Law / United States / 
South Dakota
Genetic Data Privacy Act, definitions, consent, and consumer rights
SDCL secs. 37-24-59 to 37-24-61 (SB 49, SL 2026 ch. 164, secs. 1-3)
In force since .
A sensitive categories rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Obtain a South Dakota consumer's opt-in express consent, separately for collection, third-party transfer, research use, retention beyond the initial test, and marketing use of genetic data or a biological sample, if you operate a direct-to-consumer genetic testing service.NIST Privacy FrameworkCT.PO-P1
- Honor a consumer's revocation of consent and destroy their biological sample within 30 days.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.DM-P5
- Do not treat this Act as reaching biometric data. It is scoped to genetic data and direct-to-consumer genetic testing companies only.
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does an entity that receives genetic data a consumer uploaded from another company's test become a 'direct-to-consumer genetic testing company' under SDCL 37-24-59(4)(b), which reaches an entity that 'analyzes, collects, or uses genetic data collected via a direct-to-consumer genetic testing product or service'?
What it makes you log
Logging duty
Sections 37-24-59 to 37-24-61 require a direct-to-consumer genetic testing company to make a privacy policy and notice available, to obtain separate express consent (an affirmative written response, which may be presented and captured electronically) for collection, each disclosure, each secondary use, retention of a biological sample and marketing, to keep a security program, to give a process for access and deletion, to provide ways to revoke consent, and to honor a revocation and destroy a sample within thirty days. A written consent required as a condition of processing is not itself a kept record, a policy or notice states rules and not a record of processing, and the access right is to the consumer's own genetic data, not to a log. No clause requires a log, register or retained consent file, names an audit, or gives a regulator a right to a record. The Act defines a consumer as an individual who is a resident of this state (37-24-59(2)), which is the residence test.
- Kind
- None
- As of
What this law does
South Dakota's Genetic Data Privacy Act defines genetic data as data other than de-identified data, regardless of format, concerning a consumer's genetic characteristics, and applies only to a direct-to-consumer genetic testing company and its service providers, not to personal data generally.
A covered company must obtain a consumer's opt-in express consent for collection, and separately for disclosure, third-party transfer, research use, retention beyond the initial test, and marketing use, and must maintain a security program. A consumer may access their genetic data, delete their account and genetic data, and obtain destruction of their biological sample; revocation of consent must be honored, and a biological sample destroyed, within 30 days.
The Act never mentions biometric data anywhere in its text; genetic and biometric data are treated as distinct categories in South Dakota law, not interchangeably. Exemptions cover Health Insurance Portability and Accountability Act (HIPAA)-covered entities, medical screening, diagnosis or treatment, higher-education institutions, forensic laboratories, and human-subjects research.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .