Data protection in the practice: two duties that apply to every practice — and two that do not apply to most
Anyone who runs a practice receives a lot of material on data protection that treats everything as equally important. That does not help with the question one actually has — what do I have to do, and what not?
Four duties are under discussion. Two apply to every practice. Two do not apply to most. And public perception has it almost exactly the other way round.
The record of processing activities: the duty you cannot be exempted from
The best-known relief in the General Data Protection Regulation is the one for small organisations: Article 30 paragraph 5 provides, in principle, an exemption from the record-keeping obligation for enterprises and organisations with fewer than 250 employees. Many practices therefore consider themselves exempt.
Not here. The exemption does not apply as soon as one of three points applies: if the processing is likely to result in a risk to the rights and freedoms of data subjects, if it is not occasional — or if special categories of personal data are processed (Art. 30 para. 5 GDPR). Health data are exactly that — Art. 9 para. 1 names them expressly.
For treatment practices, at least two of these exclusion grounds apply: the processing is not merely occasional, and it concerns special categories of personal data. Each of these two grounds is sufficient on its own. Under the law currently in force, every practice needs a record of processing activities, regardless of its size.
The mandatory details under Article 30 paragraph 1 include in particular: the controller and its contact details, the purposes of the processing, the categories of data subjects and of personal data, the categories of recipients — and, as a separate point, where applicable, transfers to a third country or an international organisation. In addition, where possible, the envisaged time limits for erasure and a general description of the technical and organisational measures.
The last point is the underestimated one. For most practices, the record is the only occasion to set down at all what is deleted when. Anyone who fills it in seriously has, along the way, answered the question that otherwise only comes up when something goes wrong.
And this may change
A note that carries more weight on this topic than the usual caveats: a legislative procedure is under way on Article 30. The simplification package “Omnibus IV” (procedure 2025/0130(COD)) provides for relief for smaller organisations and would reshape the exemption in paragraph 5 — according to the provisional agreement reached in June 2026, among other things through a considerably higher employee threshold and a more risk-based design of the record-keeping obligation.
That is not the law in force. The procedure has not yet been concluded, and the change is not in force. Until an amending regulation enters into force, Article 30 applies unchanged.
For the practice, this means two things. First: anyone who has no record today has a gap today, and the procedure does not change that. Second: anyone who sets one up should not assume that the requirements will stay the same permanently.
There is a certain irony in the fact that an article about outdated information sheets can itself quickly become outdated. That is why the status date is at the top.
Technical and organisational measures
The second duty that applies to everyone: appropriate technical and organisational measures, taking into account the state of the art and appropriate to the risk (Article 32 GDPR).
A list deliberately does not appear here. What is appropriate depends on the risk, and an enumeration in running text is read as a checklist, which it is not. The reliable statement is: the measures must be taken — and the record contains, where possible, a general description of them. The details in the record replace neither the actual implementation of the measures nor the necessary proof that appropriate measures have been taken.
Do you need a data protection officer?
This is where it gets interesting, because the common answer and the correct one diverge.
For practices, three situations are relevant above all.
The first is a number. Under § 38 para. 1 sentence 1 BDSG (Federal Data Protection Act), a data protection officer must be designated if, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data. Every person is counted, including the controller themselves — full-time and part-time staff, trainees, temporary agency workers, freelancers. Whether someone is “constantly” engaged in this is judged by their actual activity — supervisory authorities look at the focus of the activity, but do not define the criterion entirely uniformly. Anyone who works exclusively with paper records does not count under this reading.
The second is a characteristic. Art. 37 para. 1 point (c) GDPR requires a data protection officer if the core activities consist of processing special categories on a large scale. That sounds as if every practice were covered — health data are, after all, their core business.
For the interpretation of the term large scale, Recital 91 gives an important indication: processing should not be considered to be on a large scale if it concerns personal data from patients and is carried out by an individual physician or other health care professional.
And the supervisory authorities go further: even for joint professional practices, group practices and practices that employ other health care professionals, processing on a large scale within the meaning of Art. 37 para. 1 point (c) is not to be assumed as a rule — described as a consensus, with reference to a resolution of the Data Protection Conference. The resolution of the Data Protection Conference of 26 April 2018 still names the threshold of ten persons applicable at the time for the designation obligation; since November 2019 it has been twenty.
The third is the impact assessment. If a data protection impact assessment has to be carried out for a processing operation, a data protection officer must be designated regardless of the number of persons (§ 38 paragraph 1 sentence 2 BDSG). More on this below.
For most practices, the first situation therefore remains decisive: the number.
The number in circulation, and the number that applies
There is a trap at this point, and of all places it lies in an official source.
An older interpretation aid of a state data protection supervisory authority on data protection officers in the medical sector, still available online, names ten persons as the threshold. It is carefully made, it explains the counting method more precisely than any other source — and on the number it is outdated. It dates from before the amendment of § 38 BDSG in November 2019, which raised the threshold from ten to twenty.
On its current pages, the same authority states the correct number. But anyone who finds the older guidance and adopts it without checking may come to the wrong conclusion that they have to designate a data protection officer on account of the number of persons alone.
This does not call for distrust of supervisory authorities, but for a more mundane rule: with numbers in information sheets, look at the date first. The interpretation of a term ages slowly. A threshold becomes outdated on the day the legislator changes it.
Data protection impact assessment: mostly no — but with a consequence
A data protection impact assessment must be carried out if the processing is likely to result in a high risk to the rights and freedoms of data subjects, for example through new technologies (Art. 35 GDPR).
The first step is therefore not the impact assessment, but the preliminary check: every controller must assess whether the specific processing is likely to entail such a risk. For reasons of accountability, this decision should be documented in a traceable way. For the typical processing of a single-handed or small practice, an impact assessment is often not required; the assessment nevertheless remains case-specific. With new functions — extensive automated analysis of very sensitive content, profiling, AI-supported procedures — it may turn out differently. The use of cloud software alone, on the other hand, does not trigger an impact assessment in itself.
The connection one should know: if an impact assessment is required, a data protection officer must be designated regardless of the number of persons (§ 38 para. 1 sentence 2 BDSG). The two questions are therefore linked — whoever answers one with “yes” has answered the other as well.
Erasure when you have to retain
The most frequent erasure question in practice arises from an apparent contradiction: the patient requests erasure, but the record is subject to the retention obligation of, in principle, ten years after the end of treatment.
The contradiction is none. The right to erasure does not apply insofar as the processing is necessary for compliance with a legal obligation — and the statutory retention obligation under § 630f paragraph 3 BGB (German Civil Code) is one (Art. 17 para. 3 point (b) GDPR).
What applies after the ten years have expired is the question that then actually has to be answered — and the answer is not automatically “delete the next day”. It must be checked whether another retention obligation or another permissible ground for storage continues to exist. If neither exists, the principle of storage limitation applies. This check belongs in the time limits for erasure in the record of processing activities — in the place where it is clarified once instead of anew each time.
When something happens: 72 hours
A personal data breach must be notified to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it — unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33 GDPR).
And even where no notification is required, one duty applies: the breach must be documented — with the facts relating to it, its effects and the remedial action taken (Article 33 paragraph 5).
The deadline is tight enough that the decision should not be taken for the first time when the event occurs. Anyone who has laid down in advance who is responsible in an emergency and which authority would have to be informed has created an important precondition for meeting the short deadline. The actual work — establishing the facts, assessing the risk, containing, documenting — remains alongside.
Where to start
Anyone who does not yet have the record does not start with a template from the internet, but with four questions. The template comes afterwards — it is just a table.
First: what do you process at all? Not in the abstract, but as a list of activities: appointment scheduling, treatment documentation, billing, applications, reports to third parties, website contact form. Each activity is one line.
Second: who gets to see the data? Practice staff, billing office, tax adviser, software provider, health insurer, reviewer. This also belongs in the record — and it is the point where it becomes apparent if, for a processor, the required contract under Article 28 GDPR is missing. Not every recipient is one: a cloud provider or IT service provider can be a processor, a tax adviser or a health insurer regularly not.
Third: when is data deleted? One time limit per activity. For the treatment record it is laid down by law; for the other activities it must be checked whether statutory retention periods exist — and, where they do not, when the data are no longer needed for the purposes pursued and no other permissible ground for storage remains.
Fourth: how many persons are there? The count under § 38 BDSG takes five minutes and answers the most expensive of the four questions.
The result is not a document for the drawer. It is the answer you need to have ready when a supervisory authority asks.
What remains
Of the four duties considered here, under the law currently in force two apply to practically every treatment practice: the record of processing activities and the technical and organisational measures. Other data protection duties — information obligations, data subject rights, processing on behalf, accountability — remain unaffected by this.
Both easily slip under the radar in everyday practice — until an inspection or a data breach shows why they matter. And not both are paper: the record is documentation, the technical and organisational measures must actually be implemented.
Two further duties do not apply to most practices: designating a data protection officer and the impact assessment.
That is not an all-clear, but a shift. The effort often does not lie where one expects it.
About the status of this text
This article reflects the status as of 13 October 2026. It offers orientation, not legal advice, and it does not assess any individual case — in particular not whether your practice has to designate a data protection officer. The text names the criteria; the practice does the counting itself. This is a translation; the German version („Datenschutz in der Praxis“) is authoritative.
And because this article is about an outdated number: check the status date of this text too.
A note on our own behalf: this text comes from Psymira, a provider of documentation software for psychotherapy practices. The practice, as controller, remains responsible for the record. Software, advice or a data protection officer can support its creation and maintenance. A provider should make reliable information on data flows, processing on behalf and security measures available for this — that is what one should ask for.