GDPR for practitioners in private practice: your obligations
An overview of data protection responsibilities for practitioners in France: health data, patient information, security, processing records and service providers.
Countries covered : France
When processing health data, a practitioner in private practice is responsible for protecting it under the GDPR. This is not insurmountable: it is largely a matter of putting common sense into an organised framework.
This page summarises your main obligations in plain language. It complements our pages on professional confidentiality (professional ethics) and HDS-certified hosting (storage).
Health data is sensitive data
The GDPR classifies health data as sensitive data, whose processing is strictly regulated. The practitioner who collects and retains it is the data controller: they must be able to demonstrate compliance with the rules.
Your main obligations
- Clear purposes. Collect data only for specified purposes (care, follow-up and billing), without using it for unrelated purposes.
- Data minimisation. Collect only the data needed: record only what is useful.
- Security. Protect data through restricted access, passwords, encryption and backups.
- Patient information. Inform patients about how their data is used and their rights (access, rectification and so on).
- Records of processing activities. Keep a record describing the processing carried out.
- Data processors. Ensure service providers (software and hosting providers) are compliant: HDS-certified hosting for health data and contractual safeguards.
- Managed retention. Define retention periods and archive or delete data in accordance with the rules (see the dedicated page).
- Data breaches. Know how to respond to an incident and notify it when required.
Patient information and rights
Patients have the right to know what data is processed and why, and to exercise their rights (access, rectification and, where applicable, restriction or objection). Clear information—for example, a notice in the waiting room or a handout—is often enough to explain the framework.
GDPR, professional confidentiality and HDS: how they fit together
These three concepts complement one another: professional confidentiality is the ethical duty of confidentiality; the GDPR governs the processing of personal data; and HDS-certified hosting secures its storage by a third party. Complying with one without the others is not enough: together, they protect your patients.
The role of digital tools
A good tool makes compliance easier through restricted access, traceability, HDS-certified hosting, GDPR compliance and control over data. Delta is designed around this approach: your documentation and longitudinal patient records remain confidential and belong to you.
Further reading
This page provides guidance; for the precise details, France’s data protection authority, the CNIL, publishes guides for healthcare professionals. If you are unsure about a particular situation, consult those sources.
Frequently asked questions
Does the GDPR apply to a practitioner in private practice?
Yes: when processing health data, the practitioner is a data controller and must comply with the GDPR, particularly its requirements for security, patient information and records of processing activities.
What are the main obligations?
Clear purposes, data minimisation, security, patient information and rights, records of processing activities, compliant data processors and managed retention periods.
Do I need records of processing activities?
Yes: the record describes the processing carried out (purposes, data, recipients and retention periods). It is a key part of demonstrating compliance.
Does my software need to be compliant?
Yes: data processors (software and hosting providers) must be compliant, with HDS-certified hosting for health data and contractual safeguards.
Where can I find reliable references?
The CNIL publishes guides for healthcare professionals. If you are unsure about a specific situation, it is advisable to consult them.
Compliance made easier by your tools
Delta hosts your data with HDS certification and complies with the GDPR: restricted access, traceability and control over your data.
Try it free