Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what reporting, monitoring, or public disclosure requirements exist regarding the transfer of UK citizens’ genomic data to foreign entities, including approvals, audits, or security assessments conducted.

In order to lawfully process special category data, organisations must identify both a lawful basis under Article 6 of the UK GDPR and a separate condition for processing under Article 9, which should be documented. Organisations also need to complete a data protection impact assessment (DPIA) for any type of processing which is likely to be high risk.