Assessing Health Data Processing

Overview

Health data is classified as a special category under GDPR Art. 9(1), requiring both a lawful basis under Art. 6(1) and an Art. 9(2) exemption for processing. Processing of health data on a large scale triggers a mandatory DPIA under Art. 35(3)(b). This skill provides a DPIA methodology for health data processing scenarios: electronic health records, clinical trials, health research, telemedicine, health applications, medical devices, and genetic data analysis.

Legal Framework

Art. 9(1) — Definition of Health Data

GDPR Art. 4(15) defines data concerning health as "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status."