Privacy & Cybersecurity Law Blog

On March 23, 2026, South Dakota Governor Rhoden signed Senate Bill 49 (“the Act”), a new law designed to “safeguard the integrity, privacy, and security of consumer genetic data.” The Act will take effect on July 1, 2026.

The Act imposes strict requirements on direct-to-consumer genetic testing companies and establishes new privacy rights for South Dakota residents.

The Act applies to entities offering genetic testing products or services directly to consumers and/or analyzing data derived from such products and services. The requirements include:

• Transparency and Notice: Covered companies must publish a privacy policy detailing data processing, retention, and security practices, as well as information about the company’s collection, disclosure, and use of genetic data. They must specifically notify consumers if de-identified data is shared with third parties for research.
• Express Consent: Covered companies must obtain “express consent”, defined as an affirmative written response, for the collection and use of genetic data. Notably, they must obtain separate express consent for each of the following:
  • the initial description of the uses of collected genetic data, who has access to test results, and how the genetic data may be shared;
  • each transfer or disclosure of data to third parties (excluding vendors/service providers).
  • the use of data beyond the primary purpose of the genetic testing product or service;
  • the retention of a biological sample after the initial test is completed; and
  • for certain marketing initiatives by the company or a third party.
• Consent Revocation: Companies must honor consent revocations and destroy samples within 30 days of a request.

• Security Standards: Covered companies must develop and maintain a robust security program to protect genetic data from unauthorized access, disclosure, or use.
• Consumer Rights: Residents of South Dakota are now granted the right to access and/or delete their genetic data, delete their accounts, and request the destruction of biological samples.

• Exemptions: The Act does not apply to:
  • protected health information collected by HIPAA covered entities;
  • biological samples obtained for medical diagnosis or treatment;
  • higher education institutions;
  • law enforcement forensic labs; or
  • entities conducting certain research purposes.

The South Dakota Attorney General may seek civil penalties of up to $5,000 per violation of the Act.