Privacy and consent: who sees your DNA story

A man in Johor Bahru opens the email from the lab and thinks: "Who else can see this?" His results are about his body, his family and his past. He would like to be sure that nobody else can read them without his say-so.

The story

DNA is some of the most personal information there is. It speaks about you, and it also says a little about your parents, your children and your cousins. So it deserves strong care.

The law. Malaysia's Personal Data Protection Act 2010 (PDPA) came into force on 15 November 2013. It gives special protection to what it calls sensitive personal data. That includes information about a person's physical or mental health, their religious beliefs, and biometric data. DNA results can touch on health, so a careful service treats them with the same care. Companies generally need explicit consent to handle sensitive data. The 2013 rules say consent may be given in any form the company can record and keep, and companies must keep a record of it. The regulator is the Personal Data Protection Commissioner.

What this means for you. We plan to follow four simple rules:

1. You choose. Nothing about you is shown to anyone unless you say yes. 2. You can change your mind. You can say no again at any time. 3. Your story is yours. What your results mean for who you are is for you and your family to decide (Mathieson and Scally, 2020). 4. We keep a record, and we keep it safe. Your consent is recorded, and your results stay in your own secure account at the ATGC portal.

A word of care. Scientists warn that ancestry results can be over-read, and customers can be led by "spurious claims". So a fair service explains what a result can and cannot say. That is why every page on this site tells you what DNA cannot do.

Relatives work the same way. A match is shown to another person only if both people say yes (see "Can a DNA test find a long-lost relative?").

Where you can still see it today

In the consent box you tick before a test is processed.
In your account, where you control what is visible.
In the guidance of Malaysia's Personal Data Protection Commissioner, which tells businesses how to handle personal data.
In the words "I agree" and "I do not agree", which are yours to choose.

What DNA can tell, and what it cannot

A DNA result is a private clue to your family's deep past. It can be personal, and it can be shared with the people you choose.

It cannot be used to decide your race, religion or bumiputera status. These are matters of family, law and culture. A DNA result must not be used to judge a person, and nobody should have to share one.

DNA does not decide race, religion or bumiputera status.