Personal data protection – where to start?

Abstract

The present article focuses on the main General Data Protection Regulation requirements for private medical practices. It starts with description of 2 basic capacities in which an entity processing personal data can act, i.e. the controller or processor. Then, aforementioned roles are allocated to the physicians depending on the nature of their work (hospital or private medical practice), together with the description of legal basis for personal data processing in healthcare sector. The last part contains the most important elements of data protection that any physician should start with. These are: implementation of adequate technical and organisational security measures, provision of accurate privacy notice to patients as well as introduction of basic personal data documentation, i.e. the records of processing activities and personal data breach notification procedure