Changes to Existing Law

26.533.9 26.533.10 101st Legislative Session 49 2026 South Dakota Legislature Senate Bill 49 SENATE JUDICIARY ENGROSSED Introduced by: The Chair of the Committee on Judiciary at the request of the Attorney General Underscores indicate new language. Overstrikes indicate deleted language. An Act to safeguard the integrity, privacy, and security of genetic data and provide 1 a civil penalty therefor. 2 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF SOUTH DAKOTA: 3 Section 1. That a NEW SECTION be added to chapter 37-24: 4 Terms used in this Act mean: 5 (1) "Biological sample," any part of a human that is known to contain deoxyribonucleic 6 acid; 7 (2) "Consumer," an individual who is a resident of this state; 8 (3) "De-identified data," genetic data that cannot reasonably be used to infer 9 information about, or otherwise be linked to, an identifiable consumer; 10 (4) "Direct-to-consumer genetic testing company," an entity that: 11 (a) Offers genetic testing products or services directly to consumers; or 12 (b) Analyzes, collects, or uses genetic data collected via a direct-to-consumer 13 genetic testing product or service that is provided to the company by the 14 consumer; 15 (5) "Express consent," an affirmative written response, which may be presented and 16 captured electronically; 17 (6) "Genetic data," data other than de-identified data, regardless of format, which 18 concerns a consumer's genetic characteristics; and 19 (7) "Service provider," a person that: 20 (a) Is involved in the collection, transportation, or analysis of, or any other 21 service in connection with, a consumer's biological sample or genetic data, 22 on behalf of a direct-to-consumer genetic testing company; 23 (b) Collects, uses, maintains, or discloses biological samples or genetic data, 24 collected or derived from a direct-to-consumer genetic testing product or 25 service, or directly provided by the consumer; or 26 26.533.9 26.533.10 2 49 Underscores indicate new language. Overstrikes indicate deleted language. (c) Delivers the results of the analysis of a biological sample or genetic data. 1 Section 2. That a NEW SECTION be added to chapter 37-24: 2 To safeguard the confidentiality, integrity, privacy, and security of a consumer's 3 genetic data, a direct-to-consumer genetic testing company shall: 4 (1) Make available to the consumer in plain language: 5 (a) A privacy policy that includes basic, essential information about the 6 company's collection, disclosure, and use of genetic data; and 7 (b) A prominent, publicly available privacy notice that includes information 8 about the company's access, consent, data collection, deletion, disclosure, 9 maintenance, retention, security, and transfer practices; and how the 10 company uses genetic data; 11 (2) Provide a clear and complete notice to the consumer that the consumer's de-12 identified data may be shared with or disclosed to a third party for research 13 purposes, in accordance with 45 C.F.R. part 46 (November 25, 2025); 14 (3) Obtain the consumer's express consent to collect, disclose, or use the consumer's 15 genetic data, including: 16 (a) Initial express consent that describes the uses of genetic data collected 17 through a genetic testing product or service and specifies who has access 18 to the test results and how the genetic data may be shared; 19 (b) Separate express consent, which must include the name of the person 20 receiving the information, for each transfer or disclosure of the consumer's 21 genetic data or biological sample to any person other than the company's 22 vendors and service providers; 23 (c) Separate express consent for each use of the consumer's genetic data or 24 the biological sample beyond the primary purpose of the genetic testing 25 product or service; 26 (d) Separate express consent to retain any biological sample provided by the 27 consumer following completion of the initial testing service requested by the 28 consumer; 29 (e) Informed consent, in compliance with federal policy for the protection of 30 human research subjects under 45 C.F.R. part 46 (November 25, 2025), to 31 transfer or disclose the consumer's genetic data to a third-party for research 32 purposes, or for research conducted under the control of the company for 33 publication or generalizable knowledge purposes; and 34 26.533.9 26.533.10 3 49 Underscores indicate new language. Overstrikes indicate deleted language. (f) Separate express consent for marketing by the direct-to-consumer genetic 1 testing company, to another consumer, based on the consumer's genetic 2 data, or by a third party, to another consumer, based on the consumer 3 having ordered or purchased a genetic testing product or service; 4 (4) Develop, implement, and maintain a security program to protect the consumer's 5 genetic data against unauthorized access, disclosure, or use; 6 (5) Provide a process for the consumer to: 7 (a) Access the consumer's genetic data; 8 (b) Delete the consumer's account and genetic data; and 9 (c) Request and obtain the destruction of the consumer's biological sample; 10 and 11 (6) Provide mechanisms, without any unnecessary steps, for the consumer to revoke 12 any consent of the consumer. At least one mechanism must utilize the primary 13 medium through which the company communicates to the consumer. 14 Section 3. That a NEW SECTION be added to chapter 37-24: 15 If a consumer revokes consent pursuant to section 2 of this Act, the company must 16 honor the consumer's revocation of consent within thirty days. If a consumer revokes 17 consent to store the consumer's biological sample, the company must destroy the 18 consumer's biological sample within thirty days of receiving the consumer's revocation of 19 consent. 20 Section 4. That a NEW SECTION be added to chapter 37-24: 21 A service provider under contract with a direct-to-consumer genetic testing 22 company is subject to the same confidentiality obligations as the direct-to-consumer 23 genetic testing company, as set forth in section 2 of this Act, with respect to all biological 24 samples, genetic data, and information regarding the identity of any consumer that is in 25 the service provider's possession. 26 Section 5. That a NEW SECTION be added to chapter 37-24: 27 The attorney general may impose a civil penalty against a person for violating 28 section 2 of this Act, section 3 of this Act, or section 4 of this Act. The amount of the civil 29 penalty may not exceed five thousand dollars per violation. 30 Section 6. That a NEW SECTION be added to chapter 37-24: 31 26.533.9 26.533.10 4 49 Underscores indicate new language. Overstrikes indicate deleted language. The provisions of sections 2 to 5, inclusive, of this Act do not apply to: 1 (1) Protected health information collected by a covered entity or business associate, 2 as those terms are defined in 45 C.F.R. § 160.103 (November 25, 2025); 3 (2) A biological sample that is obtained or genetic data that is generated for the 4 purpose of a consumer's medical screening, diagnosis, or treatment; 5 (3) A public or private institution of higher education; 6 (4) An entity owned or operated by a public or private institution of higher education; 7 (5) A forensic laboratory that is operated by, associated with, or under contract with, 8 a law enforcement agency, when performing forensic analysis or related services 9 as part of a criminal investigation; or 10 (6) An entity that analyzes, collects, or uses genetic data or biological samples only in 11 the context of research, as defined in 24 C.F.R. § 164.501 (November 25, 2025), 12 in a manner that complies with the federal policy of the protection of human 13 research subjects under 45 C.F.R. part 46 (November 25, 2025); the Guideline for 14 Good Clinical Practice issued by the International Council for Harmonisation 15 (January 6, 2025); or the United States Food and Drug Administration policy for 16 the protection of human subjects under 21 C.F.R. part 50 (December 4, 2025) and 17 21 C.F.R. part 56 (December 4, 2025). 2025); or 18 (7) A hospital licensed under chapter 34-12, including any laboratory or health care 19 facility owned, operated by, or affiliated with the hospital. 20

26.533.10 26.533.11 101st Legislative Session 49 2026 South Dakota Legislature Senate Bill 49 SENATE HOUSE JUDICIARY ENGROSSED Introduced by: The Chair of the Committee on Judiciary at the request of the Attorney General Underscores indicate new language. Overstrikes indicate deleted language. An Act to safeguard the integrity, privacy, and security of genetic data and provide 1 a civil penalty therefor. 2 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF SOUTH DAKOTA: 3 Section 1. That a NEW SECTION be added to chapter 37-24: 4 Terms used in this Act mean: 5 (1) "Biological sample," any part of a human that is known to contain deoxyribonucleic 6 acid; 7 (2) "Consumer," an individual who is a resident of this state; 8 (3) "De-identified data," genetic data that cannot reasonably be used to infer 9 information about, or otherwise be linked to, an identifiable consumer; 10 (4) "Direct-to-consumer genetic testing company," an entity that: 11 (a) Offers genetic testing products or services directly to consumers; or 12 (b) Analyzes, collects, or uses genetic data collected via a direct-to-consumer 13 genetic testing product or service that is provided to the company by the 14 consumer; 15 (5) "Express consent," an affirmative written response, which may be presented and 16 captured electronically; 17 (6) "Genetic data," data other than de-identified data, regardless of format, which 18 concerns a consumer's genetic characteristics; and 19 (7) "Service provider," a person that: 20 (a) Is involved in the collection, transportation, or analysis of, or any other 21 service in connection with, a consumer's biological sample or genetic data, 22 on behalf of a direct-to-consumer genetic testing company; 23 (b) Collects, uses, maintains, or discloses biological samples or genetic data, 24 collected or derived from a direct-to-consumer genetic testing product or 25 service, or directly provided by the consumer; or 26 26.533.10 26.533.11 2 49 Underscores indicate new language. Overstrikes indicate deleted language. (c) Delivers the results of the analysis of a biological sample or genetic data. 1 Section 2. That a NEW SECTION be added to chapter 37-24: 2 To safeguard the confidentiality, integrity, privacy, and security of a consumer's 3 genetic data, a direct-to-consumer genetic testing company shall: 4 (1) Make available to the consumer in plain language: 5 (a) A privacy policy that includes basic, essential information about the 6 company's collection, disclosure, and use of genetic data; and 7 (b) A prominent, publicly available privacy notice that includes information 8 about the company's access, consent, data collection, deletion, disclosure, 9 maintenance, retention, security, and transfer practices; and how the 10 company uses genetic data; 11 (2) Provide a clear and complete notice to the consumer that the consumer's de-12 identified data may be shared with or disclosed to a third party for research 13 purposes, in accordance with 45 C.F.R. part 46 (November 25, 2025); 14 (3) Obtain the consumer's express consent to collect, disclose, or use the consumer's 15 genetic data, including: 16 (a) Initial express consent that describes the uses of genetic data collected 17 through a genetic testing product or service and specifies who has access 18 to the test results and how the genetic data may be shared; 19 (b) Separate express consent, which must include the name of the person 20 receiving the information, for each transfer or disclosure of the consumer's 21 genetic data or biological sample to any person other than the company's 22 vendors and service providers; 23 (c) Separate express consent for each use of the consumer's genetic data or 24 the biological sample beyond the primary purpose of the genetic testing 25 product or service; 26 (d) Separate express consent to retain any biological sample provided by the 27 consumer following completion of the initial testing service requested by the 28 consumer; 29 (e) Informed consent, in compliance with federal policy for the protection of 30 human research subjects under 45 C.F.R. part 46 (November 25, 2025), to 31 transfer or disclose the consumer's genetic data to a third-party for research 32 purposes, or for research conducted under the control of the company for 33 publication or generalizable knowledge purposes; and 34 26.533.10 26.533.11 3 49 Underscores indicate new language. Overstrikes indicate deleted language. (f) Separate express consent for marketing by the direct-to-consumer genetic 1 testing company, to another consumer, based on the consumer's genetic 2 data, or by a third party, to another consumer, based on the consumer 3 having ordered or purchased a genetic testing product or service; 4 (4) Develop, implement, and maintain a security program to protect the consumer's 5 genetic data against unauthorized access, disclosure, or use; 6 (5) Provide a process for the consumer to: 7 (a) Access the consumer's genetic data; 8 (b) Delete the consumer's account and genetic data; and 9 (c) Request and obtain the destruction of the consumer's biological sample; 10 and 11 (6) Provide mechanisms, without any unnecessary steps, for the consumer to revoke 12 any consent of the consumer. At least one mechanism must utilize the primary 13 medium through which the company communicates to the consumer. 14 Section 3. That a NEW SECTION be added to chapter 37-24: 15 If a consumer revokes consent pursuant to section 2 of this Act, the company must 16 honor the consumer's revocation of consent within thirty days. If a consumer revokes 17 consent to store the consumer's biological sample, the company must destroy the 18 consumer's biological sample within thirty days of receiving the consumer's revocation of 19 consent. 20 Section 4. That a NEW SECTION be added to chapter 37-24: 21 A service provider under contract with a direct-to-consumer genetic testing 22 company is subject to the same confidentiality obligations as the direct-to-consumer 23 genetic testing company, as set forth in section 2 of this Act, with respect to all biological 24 samples, genetic data, and information regarding the identity of any consumer that is in 25 the service provider's possession. 26 Section 5. That a NEW SECTION be added to chapter 37-24: 27 The attorney general general, upon petition to the court, may impose a civil penalty against 28 a person for violating 28 section 2 of this Act, section 3 of this Act, or section 4 of this Act. 29 The amount of the civil 29 penalty may not exceed five thousand dollars per violation. 30 Section 6. That a NEW SECTION be added to chapter 37-24: 31 26.533.10 26.533.11 4 49 Underscores indicate new language. Overstrikes indicate deleted language. The provisions of sections 2 to 5, inclusive, of this Act do not apply to: 1 (1) Protected health information collected by a covered entity or business associate, 2 as those terms are defined in 45 C.F.R. § 160.103 (November 25, 2025); 3 (2) A biological sample that is obtained or genetic data that is generated for the 4 purpose of a consumer's medical screening, diagnosis, or treatment; 5 (3) A public or private institution of higher education; 6 (4) An entity owned or operated by a public or private institution of higher education; 7 (5) A forensic laboratory that is operated by, associated with, or under contract with, 8 a law enforcement agency, when performing forensic analysis or related services 9 as part of a criminal investigation; 10 (6) An entity that analyzes, collects, or uses genetic data or biological samples only in 11 the context of research, as defined in 24 C.F.R. § 164.501 (November 25, 2025), 12 in a manner that complies with the federal policy of the protection of human 13 research subjects under 45 C.F.R. part 46 (November 25, 2025); the Guideline for 14 Good Clinical Practice issued by the International Council for Harmonisation 15 (January 6, 2025); or the United States Food and Drug Administration policy for 16 the protection of human subjects under 21 C.F.R. part 50 (December 4, 2025) and 17 21 C.F.R. part 56 (December 4, 2025); or 18 (7) A hospital licensed under chapter 34-12, including any laboratory or health care 19 facility owned, operated by, or affiliated with the hospital. 20

26.533.11 26.533.12 101st Legislative Session 49 2026 South Dakota Legislature Senate Bill 49 HOUSE JUDICIARY ENGROSSED Introduced by: The Chair of the Committee on Judiciary at the request of the Attorney General Underscores indicate new language. Overstrikes indicate deleted language. ENROLLED AN ACT ENTITLED An Act to safeguard the integrity, privacy, and security of genetic data and provide 1 a civil penalty therefor. 2 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF SOUTH DAKOTA: 3 Section 1. That a NEW SECTION be added to chapter 37-24: 4 Terms used in this Act mean: 5 (1) "Biological sample," any part of a human that is known to contain deoxyribonucleic 6 acid; 7 (2) "Consumer," an individual who is a resident of this state; 8 (3) "De-identified data," genetic data that cannot reasonably be used to infer 9 information about, or otherwise be linked to, an identifiable consumer; 10 (4) "Direct-to-consumer genetic testing company," an entity that: 11 (a) Offers genetic testing products or services directly to consumers; or 12 (b) Analyzes, collects, or uses genetic data collected via a direct-to-consumer 13 genetic testing product or service that is provided to the company by the 14 consumer; 15 (5) "Express consent," an affirmative written response, which may be presented and 16 captured electronically; 17 (6) "Genetic data," data other than de-identified data, regardless of format, which 18 concerns a consumer's genetic characteristics; and 19 (7) "Service provider," a person that: 20 (a) Is involved in the collection, transportation, or analysis of, or any other 21 service in connection with, a consumer's biological sample or genetic data, 22 on behalf of a direct-to-consumer genetic testing company; 23 (b) Collects, uses, maintains, or discloses biological samples or genetic data, 24 collected or derived from a direct-to-consumer genetic testing product or 25 service, or directly provided by the consumer; or 26 26.533.11 26.533.12 2 49 Underscores indicate new language. Overstrikes indicate deleted language. SB49 ENROLLED (c) Delivers the results of the analysis of a biological sample or genetic data. 1 Section 2. That a NEW SECTION be added to chapter 37-24: 2 To safeguard the confidentiality, integrity, privacy, and security of a consumer's 3 genetic data, a direct-to-consumer genetic testing company shall: 4 (1) Make available to the consumer in plain language: 5 (a) A privacy policy that includes basic, essential information about the 6 company's collection, disclosure, and use of genetic data; and 7 (b) A prominent, publicly available privacy notice that includes information 8 about the company's access, consent, data collection, deletion, disclosure, 9 maintenance, retention, security, and transfer practices; and how the 10 company uses genetic data; 11 (2) Provide a clear and complete notice to the consumer that the consumer's de-12 identified de-identified data may be shared with or disclosed to a third party for research 13 purposes, in accordance with 45 C.F.R. part 46 (November 25, 2025); 14 (3) Obtain the consumer's express consent to collect, disclose, or use the consumer's 15 genetic data, including: 16 (a) Initial express consent that describes the uses of genetic data collected 17 through a genetic testing product or service and specifies who has access 18 to the test results and how the genetic data may be shared; 19 (b) Separate express consent, which must include the name of the person 20 receiving the information, for each transfer or disclosure of the consumer's 21 genetic data or biological sample to any person other than the company's 22 vendors and service providers; 23 (c) Separate express consent for each use of the consumer's genetic data or 24 the biological sample beyond the primary purpose of the genetic testing 25 product or service; 26 (d) Separate express consent to retain any biological sample provided by the 27 consumer following completion of the initial testing service requested by the 28 consumer; 29 (e) Informed consent, in compliance with federal policy for the protection of 30 human research subjects under 45 C.F.R. part 46 (November 25, 2025), to 31 transfer or disclose the consumer's genetic data to a third-party for research 32 purposes, or for research conducted under the control of the company for 33 publication or generalizable knowledge purposes; and 34 26.533.11 26.533.12 3 49 Underscores indicate new language. Overstrikes indicate deleted language. SB49 ENROLLED (f) Separate express consent for marketing by the direct-to-consumer genetic 1 testing company, to another consumer, based on the consumer's genetic 2 data, or by a third party, to another consumer, based on the consumer 3 having ordered or purchased a genetic testing product or service; 4 (4) Develop, implement, and maintain a security program to protect the consumer's 5 genetic data against unauthorized access, disclosure, or use; 6 (5) Provide a process for the consumer to: 7 (a) Access the consumer's genetic data; 8 (b) Delete the consumer's account and genetic data; and 9 (c) Request and obtain the destruction of the consumer's biological sample; 10 and 11 (6) Provide mechanisms, without any unnecessary steps, for the consumer to revoke 12 any consent of the consumer. At least one mechanism must utilize the primary 13 medium through which the company communicates to the consumer. 14 Section 3. That a NEW SECTION be added to chapter 37-24: 15 If a consumer revokes consent pursuant to section 2 of this Act, the company must 16 honor the consumer's revocation of consent within thirty days. If a consumer revokes 17 consent to store the consumer's biological sample, the company must destroy the 18 consumer's biological sample within thirty days of receiving the consumer's revocation of 19 consent. 20 Section 4. That a NEW SECTION be added to chapter 37-24: 21 A service provider under contract with a direct-to-consumer genetic testing 22 company is subject to the same confidentiality obligations as the direct-to-consumer 23 genetic testing company, as set forth in section 2 of this Act, with respect to all biological 24 samples, genetic data, and information regarding the identity of any consumer that is in 25 the service provider's possession. 26 Section 5. That a NEW SECTION be added to chapter 37-24: 27 The attorney general, upon petition to the court, may impose a civil penalty against 28 a person for violating section 2 of this Act, section 3 of this Act, or section 4 of this Act. 29 The amount of the civil penalty may not exceed five thousand dollars per violation. 30 Section 6. That a NEW SECTION be added to chapter 37-24: 31 26.533.11 26.533.12 4 49 Underscores indicate new language. Overstrikes indicate deleted language. SB49 ENROLLED The provisions of sections 2 to 5, inclusive, of this Act do not apply to: 1 (1) Protected health information collected by a covered entity or business associate, 2 as those terms are defined in 45 C.F.R. § 160.103 (November 25, 2025); 3 (2) A biological sample that is obtained or genetic data that is generated for the 4 purpose of a consumer's medical screening, diagnosis, or treatment; 5 (3) A public or private institution of higher education; 6 (4) An entity owned or operated by a public or private institution of higher education; 7 (5) A forensic laboratory that is operated by, associated with, or under contract with, 8 a law enforcement agency, when performing forensic analysis or related services 9 as part of a criminal investigation; 10 (6) An entity that analyzes, collects, or uses genetic data or biological samples only in 11 the context of research, as defined in 24 C.F.R. § 164.501 (November 25, 2025), 12 in a manner that complies with the federal policy of the protection of human 13 research subjects under 45 C.F.R. part 46 (November 25, 2025); the Guideline for 14 Good Clinical Practice issued by the International Council for Harmonisation 15 (January 6, 2025); or the United States Food and Drug Administration policy for 16 the protection of human subjects under 21 C.F.R. part 50 (December 4, 2025) and 17 21 C.F.R. part 56 (December 4, 2025); or 18 (7) A hospital licensed under chapter 34-12, including any laboratory or health care 19 facility owned, operated by, or affiliated with the hospital. 20 26.533.12 5 49 SB49 ENROLLED An Act to safeguard the integrity, privacy, and security of genetic data and provide a civil penalty therefor. I certify that the attached Act originated in the: Senate as Bill No. 49 Secretary of the Senate President of the Senate Attest: Secretary of the Senate Speaker of the House Attest: Chief Clerk of the House Senate Bill No. 49 File No. ____ Chapter No. ______ Received at this Executive Office this _____ day of _____________, 2026 at ____________M. By for the Governor The attached Act is hereby approved this ________ day of ______________, A.D., 2026 Governor STATE OF SOUTH DAKOTA, ss. Office of the Secretary of State Filed ____________, 2026 at _________ o'clock __M. Secretary of State By Asst. Secretary of State