Genetic Data and Legal Protection

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Genetic data is the most intimate and unchangeable information about a person, and its legal protection has become one of the most urgent frontiers of modern digital law.

What Genetic Data Is and Why It Requires Special Protection

Genetic data is information obtained by analyzing biological samples (blood, saliva, tissue) that reveals inherited traits, predispositions to disease, ancestry, and biological characteristics unique to each person. Unlike an e-mail address or a phone number, genetic data is permanent: it cannot be changed, replaced, or “reset.” That immutability gives it a degree of sensitivity with no parallel in the world of personal data protection.

The rapid growth of direct-to-consumer genetic tests, biotechnology research, and DNA databases maintained by public and private bodies has dramatically expanded the collection of this kind of information. Health care companies, insurers, ancestry laboratories, assisted-fertility platforms, and even wellness apps now process genetic data on a large scale, often without the people concerned fully understanding what that sharing means.

Several factors make genetic data sensitive. First, it concerns not only the person who provided the sample but also their blood relatives, creating an effect of involuntary collective exposure. Second, combining genetic information with other databases (health, behavior, location) makes it possible to build extremely detailed profiles with significant potential for discrimination. Third, leaks of genetic data are irreversible: once the data is exposed, the harm cannot be undone.

The Legal Framework in Brazil: the LGPD (Brazil’s General Data Protection Law) and Genetic Data

Brazil’s General Data Protection Law (Law No. 13.709/2018) classifies genetic data as sensitive personal data, the category that receives the highest level of legal protection. Article 5, item II, of the LGPD expressly lists “genetic data” alongside data on racial or ethnic origin, religious belief, political opinion, union membership, health, sex life, and biometrics. This classification is not a mere formality: it imposes substantially stricter obligations on those who process the data.

Under Article 11 of the LGPD, genetic data may be processed only in specific, exhaustively listed situations. The main one is the data subject’s consent, which must be given in a specific and prominent manner and for defined purposes. Unlike the generic consent accepted for ordinary data, here the data subject must be clearly told which genetic data will be collected, for exactly what purpose, how long it will be stored, and with whom it may be shared.

Besides consent, the LGPD allows sensitive data to be processed without consent in certain situations: compliance with a legal obligation by the controller; shared processing of data needed to carry out public policies; studies by a research body (with anonymization whenever possible); the regular exercise of rights in judicial proceedings; protection of the life or physical safety of the data subject or a third party; and health protection by health professionals or health entities. Each of these situations calls for careful analysis to determine whether the legal basis actually applies to the case at hand.

Genetic data is the only truly unchangeable piece of personal information: protecting it is not just a legal obligation but an ethical imperative that reaches across generations.

One aspect that deserves special attention is the preparation of the Data Protection Impact Report (RIPD). The National Data Protection Authority (ANPD) may require this report whenever the processing of genetic data poses a high risk to data subjects’ rights. In practice, organizations that process genetic data on a significant scale should keep this report up to date as a preventive measure, documenting the risks identified, the mitigation measures, and the safeguards in place.

Due Diligence on Genetic Data: Verification and Compliance

Due diligence on genetic data is a systematic, in-depth review of how an organization collects, stores, processes, and shares this information. It is especially relevant in mergers and acquisitions involving biotechnology companies, clinical laboratories, health insurers, and genomics startups, but it applies equally to any entity that regularly processes genetic data.

The review begins with the data inventory: what types of genetic data are collected, from how many data subjects, in which systems they are stored, and what sharing flows exist (internal and external). The lack of a complete, current inventory is, in itself, a sign of a significant risk of noncompliance. Next, we assess the legal bases relied on for each processing purpose. It is common to find organizations that rely on generic consent terms, which are not enough for sensitive data under the LGPD.

Information security is another cornerstone of due diligence on genetic data. We consider it essential to verify technical measures such as encryption at rest and in transit, role-based access controls (RBAC), pseudonymization or anonymization where feasible, audit logs to trace access, and retention policies with defined time limits and secure disposal procedures. The absence or weakness of these measures may violate Article 46 of the LGPD, which requires those who process data to adopt security measures capable of protecting personal data.

Due diligence should also examine contracts with third parties that receive or process genetic data (known as processors under the LGPD). These contracts should contain specific clauses on the purpose of processing, security measures, confidentiality obligations, procedures for incidents, and conditions for subcontracting. International transfers of genetic data add another layer of complexity, requiring verification of the safeguards set out in Articles 33 to 36 of the LGPD.

Practical Risks and Vulnerability Scenarios

Experience with data due diligence reveals recurring vulnerabilities that deserve attention. The first is genetic discrimination: using genetic information to deny insurance coverage, refuse to hire a worker, or charge different prices for health services. Although the Federal Constitution prohibits all forms of discrimination and the LGPD restricts the use of sensitive data for discriminatory purposes (Article 11, §1), enforcement against this kind of practice still faces considerable challenges.

Another troubling scenario is the secondary sharing of genetic data. Consider people who provide samples for an ancestry test and, under terms of use (often long and hard to understand), authorize sharing with research partners, pharmaceutical companies, or international databases. Granular consent becomes crucial here: data subjects must be able to choose each purpose of use separately and independently.

We also see risks tied to the re-identification of supposedly anonymized data. Scientific studies show that genetic data, even when partially anonymized, can be cross-referenced with public databases (such as genealogical records) to identify specific individuals. This possibility calls into question how effective anonymization is as a safeguard and reinforces the need for robust differential privacy techniques and periodic assessments of re-identification risk.

In employment relationships, the collection of genetic data by employers raises deep ethical and legal questions. Using genetic tests as a criterion for hiring, promotion, or dismissal may amount to discrimination prohibited by labor and constitutional law, and it directly violates the LGPD’s principles of purpose, adequacy, and necessity.

Best Practices and Recommendations for Organizations

Based on our analysis of the regulatory landscape and the risks identified, we have put together a set of practical recommendations for organizations that process genetic data. The first and most fundamental is to adopt the principle of data minimization: collect only the genetic data strictly necessary for the stated purpose, and avoid accumulating information “for future use” without a defined legal basis.

We also recommend putting in place a governance program specific to genetic data. It should include clear internal policies, regular training for the teams that access this data, the appointment of a data protection officer (DPO) with knowledge of bioethics and data protection, and effective channels for data subjects to exercise their rights (access, correction, deletion, portability, and withdrawal of consent).

Transparency with data subjects must be an absolute priority. Consent forms for genetic data should be written in plain language, with clear explanations of the risks involved, including the potential impact on family members. We consider it good practice to adopt dynamic consent models that let data subjects review and change their choices over time, especially when new processing purposes arise.

Finally, it is important to stay current on the specific regulations now being developed. The ANPD has been making progress on sector-specific guidance, and bills pending in the National Congress seek to establish more detailed regulatory frameworks for genetic data. Organizations that get ahead of these regulations by adopting high standards of protection now put themselves in a safer and more competitive position in the market.

This subject is directly related to biometric data, a topic we cover in a separate article.

This subject is directly related to impact reports, a topic we cover in a separate article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.