23andMe filed for Chapter 11 bankruptcy last month, which it said was to “facilitate a sale process to maximise the value of its business”.

The company said it intended to continue operating its business in the ordinary course throughout the sale process, with “no changes to the way the company stores, manages, or protects customer data”.

The Chapter 11 filing would allow 23andMe, with the assistance of an independent investment banker, to actively solicit qualified bids over a 45-day process.

If multiple qualified bids are submitted during the court-supervised sale process, the company said it plans to carry out an auction to maximise the value of its assets, with any buyer required to comply with applicable law with respect to the treatment of customer data.

However, Stephen Bonner, deputy commissioner – regulatory supervision at the ICO, warned that any genetic data from UK nationals held by the company would have to be treated in accordance with GDPR.

The ICO and the Office of the Privacy Commissioner of Canada had been investigating a data breach 23andMe reported in October 2023, and had issued the company with a notice of intent to fine it £4.59m earlier this year.

The ICO decision on the fine and outcome of its investigation is provisional and subject to representations from 23andMe, including in relation to affordability considerations.

“Genetic information is among the most sensitive personal data that a person can entrust to a company and organisations handling such data are required to uphold a very high standard of security and governance in accordance with the UK GDPR,” Bonner said.

“We are aware that 23andMe has filed for Chapter 11 bankruptcy in the US to facilitate a sale process. We are monitoring the situation closely and are in contact with the company.

“As a matter of UK law, the protections and restrictions of the UK GDPR continue to apply and 23andMe remains under an obligation to protect the personal information of its customers.”