GDPR and your genetic data — what rights do you actually have?
Genetic information is one of the most strongly protected data categories in the EU. It gives you concrete rights — and it is partly why your raw data file can be downloaded at all.
Short answer
Under the GDPR, genetic data counts as a special category of personal data (Article 9) — the same level as health data. That means companies processing it need extra-strong grounds, usually your explicit consent, and that you as an individual have a full register of rights: to know what is stored, to get your data out, to have it erased and to complain to a supervisory authority.
Why your raw data file exists at all
That MyHeritage, 23andMe, AncestryDNA and FamilyTreeDNA offer raw data downloads is no random courtesy — it is connected to two GDPR rights:
- Right of access (Art. 15): you can request which personal data a company holds about you — a so-called subject access request.
- Data portability (Art. 20): when processing is based on consent or contract you have the right to receive your data in a structured, machine-readable format — and to take it to another service.
The raw data file you download is in practice your data portability in action. It is also why tools that can read the file locally — like DNAHelper — exist without you having to hand over the data again.
Your rights in practice
- Access / subject access request: ask which genetic and linked data a company stores about you.
- Rectification: inaccurate data must be correctable.
- Erasure ("right to be forgotten", Art. 17): you can request your data be deleted, especially if you withdraw the consent it was based on.
- Data portability: get your data in machine-readable format — the raw file is exactly this.
- Withdraw consent: if processing is based on consent, withdrawing it must be as easy as giving it.
- Complaints: you can report a company to a supervisory authority — your national data protection authority in the EU/EEA (e.g. Ireland's DPC, France's CNIL, Germany's BfDI, Sweden's IMY).
What you can demand of services that take your file
If you upload your raw data file to an analysis service it processes genetic data — a special category. A serious service should be able to answer:
- What legal basis is used? (For genetic data, normally explicit consent, Art. 9.2a.)
- What happens to the file after analysis — is it stored, for how long, and can it be deleted on request?
- Is the data used for anything else — research, model training, onward sharing?
- Who is the data controller and how do I reach them?
A practical rule of thumb: read the deletion and retention policy before you upload — not after.
How DNAHelper relates to this
DNAHelper is built to minimize the question entirely: your raw data file is not processed on our servers at all — the analysis runs locally in your browser, so we have no genetic data to hand out, sell or leak. What you can request access to or erasure of with us is limited to what actually exists: email address if you created an account, payment data with Stripe at purchase, and your consent status. See the privacy policy for exactly what is processed and where.
The only consent-gated exception is the voluntary DNA Chat: only after you explicitly activate it are your question and the variants needed for the answer sent to an external AI provider (currently DeepSeek, with processing outside the EU/EEA). Consent can be withdrawn at any time — withdrawal is a GDPR right, not a bonus feature.
Important boundary
This article is general information about the GDPR — not legal advice. For a concrete matter, contact your national supervisory authority or an ombudsman. The authorities themselves also publish excellent guides on special categories of personal data.
Also: What happens to your DNA file? · Local vs cloud analysis · What is a raw DNA file? · English overview