SB 49: safeguard the integrity, privacy, and security of genetic data and provide a civil penalty therefor. - South Dakota

House Judiciary Engrossed → Enrolled · 5 edits · Mar 10, 2026

MODERATE

This bill establishes new legal protections for genetic data collected by direct-to-consumer genetic testing companies in South Dakota. It defines key terms related to genetic data, requires companies to obtain explicit consent for various uses of genetic information, mandates data security measures, and creates civil penalties for violations.

Scope change

Newly created provisions; this is an entirely new section added to chapter 37-24 of South Dakota law

DEFINITION

Added seven new definitions including 'biological sample,' 'consumer,' 'de-identified data,' 'direct-to-consumer genetic testing company,' 'express consent,' 'genetic data,' and 'service provider' to clarify who and what the law protects.

REQUIREMENT

Requires direct-to-consumer genetic testing companies to provide clear privacy notices, obtain separate express consent for each use of genetic data beyond primary testing purposes, and implement security programs to protect genetic data.

Mandates that companies provide consumers with mechanisms to access, delete, or destroy their genetic data and biological samples, including revocation of consent within thirty days.

Requires companies to obtain informed consent for sharing genetic data with third parties for research purposes, following federal standards for human research subjects.

ENFORCEMENT

Authorizes the attorney general to seek civil penalties of up to $5,000 per violation for companies that fail to comply with the new genetic data protection requirements.

Senate Judiciary Engrossed → House Judiciary Engrossed · 7 edits · Mar 2, 2026

MODERATE

This bill adds new legal protections for genetic data collected by direct-to-consumer genetic testing companies in South Dakota. It establishes clear definitions for genetic data and service providers, requires companies to obtain specific express consent for various uses of genetic information, mandates privacy policies and security programs, and gives consumers the right to access, delete, or destroy their genetic data and biological samples.

Scope change

The bill applies specifically to direct-to-consumer genetic testing companies operating in South Dakota and adds new sections to chapter 37-24 of the South Dakota Codified Laws.

DEFINITION

New definitions for biological sample, consumer, de-identified data, direct-to-consumer genetic testing company, express consent, genetic data, and service provider

REQUIREMENT

Requirement for companies to provide plain language privacy policies and publicly available privacy notices

Mandatory express consent requirements for data collection, third-party sharing, secondary uses, sample retention, research transfers, and marketing

Obligation to develop and maintain security programs to protect genetic data from unauthorized access

Consumer rights to access, delete accounts and genetic data, and request destruction of biological samples

Requirement for companies to honor consent revocation requests within thirty days

Mechanisms for consumers to revoke consent through primary communication channels

Introduced → Senate Judiciary Engrossed · 6 edits · Jan 20, 2026

MODERATE

This bill introduces new protections for genetic data privacy in South Dakota, establishing requirements for direct-to-consumer genetic testing companies. The legislation adds specific definitions for genetic data terms and mandates that companies obtain express consent from consumers before collecting, disclosing, or using their genetic information. It also requires companies to provide clear privacy notices, implement security programs, and offer consumers the ability to access, delete, or destroy their genetic data and biological samples.

Scope change

The bill expands state oversight to include direct-to-consumer genetic testing companies, which were not previously subject to these specific genetic data privacy requirements in South Dakota.

DEFINITION

Added seven new definitions including 'biological sample,' 'consumer,' 'de-identified data,' 'direct-to-consumer genetic testing company,' 'express consent,' 'genetic data,' and 'service provider' to establish clear terminology for the law.

REQUIREMENT

Requires direct-to-consumer genetic testing companies to provide plain language privacy policies and prominent privacy notices explaining data collection, use, and security practices.

Mandates express consent from consumers for collecting, disclosing, or using genetic data, including separate consent for each transfer to third parties, uses beyond primary testing purposes, sample retention, and marketing based on genetic data.

Requires companies to develop and maintain security programs to protect genetic data from unauthorized access, disclosure, or use.

Establishes consumer rights to access genetic data, delete accounts and genetic data, and request destruction of biological samples within 30 days of revocation.

Requires companies to provide easy mechanisms for consumers to revoke consent, with at least one method using the primary communication channel the company uses with consumers.

safeguard the integrity, privacy, and security of genetic data and provide a civil penalty therefor.

What changed between versions

How they voted

Actions timeline

Sponsors