Laboratory services, genetic testing and medical check-ups

• Regulation (EU) 2017/746 — IVDR including Article 5(5) for health institutions
• Regulation (EU) 2016/679 — GDPR, Article 9
• Regulation (EU) 2025/327 — European Health Data Space
• National laws on genetic testing

Who has to appoint one

Laboratories and direct-to-consumer testing companies outside the Union serving EU customers. Genetic data is special-category data and, in several member states, subject to additional national restrictions including requirements for medical supervision and counselling.

Thresholds and exemptions

None for the data obligations. Under the IVDR, tests placed on the market require conformity assessment, while in-house tests within a health institution follow Article 5(5) conditions.

What must appear on the label

For test kits placed on the market: CE marking with the notified body number, EC REP details, UDI, and instructions for use including limitations. For services, the consent and result documentation.

Marketplace fields

Direct-to-consumer genetic testing is restricted in several member states, notably France and Germany, where testing outside medical supervision is prohibited or criminalised, so market access is national rather than EU-wide.

Documentation you must hold

Article 30 records covering samples and results, the Article 27 designation, explicit consent documentation for genetic processing, a data protection impact assessment, retention and destruction schedules for samples and raw data, and the transfer mechanism. IVDR documentation for kits.

Standards and testing

Analytical and clinical performance evaluation for the assays, and for kits the conformity assessment route by class.

Language requirements

Consent documents and results in the language of the individual, with the limitations explained comprehensibly.

When it applies

Before offering the service. National restrictions must be checked per member state before marketing.

How long records are kept

Samples and raw genetic data only as long as necessary and consented, with destruction documented. Indefinite retention of genomic data is a serious exposure.

What happens if you do not comply

GDPR fines up to 4% of turnover, and in some member states criminal penalties for genetic testing outside medical supervision. Data breaches involving genetic data are treated as high severity by default.

Who enforces it

Data protection authorities, national health and genetics authorities, and medical device authorities for kits.

Where the boundary lies

Genetic data concerns relatives as well as the individual, which several authorities have emphasised, and consent from one person does not cover the inferences drawn about family members. National prohibitions on direct-to-consumer testing override the freedom to provide services in this area.

Questions we are asked

Can we sell DNA tests across the EU?

Not uniformly. Several member states restrict genetic testing to medical supervision and prohibit direct-to-consumer sale.

How long can we keep genetic data?

Only as long as necessary for the consented purpose. Retaining genomes indefinitely for research requires its own basis and is heavily scrutinised.