The GDPR in your practice: the essentials, without the overkill
A health professional practicing individually is, as a rule, not required to appoint a DPO — the very example cited by the European guidelines themselves. But every other obligation applies: record of processing activities, patient information, security, retention periods, breach notification. And the CNIL has already sanctioned independent physicians — €3,000 and €6,000 in 2020, for medical images accessible online and an unnotified breach.
What the regulations require of you
Each obligation is cited with its legal reference — so you know exactly where it comes from and what it demands of your organization.
Keep a record — even in individual practice
The small-organization exemption does not apply to a patient file: health data processed on a regular basis requires a record, proportionate to the activity.
Inform your patients
Waiting-room notice, statements on documents and on the practice's website: every patient knows who processes their data, why, for how long and what their rights are.
Secure the workstation and tools
Strong passwords, updates, backups, router and software configuration: the exact shortcoming that earned two French physicians their sanctions in 2020.
Notify breaches within 72 hours
Lost equipment, compromised mailbox, exposed records: a breach is qualified, documented and, when it presents a risk, notified to the CNIL within 72 hours.
No mandatory DPO — everything else applies
Individual practice is the very example cited by the European guidelines as not reaching large scale. All the other obligations remain.
What is at stake for your organization
- Secure the workstation, the internet router and the software — the exact failure that earned the two physicians their sanctions.
- Keep a record of processing activities proportionate to the practice’s activity.
- Inform patients: a waiting-room notice, statements on documents.
- Frame the secretariat, remote secretarial services and online scheduling (roles and contracts).
- Know how to react to a breach: qualify, notify within 72 hours where required, document.
What triggers the need
- Installing or changing practice software or an online scheduling tool
- Joining forces with other practitioners or hiring a secretariat
- A patient requesting access to their record
- An incident: lost equipment, a misdirected message, a compromised workstation
Sound familiar? Now is the right time to get the subject under control — before it takes control on its own.
The most common mistake
Thinking “I’m too small to be concerned”. The two physicians sanctioned by the CNIL in 2020 practiced individually: size only exempts you, as a rule, from the obligation to appoint a DPO — not from the record of processing, not from security, not from breach notification.
What we put in place
- A Health Compliance Diagnostic tailored to independent practice
- A proportionate documentation kit: simplified record, notices, procedures
- Review of the practice’s tools and providers
- Awareness for the practitioner and the secretariat
- One-off support in the event of an incident or a patient request
Expertise backed by the NELSE technology
Independent health professionals: our support relies on the tools developed by NELSE: each processing activity is qualified by written, sourced legal rules, the register stays up to date version after version, and the files handed over can be verified by a third party. The DPO assesses, advises and documents their opinions; your organisation keeps its decisions.
In practice, for you: the register is built in a few records described by simple facts, with no legal vocabulary; each processing activity's regime appears with its grounds, and you receive a readable file in case of inspection.
Discover our softwareYour questions
Must an independent physician appoint a DPO?
In principle no, for individual practice: the European guidelines expressly cite this case as not amounting to large scale. Things change in group practice — MSP, health center, a large group practice — where the analysis is made case by case. A voluntary appointment remains possible and sometimes relevant.
What does a practice really risk?
Real but proportionate sanctions: in 2020, two independent physicians were fined €3,000 and €6,000 for a security failure (images accessible online) and for failing to notify the breach. Beyond the fine, what is at stake is patients’ trust — and that cannot be bought back.
Where to start without spending weeks on it?
Three proportionate work streams: check basic security (passwords, updates, backups, router configuration), keep a simplified record of the practice’s processing activities, and display clear information for patients. Our Health Compliance Diagnostic covers these points and delivers a roadmap within 10 business days.
Let’s secure the compliance of your organization
A free first conversation to review your situation and identify your priorities.
Response within one business day · No obligation