Data protection officer in a clinic: do you need one?

A clinic that is a healthcare centre must appoint a data protection officer: Spain's LOPDGDD includes in its list the healthcare centres legally obliged to keep their patients' medical records. Health professionals who practise on their own account are left out, and they may appoint one voluntarily.

When it is mandatory in a clinic

For a clinic in Spain, the answer lies in one specific point of Spanish law. Article 37 of the General Data Protection Regulation sets out the general cases in which an officer must be appointed. The LOPDGDD, Spain's data protection act, keeps those cases and, in its Article 34, adds a list of entities that must appoint one in every case. This is the point that affects clinics, in full (translated from the Spanish):

“l) Healthcare centres legally obliged to keep their patients' medical records. Excepted are health professionals who, even though legally obliged to keep their patients' medical records, practise on their own account.”

Spain's Ley 41/2002 (the basic law on patient autonomy and clinical documentation) defines a healthcare centre as “the organised set of professionals, facilities and technical means that carries out activities and provides services to look after the health of patients and users” (translated from the Spanish), and says that each centre will archive its patients' medical records. The Spanish Data Protection Agency's (AEPD) guide for patients turns this into examples: hospitals, health centres, specialist care centres and clinics must have an officer; the private practices of an individual health professional need not.

Your case	What the rule says
A clinic that is a healthcare centre, even a small one	Falls under point l): it must appoint an officer. The point makes no distinction by size.
A health professional who practises on their own account	Exempt from point l). May appoint one voluntarily.
A centre that is not a healthcare centre	Does not fall under point l). You then need to see whether it fits the general cases in the GDPR.
Anyone who is not required to	May appoint one voluntarily, under the same regime.

Where the line falls in your case, for example whether your clinic is a healthcare centre or whether a professional who shares premises with others practises on their own account, depends on how your activity is set up and authorised: confirm it with your adviser.

If you are not required to

If you are not required to, you can still appoint one. The LOPDGDD allows anyone who is not on the list to appoint an officer voluntarily, and that officer is subject to the same regime under the GDPR and the act itself. Notification to the AEPD, covered below, also applies when the appointment is voluntary.

Even if you do not appoint one, someone at the clinic will have to take care of data protection: dealing with a patient who asks for their records, checking who has access to what, or keeping the information given to patients up to date. Putting a name to that task helps, whether or not they are an officer. We go over the other basic pieces in data protection in a clinic.

Who can be the officer

The officer is chosen for their professional qualities: the GDPR refers in particular to expert knowledge of data protection law and practice and to the ability to fulfil their tasks. In addition:

• Inside or outside. They may be a member of staff or fulfil their tasks under a service contract.
• With other tasks, without conflict. They may have other duties, provided these do not give rise to a conflict of interests.
• With the time commitment needed. The LOPDGDD allows a full-time or part-time commitment to be set, among other criteria, according to the volume of processing, the special category of the data processed or the risks.
• Independent. They receive no instructions on how to carry out their tasks, cannot be dismissed or penalised for performing them, and report directly to the highest management level of the clinic.
• Voluntary certification. The LOPDGDD provides that their requirements can be demonstrated, among other means, through voluntary certification mechanisms, and the AEPD promotes a certification scheme for officers.

What the officer does in a clinic

The officer informs, advises and monitors; they are not the one who decides for the clinic. Their minimum tasks are set by Article 39 of the GDPR:

• to inform and advise the clinic and the employees who carry out processing of their obligations;
• to monitor compliance, including the assignment of responsibilities, awareness-raising and training of staff, and the related audits;
• to provide the advice requested on the impact assessment and monitor its performance (when one is needed is covered in the impact assessment in a clinic);
• to cooperate with the supervisory authority and act as its contact point.

The clinic, for its part, must ensure that the officer is involved, properly and in a timely manner, in all issues relating to data protection. And the LOPDGDD gives the officer specific tools:

• Access to data. In carrying out their tasks they have access to personal data and processing operations, and the clinic cannot invoke a duty of confidentiality or secrecy against them. In return, the GDPR requires them to maintain secrecy or confidentiality when performing their tasks.
• Point of contact. They act as the clinic's contact with the AEPD and the regional data protection authorities.
• Patient complaints. Before complaining to the AEPD, the patient may contact the officer, who will communicate the decision within a maximum of two months. If the complaint reaches the AEPD, it may forward it to the officer to respond within one month.
• Breaches. If they identify a significant breach, they document it and report it immediately to the clinic's governing and management bodies.

Notifying the AEPD and making the officer known

Appointing the officer is not enough: you must notify the appointment and publish how to contact them.

1. Publish their contact details and communicate them to the supervisory authority, as the GDPR requires.
2. Within ten days. The LOPDGDD sets that deadline for notifying the AEPD or, where applicable, the regional authority, of appointments and dismissals, whether the appointment is mandatory or voluntary. The AEPD has a form for this through its online portal.
3. In the information given to patients. Article 13 of the GDPR includes the officer's contact details, where applicable, among what must be provided to the patient. How to provide it is covered in how to inform patients about their data.

Once appointed, patients can contact the officer on all issues relating to the processing of their data and the exercise of their rights.

What the officer will want to see in your software

An officer reviewing a clinic ends up asking about the management software: who gets in, what each person sees and whether a trace is left. In Mi Clínica:

• Users and roles. Each member of the team logs in with their own user and sees what their role allows: reception, administration, management or healthcare professional.
• Access trail. A log records who consults the medical record, with user, date and time. If the person opening the file has no clinical access, the log shows that they opened the patient's file, not that they consulted the medical record. Views of documents and photos, and the download of a photo, are also logged, and anyone with clinical access can see this in the “Actividad” (Activity) tab of the patient file.
• Permission changes. Each person's permissions are changed by whoever holds the management permission, which “Dirección” (Management) and “Administración” (Administration) have by default, except for clinical matters (access to the medical record and the prescription), which only “Dirección” grants or removes, and permission changes are logged.
• Each clinic isolated. No clinic can see another's data.

That trail is working material for the officer when reviewing access. What the software does not do is the officer's job, or prove that your clinic complies with any regulation. How to split access by role is covered in who can see the medical record, and the rest of the features are on the Mi Clínica page (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado). BOE.
• Reglamento (UE) 2016/679, Reglamento general de protección de datos. BOE (DOUE).
• Ley 41/2002, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica (texto consolidado). BOE.
• Guía para pacientes y usuarios de la Sanidad. AEPD.
• Designación de un delegado de protección de datos. AEPD.