Record of processing activities in a clinic (GDPR Article 30)

A clinic's record of processing activities is a written inventory of what it does with personal data – what it uses them for, whose they are, what data they are, who they are disclosed to, how long they are kept and how they are protected. It is required by Article 30 of the GDPR and, with health data involved, the size of the clinic does not exempt it.

What it is and who has to keep it

The record is kept by whoever decides why and how the data is processed: in a clinic, the clinic itself. The GDPR says each controller shall maintain a record of processing activities under its responsibility. And it understands processing to mean almost anything done with a piece of data – collecting it, recording it, storing it, consulting it, disclosing it or destroying it, among other operations.

The LOPDGDD (Spain's data protection and digital rights law) adds a practical criterion: the record may be organised around structured sets of data and must specify the processing activities according to their purposes. In other words: you can group it by data sets, but each activity is described by its purpose, not by the program in which it is stored.

Two details that often cause confusion:

• It must be in writing, including in electronic form. A document or a well-maintained spreadsheet will do.
• It is not sent to the AEPD (the Spanish Data Protection Agency) for approval. The GDPR asks for it to be made available to the supervisory authority on request.

The supplier that processes data on the clinic's behalf, such as the management software, must also keep its own record: the GDPR asks each processor for a record of all categories of processing activities carried out on behalf of a controller. That record belongs to the supplier and does not replace yours.

Why the 250-person exception does not help a clinic

The size exception exists, but it does not reach anyone processing health data. Article 30.5 of the GDPR says these obligations shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of personal data.

A clinic meets at least two of those conditions at once: it processes patient data every day, so the processing is not occasional, and data concerning health is a special category. That is why a practice with two professionals and one person at reception cannot rely on being small. Why health data is special is explained in data protection in a clinic.

What each activity must say

Each activity in the record must contain the information listed in Article 30.1 of the GDPR. This table sets it beside a clinic example; the examples are indicative and you need to adjust them to what your centre does.

What the GDPR requires	Example in a clinic
a) Name and contact details of the controller and, where applicable, of the data protection officer	The company or professional who owns the clinic, their address and email, and those of the officer if there is one
b) The purposes of the processing	Providing healthcare and keeping the medical record
c) Categories of data subjects and of personal data	Patients and, if they are minors, their representatives; identification, contact and health data
d) Categories of recipients	Who it is disclosed to: for example, the laboratory that does the tests or the management software supplier
e) Transfers to third countries, where applicable	If any supplier processes the data outside the European Union, which one and with what safeguards
f) Envisaged time limits for erasure, where possible	For the medical record, the legal retention period and whatever the rule of your autonomous community adds, if there is one
g) General description of security measures, where possible	Personal user accounts, permissions by role, a log of who views the record

On point d), remember that under the GDPR a recipient is the person or body to which personal data is disclosed, whether a third party or not: the supplier that processes it for you counts too. The AEPD itself gives as an example of a processor the external service providers that carry out blood tests and other tests.

On point f), the minimum period for the medical record is not yours to choose: Law 41/2002 requires clinical documentation to be kept for the time appropriate to each case and, as a minimum, five years counted from the date of discharge from each care process. The nuances, and what your autonomous community may add, are in how long to keep the medical record.

Typical activities of a clinic

A clinic's activities are recognised by their purpose. These four are a starting point. There is no official template with these names: it is a reasonable way to start, which you will need to adapt.

1. Patients and medical record. Care: record, history, consents, clinical photos and documents for each patient. It is the activity involving health data and the one that needs most care.
2. Diary and appointments. Making, changing and cancelling appointments and contacting the patient. You can describe it within the previous one or separately; what matters is that it is not left out.
3. Invoicing and payments. Invoices, payments, quotes and what is outstanding. Their retention periods are those of commercial and tax rules, not those of the medical record: ask your accountancy firm.
4. Team. The data of the people who work at the clinic: contracts, payroll and access to the software.

And these others, only if you do them:

• Marketing communications to patients.
• Patient photos for the website or social media, kept apart from clinical photos and with their own consent. We cover it in before-and-after patient photos.
• Video surveillance at the entrance or at reception.
• Job candidates who send in their CV.

Keeping it up to date

A record is useful as long as it describes what the clinic does today, so it has to be revisited every time something changes. The typical occasions:

• you hire a new supplier who will see patient data, or you change management software;
• you open a new specialty or start treating minors;
• you start using patient photos outside the consulting room;
• you change the period or the way old documentation is destroyed.

If the clinic has a data protection officer, the LOPDGDD requires them to be told of any addition, modification or removal in the content of the record. When a clinic has to have one is explained in the data protection officer in a clinic.

A good habit, although no rule sets the date: review it once a year, on the same day you review who has access to what.

What data your clinic handles in Mi Clínica

If you run the clinic with Mi Clínica, the software does not draft your record, but it helps you know what to put in it, because it brings almost all the activities above together in one place:

• Patients: the general record with allergies, medication, history and habits, and the record by specialty, with its body chart and files.
• Diary: each appointment with its status, from “planificada” (planned) to “finalizada” (finished), “no presentado” (no-show) or “cancelada” (cancelled).
• Payments: invoices and payments by cash, card, Bizum (a Spanish mobile payment app) or bank transfer.
• Team: each person logs in with their own user and sees what belongs to their role.

For point g) you can describe measures the software applies: each clinic is isolated and none can see another's data; there are permissions by role; and who views the medical record is logged, with user, date and time. What the software does not do is decide your purposes, your retention periods or your suppliers: the clinic sets those, with its adviser. The summary of features is on the Mi Clínica page (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Reglamento (UE) 2016/679, Reglamento general de protección de datos. BOE (DOUE).
• Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado). BOE.
• Guía para pacientes y usuarios de la Sanidad. AEPD.
• Ley 41/2002, básica reguladora de la autonomía del paciente (texto consolidado). BOE.