Toward GDPR compliance with the Helmholtz Munich genotype imputation server

Genomics has the potential to revolutionize healthcare, empowering personalized disease management, including precision prevention. Genome-wide association studies (GWAS) have been instrumental in generating new biological insights into complex human diseases¹. The power of GWAS can be increased by increasing sample size through meta-analysis, which requires the imputation and analysis of genotypes that may be untyped across some studies. Imputation relies on the availability of phased haplotype reference panels of whole-genome-sequenced individuals². These are not amenable to sharing with researchers who need to impute their GWAS data, primarily for reasons of data access and security, dataset size, and scale of computing resources required to enable imputation. Imputation servers have, therefore, been developed to provide a solution: researchers upload their genotyped dataset to the imputation server that hosts the reference panels and imputation machinery, where the data are imputed, and then downloaded back to the researchers’ individual local computing environment. There are a number of imputation servers that serve the global community of researchers, including two based in the USA (University of Michigan, https://imputationserver.sph.umich.edu/index.html and TOPMed, https://imputation.biodatacatalyst.nhlbi.nih.gov/), one based in the UK (Wellcome Sanger Institute, https://imputation.sanger.ac.uk/?about=1) and one based at Kiel University in Germany (https://hybridcomputing.ikmb.uni-kiel.de). Here, we have developed a European Union (EU)-based imputation server serving the community at large, based in Munich, Germany (https://imputationserver.helmholtz-munich.de/), to assist users in complying with their General Data Protection Regulation (GDPR) requirements.

The need for EU-based imputation servers arises from restrictions imposed by GDPR law³, a comprehensive data privacy law in the EU. Genetic data are considered a special category of personal data under GDPR, and hence they are subject to strict data sharing rules and safeguards⁴. Uploading of genotype data to imputation servers not residing within the EU or covered by an adequacy agreement constitutes a breach of GDPR, unless explicitly covered in informed consent forms for the respective study. Here, we introduce the Helmholtz Munich Imputation Server, designed to provide a cost-free genotype imputation service in a GDPR-compliant manner for EU-based researchers, as well as for researchers globally.