Just that simple question: Is a Blood sample considered Personal Data under GDPR?

  • 3
    Are you asking about the sample itself or about data derived from the sample?
    – phoog
    May 31, 2019 at 17:58
  • The sample... which is a repository of Data... Jul 8, 2019 at 10:38

4 Answers 4


If you mean the actual sample - no. It’s a physical thing, not data.

If you mean the results of testing then yes if they can identify an individual (like a DNA sequence) or are linked to an identifiable individual and no if they don’t (like they are part of an anonymised database of thousands of results).

  • 1
    Data can be extracted from that sample if though.
    – Putvi
    May 31, 2019 at 22:11
  • 1
    @Putvi and such data would be covered. It’s analogous to my face -it can be photographed at any time and that photo is data but my face isn’t.
    – Dale M
    May 31, 2019 at 22:15
  • I agree with the photo and the face thing, but I meant even if the data is anonymized you are processing data that would be an identifier.
    – Putvi
    May 31, 2019 at 22:19
  • 1
    @Putvi and I said it depended on the test - a cholesterol test doesn’t identify an individual, a DNA test does.
    – Dale M
    May 31, 2019 at 22:20
  • 1
    To each their own, but just like an IP is still an identifier if you don't use it for that purpose, so is blood and dna, if in a form where you have the data.
    – Putvi
    May 31, 2019 at 22:22

From GDPR Article 2:

This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

A blood sample is not "personal data". If information is derived from the sample then that is personal data.

Also, if an organisation collects many blood samples then it must also be collecting associated data, such as when, where, who, why etc. These are certainly personal data, and their linkage with the blood sample makes them more personal because it is reasonable to suppose that future processing (such as analysis of the sample) will create Special Category data.


The GDPR defines bio-metric data as:

“personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person”.

So yes a blood sample would fit. To analyze the data you would most likely be extracting data from it and analyzing it so that would mean you are a processor under the GDPR.


Well, thank you for all your feedback...

Now the answer :)

A Blood Sample is NOT Personal Data, however, it is something similar to a biological Hard Drive, meaning a repository which contains identifiers that constitute Personal Data (DNA; Blood Type; other...).

Personal Data (and someone gave the example of a facial photograph) is any Data that either on its own or when cross-referenced with other Data enabled the univocal identification of a natural person.

In this sense (as an example) a facial photograph on its own allows the univocal identification of a specific natural person, whereas Blood type requires other identifiers or context to be cross-referenced so such identification may occur.

  • Now, whoever gave a negative score to this answer really needs to revisit the Law and read it carefully :) Jul 8, 2019 at 10:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .