Have you ever given a company your personal information without thinking much about what might happen to it years later?

Maybe you signed up for an online service, completed a medical questionnaire, or provided financial information to open an account. At the time, you probably trusted the company to protect that information.

So what happens if the company goes bankrupt, gets sold, or merges with another business?

Does your personal information automatically become the property of whoever takes over?

Do you know what happens to it after?

Unfortunately, the answer isn’t always that simple. A recent settlement involving genetic testing company 23andMe shows why protecting sensitive information involves much more than preventing hackers from stealing it.

What Happened to 23andMe?

You may remember 23andMe, the company that became popular for its at-home DNA testing kits. Customers mailed saliva samples to the company and received reports about their ancestry, genetic traits, and potential health risks.

Of course, providing a DNA sample is quite different from sharing your email address. Your genetic information is deeply personal. It can reveal details about your health, biological relatives, and family history.

Unfortunately, 23andMe experienced a major data breach in 2023 that affected approximately 6.9M customers.

Then, in March 2025, the company filed for bankruptcy. As part of the bankruptcy process, 23andMe sold certain assets, including customers’ genetic information and biological samples, to TTAM Research Institute, a nonprofit established by the company’s co-founder.

Did customers actually agree to have their genetic information transferred to another organization?

California’s attorney general challenged the sale, arguing that state privacy laws required customers’ explicit consent before you can transfer genetic information. Although the courts rejected California’s objections to the sale, the dispute continued.

On October 19, 2026, California Attorney General Rob Bonta announced a $6M settlement resolving allegations related to the 2023 breach and the transfer of genetic information during bankruptcy. The settlement was pending bankruptcy court approval when announced. Importantly, California consumers retained the right to request deletion of their genetic information and destruction of their stored samples.

Why Does This Matter for Cyber-Compliance?

You might be wondering what a DNA testing company has to do with your everyday responsibilities at work. Actually, quite a bit!

Think about all the personal information your organization might collect. Customer addresses, employee records, financial information, medical details, and account histories are just a few examples.

Now imagine your company merges with another business or changes service providers. That information doesn’t suddenly stop being sensitive just because the organization handling it has changed.

Privacy laws, contracts, and company policies may still govern how the information can be used, shared, stored, or transferred.

A change in ownership doesn’t automatically erase the responsibility to protect personal information.

Mistake #1: Assuming You Can Share Information with Anyone Inside a New Organization

What would happen if your current employer merges with another company? You could soon have new coworkers, shared systems, and additional departments requesting information.

Does that mean everyone can access the same customer records? Not necessarily.

Even when two organizations become one, employees should only access information necessary for their responsibilities.

Some records may have additional privacy restrictions, and certain information may require special handling.

Before sharing sensitive records with new coworkers or departments, make sure the request is authorized and follows your organization’s policies.

Mistake #2: Forgetting About Information Held by Outside Companies

Your organization probably relies on outside providers for everyday services. Maybe you use a payroll company, cloud storage provider, customer management system, or online scheduling platform.

Those providers may store sensitive information on your organization’s behalf. So what happens if one of them gets acquired or changes how it handles customer data?

That’s why organizations need to understand where their information is stored and which companies have access to it.

As an employee, you can help by using approved services and avoiding unauthorized applications. If a service you use announces a change in ownership, privacy practices, or data handling, notify the appropriate person rather than assuming everything will remain the same.

Mistake #3: Keeping Information Without Considering Its Future

The longer an organization keeps sensitive information, the more opportunities there may be for that information to be exposed, transferred, or misused.

This is one reason why data minimization is so important. Organizations should collect and retain only the information necessary for legitimate purposes, subject to applicable legal and business requirements.

For employees, that means avoiding unnecessary copies, following retention policies, and keeping sensitive records in approved locations.

Remember that information you save today could still exist years from now, even if the company itself changes.

What Can You Do to Protect Sensitive Information?

Fortunately, you don’t need to be involved in a corporate merger to practice good cyber-compliance habits. Instead, start with a few simple precautions:

• Share only what’s necessary. Don’t provide entire customer files when someone only needs a few details.
• Use approved systems. Avoid storing sensitive information in personal accounts or unauthorized applications.
• Respect access restrictions. New coworkers or departments don’t automatically need access to every record.
• Follow retention policies. Don’t keep unnecessary information indefinitely or delete records without authorization.
• Pay attention to privacy notices. If a service changes ownership or data practices, understand what those changes mean before continuing to use it.

You can also review the privacy settings of services you use personally. For example, California’s attorney general reminds 23andMe customers that they can request deletion of their genetic information and destruction of stored biological samples. Other privacy rights depend on the applicable laws and services involved.

Conclusion

The 23andMe case reminds us that protecting personal information involves more than preventing data breaches. It’s also about understanding who controls sensitive information, how long it’s retained, and what happens when that information changes hands. After all, you might trust a company with your information today, but there’s no guarantee that the same company will be handling it five or ten years from now.

On the bright side, good cyber-compliance practices can help reduce those risks. By limiting unnecessary data collection, following privacy policies, and sharing information only with authorized people, we can help protect sensitive records throughout their entire lifecycle.

Protecting personal information isn’t just about who has access to it today. It’s also about who might have access to it tomorrow!