GDPR checklist for
firms and clinics

Yes, almost always, although the record itself isn't something you file with anyone — it's an internal document. The GDPR exempts the smallest organisations from keeping one, but that exemption doesn't apply when processing is not occasional or includes special categories of data. A clinic processes health data by definition, and a firm processes its clients' data routinely rather than occasionally, so both fall outside the size exemption. In practice the record must list what data is processed, for what purpose, on what legal basis, who it's disclosed to if anyone, and how long it's kept. You don't need to submit it to anyone unless the supervisory authority asks for it during an inspection, but without it there's no way to show that the rest of your compliance has an organised foundation behind it.

For clinics, often yes. Spanish law requires one for healthcare centres legally obliged to keep medical records, with an express exception for a healthcare professional practising individually without an organisation behind them. For law firms, accountants or advisory practices it isn't usually mandatory under the fixed list, although it can be if the volume or type of processing justifies it: a one-person practice isn't the same as an accountancy firm with dozens of clients and several employees accessing their data. This is exactly the question to take to your legal adviser rather than your IT provider: we can tell you whether your systems meet the technical conditions for someone to perform that role, but whether the role is mandatory in your specific case, and who should take it on, is a legal judgement that depends on how the business is organised.

Yes: the data processing agreement required by Article 28 of the GDPR, in addition to the usual service contract. If someone accesses your systems, and therefore patient or client data, it has to be set out what they can do with that data, for what purpose, what confidentiality their staff are bound by and what happens when the relationship ends. This doesn't only apply to the IT provider: it applies equally to the hosting company running your website or email, the cloud management software you use every day, the accountant if they also handle other data, and the company that shreds your paper records. Any of them that touches personal data needs that agreement signed. It's common to find firms with all the legal side in order and not a single one of these agreements signed with the party that has the most technical access to their systems.

National law sets a minimum of five years from discharge for each episode of care, and the regions can extend that period: in Catalonia the retention periods are longer, so it's worth confirming them with your legal adviser before destroying any medical record, rather than relying on a generic figure found online. But from the IT side the real problem is almost never the one people worry about: hardly anyone deletes too much or destroys records too early. What usually happens is the opposite — keeping everything indefinitely because the disk has room and nobody ever set a period or a procedure to apply it. That's also a breach, even if it doesn't look like one: keeping health data longer than required needlessly increases the amount of sensitive information that has to be protected, and that can be lost if something goes wrong with the system.

To say the appointment is at five, sparingly and without mentioning the reason for the visit, many people use it without much trouble. To send reports, test results, deeds or any documents from the file, it isn't a suitable channel: it ends up on a personal phone, is copied automatically to a cloud the business doesn't control, and stays in the history of a device that gets lent, replaced or lost without anyone wiping it first. If a patient or client asks for documents to be sent, they have to go through a channel the business can control, with a record of who sent them and when: a company email account, the management software itself if it has messaging, or a download link that expires. The convenience of a personal phone isn't worth losing control over where that sensitive information ends up.

Always document it, whatever its severity, and notify the AEPD (the Spanish Data Protection Agency) within 72 hours if it's likely to pose a risk to the rights of the people affected. An email sent with thirty patients visible in the recipients is a breach even if nobody did anything with that data afterwards; so is a lost unencrypted laptop, even if it turns up unopened the next day. What sinks most firms and clinics isn't so much the breach itself as discovering, in the middle of the scare, that nobody was clear about who decides whether to notify, who writes the notice and who has to be told first. Having that written down in advance, even on a single page, is what makes the difference between sorting it out in a day and spending a week not even knowing whether you need to call anyone.

No, and relying on consent alone is a common mistake that also complicates things. Healthcare has its own legal basis under the GDPR, and much of the data processing in a professional firm rests on legal obligation or the contractual relationship with the client, not on consent that has to be requested. Consent is needed specifically for what falls outside those bases: sending marketing communications, publishing a photograph, passing data to a third party not involved in providing the service itself. Asking for it for everything, including the care itself, adds no protection: it dilutes real consent among routine signatures nobody reads, and that makes it harder to prove that the consent that does matter, when it's needed, was given freely and on an informed basis.

No. The duty to inform — the notice in the waiting room, the clause on the form, the paragraph at the foot of the email — is the most visible point and also the easiest to meet, precisely because it doesn't require changing anything about how day-to-day work runs. It's just one check among several. What the AEPD looks at when a real complaint arrives is who had access to see a specific piece of data, the traceability of that access, whether there are agreements with the providers who touch the systems, and whether backups really exist and can be restored. A flawless notice at the entrance with the management software password stuck on a Post-it on the reception monitor protects nothing: it meets the visible part and fails the part that really matters when something goes wrong.