Is it safe to upload your raw DNA data?
It is a reasonable question, and the honest answer is that it depends entirely on where you upload it. A DNA file is unlike other personal data in one specific way: you cannot change it after a breach. A leaked password can be rotated. A leaked genome is leaked permanently, and it partly describes your relatives too.
That is not an argument against uploading anything anywhere. It is an argument for knowing what to check first.
What are the actual risks of uploading a DNA file?
Three, in order of likelihood: the service keeps your file longer than you expect, the service is bought and the new owner changes the terms, or the service is breached. Outright sale of identifiable genetic data is rarer than people fear — the mundane risks are the ones that actually materialise.
None of those three is exotic. Companies get acquired, and a privacy policy is a promise by the company that wrote it, not a property of the data. Breaches happen to organisations of every size. And “we retain your data to improve our service” can mean a copy of your genome sits in a database indefinitely.
There is a fourth risk that gets more attention than it deserves: re-identification from anonymised research data. It is real and well documented in the literature, but it is not what happens to most people. What happens to most people is that they forget which five services hold a copy of their file.
Can insurers or employers get your genetic data?
It depends on where you live, and the protections are narrower than most people assume. In the United States, GINA restricts the use of genetic information in health insurance and employment — but it does not cover life, disability or long-term care insurance. Rules elsewhere differ substantially.
In the EU and UK, genetic data is a special category under data protection law, which means it needs explicit consent to process and cannot be handled on the looser bases that cover ordinary personal data. The UK also operates a voluntary code between government and insurers covering when genetic results may be asked for.
The practical upshot: the protections that exist are real but partial and jurisdictional. If you are considering life or income protection cover, that is worth understanding before uploading anything, not after. This is general information rather than legal advice, and your own jurisdiction is the one that matters.
What should you check before uploading a DNA file anywhere?
Five things, all findable in a privacy policy in about ten minutes: how long the file is retained, whether deletion is actually offered, whether your data is used for research, whether it is shared with third parties, and what happens if the company is sold. Vagueness on any of them is the answer.
Two specific phrases are worth searching for. “De-identified” often means the data can still be shared and, for genetic data, de-identification is a weaker guarantee than it sounds. “Affiliates and partners” is doing a lot of work in most policies — find out who they are.
Also check whether the service requires an account. Every account is a persistent identifier linking your genome to your identity across time. A service that can work from an email address alone is holding less about you than one that cannot.
What does proper deletion actually look like?
Deleting a row in a database usually leaves the file recoverable from backups for months. The stronger version is per-file encryption with a key that is destroyed on request: without the key the stored bytes are unreadable, including in every backup, and no future policy change can undo it.
Ask what happens to backups, because that is where the honest answer separates from the marketing one. “Deleted within 30 days” usually means the live record goes immediately and the backup rotation catches up. That is fine, provided it is stated.
For what it is worth, this is the approach we use ourselves: each file gets its own key, and a deletion request destroys the key rather than merely marking a row. We would rather be checked on that than believed.
Is a DNA file more sensitive than other personal data?
Yes, in two ways that matter. It cannot be changed after exposure, so the harm has no expiry date. And it is partly shared — your file says something probabilistic about your siblings, parents and children, none of whom consented to the upload.
That second point is the one people rarely weigh. It is also why the appropriate standard is not “do I trust this company today” but “would I be comfortable with this file in the hands of whoever owns this company in ten years”.
If the answer is no, the right move is not to upload it. A service that cannot survive that question does not deserve the file.
How we handle files, and what deletion means here →