Does your clinic need a data protection impact assessment?

A clinic's data protection impact assessment (DPIA, EIPD in Spanish) is an analysis, carried out beforehand, of processing that may involve a high risk for patients. Not every clinic needs one: the Spanish Data Protection Agency (AEPD) considers it necessary in most cases where processing meets two or more criteria on its list, and health data is already one of them.

What an impact assessment is

An impact assessment is the prior study that the GDPR requires when processing is likely to result in a high risk. Article 35 of the GDPR says that where a type of processing, in particular one using new technologies, is likely, by its nature, scope, context or purposes, to result in a high risk to the rights and freedoms of natural persons, the controller shall carry out an impact assessment before the processing.

Three ideas from that article to be clear about from the start:

• It is done before the processing starts, not when it has already been running for months.
• The controller does it, that is, the clinic. A supplier can help you with information, but the assessment is yours.
• A single assessment can cover several similar processing operations that present similar high risks.

In Spain, the LOPDGDD (Spain's data protection law) links it to the controller's general obligations: when deciding on their measures, controllers will assess whether an impact assessment is appropriate, and will take into account the higher risks of certain cases. These include processing of special categories of data that is not merely incidental or ancillary, and processing of data of groups in a situation of particular vulnerability, in particular minors and people with disabilities.

What the GDPR says about health data on a large scale

The GDPR requires the assessment in particular where there is large-scale processing of special categories of data, such as health data. That is the case in article 35.3(b), and the first one to look at in a clinic.

What is “large scale”? The GDPR gives no figure. Its recital 91, which is not an article but part of the explanation that precedes the articles, offers guidance at one end: the processing of personal data should not be considered to be on a large scale if it concerns the data of patients or clients of an individual physician or other health care professional. And it adds that, in such cases, an impact assessment should not be mandatory.

Between a professional working alone and a hospital there is a lot of ground, and that is where a clinic with several professionals has to look beyond large scale: at the list published by the AEPD.

The AEPD list: the two-criteria rule

The GDPR requires each supervisory authority to publish a list of the types of processing that require an impact assessment. The AEPD list is indicative and non-exhaustive, and sets a practical rule: an assessment will be necessary in most cases where the processing meets two or more criteria on the list, unless the processing is on its list of those that do not require one. The more criteria it meets, the greater the risk and the greater the certainty that one is needed.

These are the criteria on the list that most often intersect with a clinic:

AEPD criterion	When it may apply in a clinic
4. Use of special categories of data under article 9.1 of the GDPR	Whenever you keep medical records: health data is one
9. Data of vulnerable subjects, including children under 14 and elderly people with some degree of disability	If you treat children under 14 or elderly people with some degree of disability
7. Large-scale use of data	It depends on volume: the AEPD refers to the criteria in the European guidance WP243, on data protection officers
10. New technologies or innovative use of established technologies	If you bring in a new tool that processes health data in a new way
8. Association or combination of databases with different purposes	If you cross-reference medical records with other data, for example marketing data

Note the first row: in a clinic, criterion 4 is almost always met. That is why the useful question is not whether you process health data, but whether any of the others also applies.

Three clinic situations

With the two-criteria rule, a clinic can form a first idea of its case. These examples are meant to guide you, not to decide for you: take the final decision with your data protection officer or your adviser.

A professional who works independently and treats adults

They meet criterion 4 and, in principle, no other, so the two-criteria rule does not apply. In addition, under recital 91, the processing of a single health professional should not be considered large scale. And the AEPD includes in its list of processing that does not require an assessment processing carried out by self-employed workers practising individually, in particular doctors, health professionals or lawyers, without prejudice to an assessment being required where the processing significantly meets two or more criteria on the previous list. The AEPD itself asks that the decision not to carry one out be adequately justified: put it in writing and review it if you change the way you work.

A clinic that treats children

On top of health data there is criterion 9, which expressly names children under 14. That makes two criteria, so, according to the AEPD list, the assessment will be necessary in most cases. The same applies if you regularly treat elderly people with some degree of disability.

A clinic that adopts a new tool

If you bring in a new application that processes health data in a new way, for example one that automatically analyses patients' records, criterion 10 may come into play. If it does, together with health data that would be two criteria; and if the assessment is needed, it is done before using the tool with real patients.

What it must include and who takes part

The GDPR sets a minimum content for the assessment, listed in its article 35.7:

1. A systematic description of the envisaged processing operations and their purposes.
2. An assessment of the necessity and proportionality of those operations in relation to their purpose.
3. An assessment of the risks to the rights and freedoms of patients.
4. The measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of data.

As for who takes part, the GDPR requires the controller to seek the advice of the data protection officer, where one has been designated. If your clinic has to have one, we explain it in the data protection officer in a clinic.

And two steps that get forgotten:

• Review it. The controller will examine whether the processing complies with the assessment, at least when the risk changes.
• Consult the authority. If the assessment shows that the processing would involve a high risk if no measures are taken to mitigate it, the controller will consult the supervisory authority before starting.

The impact assessment fits with the other pieces of a clinic's data protection, such as the duty to inform or security measures: you have the full map in data protection in a clinic.

What you can describe about your practice management software

In the measures section of the assessment you will have to describe how the software you run the clinic with protects data. If you use Mi Clínica, these are measures you can check and describe:

• Isolation between clinics. No clinic can see another's data.
• Access by role. Each team member signs in with their own user and sees what belongs to their role; by default, “Recepción” (Reception) has no clinical permission.
• Access trail. It records who consults the medical record, with user, date and time.
• Artificial intelligence without health data. The AI assistant comes switched off and only helps with management, such as appointments, free slots or invoicing: it does not receive health data.

What the software does not do is the assessment: it does not decide whether you need one or certify that your clinic complies with any regulation. The clinic decides that. You have the summary of features on the Mi Clínica page (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Reglamento (UE) 2016/679, Reglamento general de protección de datos. BOE (DOUE).
• Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado). BOE.
• Listas de tipos de tratamientos de datos que requieren evaluación de impacto relativa a protección de datos (art. 35.4). AEPD.
• Lista orientativa de tipos de tratamientos que no requieren una evaluación de impacto (art. 35.5 RGPD). AEPD.