agreement with the lab contain?

Subject matter and duration, nature and purpose of the processing, type of data, categories of data subjects, and the controller’s rights and obligations (Art. 28(3) GDPR). It also covers, among other things: processing only on documented instructions, confidentiality, security measures under Art. 32, rules for further processors, and deletion or return of the data at the end. In Switzerland, Art. 9 FADP governs processing by processors.

How long may samples and genetic data be kept?

Only as long as the purpose requires (Art. 5(1)(e) GDPR). For medical examinations in Germany, samples must be destroyed without delay once they are no longer needed (Section 13 GenDG), and results are kept for ten years and then destroyed (Section 12 GenDG). In Switzerland, samples and data from other tests must be destroyed two years after testing at the latest, unless the person has consented to another use or has not objected to anonymization (Art. 11(2) GUMG).

May I use my customers’ genetic data for research or new products?

Only on a separate legal basis – for consumer genetic tests, usually separate explicit consent (Art. 9(2)(a) GDPR). In Germany, Section 13(2) GenDG requires express written consent for medical samples; in Switzerland, Art. 12 GUMG requires free and express consent. In Austria, genetic analyses for scientific purposes may only be performed on de-identified samples (Section 66 GTG).

May genetic data from Switzerland be processed in an Austrian lab?

Yes. Austria is listed in Annex 1 of the Swiss Data Protection Ordinance as a state with adequate data protection (Art. 16(1) FADP). You tell your customer the state (Art. 19(4) FADP) and the lab (Art. 32 GUMG), and testing abroad requires their written consent (Arts. 29 and 36 GUMG).

Planning your own genetic-test brand?

Tell us about your audience and your preferred portfolio – we will show you how your launch could look.

Request a project →White-label genetic analyses

Note: This guide is general information for businesses and professionals and does not replace medical or legal advice. The genetic traits determined in a genetic analysis are well documented (each gene included is backed by at least three independent studies); recommendations derived from them are logical conclusions, not scientifically proven. Regulations can change; errors and changes excepted.