Privacy and GDPR in the veterinary practice: what you really need in practice

The first clarification is conceptual. The regulation protects natural persons, so in the practice the personal data is that of the owner and of anyone who brings the animal in. The animal's clinical record is still personal data, because it is linked to an identifiable owner and often includes their name, address, contacts and payment habits.

Some information deserves particular attention because it is indirectly sensitive: an instalment payment reveals an economic situation, a message may contain health data about the person when it explains why they cannot manage a therapy. Treating this data with the same care reserved for delicate information is a prudent choice, not an excess.

Every processing activity needs a legal basis, and it is not always consent. Confusing the informed consent to the clinical procedure with consent to data processing is a common mistake: they are two different things, with different purposes.

The privacy notice must be clear, accessible and given at the time the data is collected. A comprehensible text that genuinely reflects what the practice does is better than a generic template downloaded and never adapted. A notice describing processing that does not exist is as risky as one that omits processing that does.

Most problems do not come from sophisticated attacks, but from neglected daily habits. At reception, in the consulting room and behind the scenes, data leaves where it should stay with surprising ease.

• Practice management screens facing the waiting room, with names and diagnoses readable by anyone passing.
• Calling out the surname and reason for the visit loudly in a crowded room.
• Paper documents left on the counter or in the bin without destruction, rather than filed or shredded.
• Personal messaging used to send reports or photos, outside the practice's channels.
• Shared accounts without individual credentials, making it impossible to know who did what.
• Memory sticks and mobile devices with unencrypted data, easy to lose.

Data is not kept forever and is not handled in isolation. Two areas call for written rules: how long information is kept and how you respond to client requests, plus how you choose and bind suppliers.

1. 1

   Set retention periods

   Decide in writing how long you keep each type of data, distinguishing tax obligations from clinical data, and delete or anonymise what is no longer needed.

2. 2

   Prepare a procedure for rights

   A client can ask for access, a copy, rectification or erasure of their data. Set up an orderly way to respond within the required timeframes and to verify the identity of the requester.

3. 3

   Govern relations with suppliers

   With the management system, the laboratory, the cloud and external services, sign an agreement binding them as processors and check where the data is stored.

4. 4

   Train the staff

   Periodic training on what to say and not say, how to handle documents and how to spot a suspicious email is worth more than any signed and filed document.

5. 5

   Keep a record of processing

   Map which data you handle, for which purposes, with which tools and for how long. It is the basis for showing you have thought about data protection.

Data portability deserves a practical mention: when a client changes vet, they have the right to obtain their history in a usable format. Preparing in advance to export the record cleanly is both a service to the client and a compliance duty.

A data breach is not only the cyber attack: it is also the lost laptop, the email sent to the wrong recipient, the cabinet left open. The difference between a well managed incident and reputational harm lies in preparation, not in luck.

1. Recognise the event and contain it, blocking access or recovering what has leaked.
2. Assess what was involved, how many people and with what risk to their rights.
3. Document what happened in writing, with times, causes and measures taken.
4. Notify the competent authority when the risk requires it, within the set deadlines.
5. Inform the individuals if the risk to them is high, clearly and without minimising.
6. Fix the cause, so the same mistake is not repeated.

Having a working, tested backup is part of data protection, not just of business continuity: ransomware that encrypts the management system is to all intents a problem of data availability. Knowing in advance who to call and what to do turns a moment of panic into an orderly procedure.