Where your material came from

We take data of EU, EEA, Swiss and UK provenance as standard. Everything else we are glad to take — once the paperwork on your side is in place. This page tells you what we need and why, so you find out before you convert a terabyte.

Start a request Data & security

The default, and why there is one

DNA ME is a German company and your data is processed in Germany, so EU law applies to it the moment it arrives — including law that binds us rather than you. Restricting the default to EU, EEA, Swiss and UK provenance is not a preference; it is the range where we can be sure of our own position without asking you for anything beyond the ordinary. Anything else is a conversation first and an upload second.

What we ask for on every order

The country of origin of the source material. One line on the request form. It goes into your audit record as your declaration, which is also what makes it useful to you later: the provenance of the material is part of the reproducibility story your methods section is telling.

If the origin is genuinely unknown, say so. We cannot accept the job until it is established, and it is better to find that out now.

Genetic resources and the Nagoya Protocol

This one surprises people, so it is worth being direct about it. If your material is non-human biological material — environmental, microbial, plant, animal — it is very likely a genetic resource under the Nagoya Protocol. The obligations that come with that rest with you: under Regulation (EU) No 511/2014 you are its user. We perform only the service described in your offer, acquire no rights in the material, carry out no further research on it and pass nothing to third parties — and we keep your documentation as the record of that, for ten years.

So before upload we need either the provider country's prior informed consent and mutually agreed terms — a permit, an IRCC number, or the equivalent — or a reasoned statement that the provider country asks for none, or that the material is outside its scope.

This is not a non-EU question. Several EU member states have their own access legislation, so material collected inside the EU can need exactly the same documentation.

Synthetic constructs, in-vitro material and human-derived material sit outside the Protocol. Human-derived material has its own rules, below.

Non-EU provenance: you hold the permissions, we hold the record

For material from outside the default range, you warrant that every consent, approval, notification and clearance required where the material came from — and where you are — is in place, both for collecting the data and for sending it to Germany. You name them; we keep the record with the job.

We do not assess whether your permissions are sufficient, and we will not tell you that they are. That is not us being unhelpful: an assessment from us would be worth nothing to a regulator and would muddle whose duty this is. Your institution's research office or counsel decides; we record what you tell us and rely on it.

What this usually means, by region

Written from what customers have needed in practice. It is not legal advice, it is not exhaustive, and rules in this area change — check the current position with your own research office or counsel.

United States

Human data: your IRB's approval or its exemption determination. If the work is NIH-funded, whatever the Genomic Data Sharing Policy and the relevant consent group permit. Data originating with a HIPAA covered entity needs de-identification or an authorisation.

The Department of Justice rule made under Executive Order 14117 restricts bulk transfers of US sensitive personal data — human genomic data explicitly included — to a defined list of countries. Germany is not on that list. Your own compliance record should still say why this transfer is permitted.

Non-human material: the United States is not a party to the Nagoya Protocol, so there is no US access permit to obtain. Material collected elsewhere and merely held in the US keeps the terms of the country it came from.

Mexico

Human data: genetic data is sensitive personal data and generally needs express written consent, including for transfer abroad. The federal framework was reorganised in 2025, so confirm the current requirement rather than relying on an older template.

Non-human material: Mexico is a Nagoya party. Material collected in Mexico normally needs authorisation from SEMARNAT and agreed benefit-sharing terms. We need those documents, or a reasoned statement that they are not required.

Because we take digital signal and never physical samples, permits for exporting biological material are usually not engaged at all. The rules on the data still are.

China

Human genetic resources: the regulations cover genetic information, not only physical material. Providing it to a foreign party generally requires filing with the Ministry of Science and Technology, and international collaborative research generally requires approval. PIPL treats genetic data as sensitive personal information and requires its own basis for sending it abroad.

We do not accept human genetic data of Chinese origin without documented approval or filing. If that cannot be obtained, we can usually still help with non-human material — say so in your request and we will tell you where the line falls for your project.

Non-human material: China is a Nagoya party, and its biosecurity legislation applies alongside.

Anywhere else

Name the country in your request. We reply with what we need before you upload — and if the answer is that we cannot take it, you will know that before you have spent a week converting files.

What we do to make this easier

We tell you in writing what is needed for your specific job before you upload anything, as part of the offer.
We give you the declaration wording, so you are not drafting it from scratch.
We never ask for physical material, which keeps a whole category of export permits out of the picture.
We keep the documentation with the job and hand you the audit record that references it.

What we will not do

Tell you that your permissions are adequate. We are not your counsel and an opinion from us would not protect you.
Accept data whose origin is unclear, or start work while the documentation is outstanding.

Start a request AVV — data processing agreement

Courtesy translation. The German version of the terms is the binding one (§ 17).