# Checklist: data protection in medical clinics Source: https://conformitate.md/en/resources/checklist-medical-clinics Updated: 2026-10-16 Free checklist Patients’ data concerning health belong to the special categories of data, which may be processed only in the cases set out in art. 9. The checklist helps you check whether your clinic informs patients, keeps a record of processing activities, limits access to patient files and knows what to do after a personal data breach. 12 check questions, each with its article of the law Tick what you already have. You see at once what is missing against the basic requirements of Law 195/2024 and which package closes the gaps. 1. Do you process patients’ data concerning health only in one of the cases the law allows, for example to provide medical care by, or under the responsibility of, a professional subject to professional secrecy? [art. 9](https://conformitate.md/en/law-195-2024/article-9 "Processing of special categories of personal data") 2. Do you have a legal basis for each purpose for which you process patients’ data, including appointments, invoicing and reminders? [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") 3. When their data is collected, do patients receive the information the law requires: who processes their data, for what purposes and on what legal basis, to whom you disclose it, how long you keep it and what rights they have? [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") 4. Do you keep a written record of processing activities? The exemption for organisations with fewer than 250 employees does not apply where the processing includes data concerning health. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") 5. Can each member of staff access only the patient data they need for their role, so that patient files are not accessible by default to all staff? [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 25](https://conformitate.md/en/law-195-2024/article-25 "Data protection by design and by default") 6. Do your staff process patients’ data only on the clinic’s instructions? [art. 29](https://conformitate.md/en/law-195-2024/article-29 "Carrying out processing activities under the authority of the controller or the processor") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 7. Do you send test results and other data concerning health only through channels whose security measures are appropriate to the risk for patients? [art. 9](https://conformitate.md/en/law-195-2024/article-9 "Processing of special categories of personal data") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 8. Do you keep patients’ data only for as long as the purpose for which it was collected requires, or as long as health legislation requires? [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") 9. Do you have a written contract with every provider that processes data on the clinic’s behalf, such as the provider of your patient management software? [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") 10. Do you document every personal data breach, and do you know when the National Centre for Personal Data Protection must be notified and when patients must be informed? [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") [art. 34](https://conformitate.md/en/law-195-2024/article-34 "Communication of a personal data breach to the data subject") 11. Have you checked whether you must carry out a data protection impact assessment, where the law requires one, for example before processing data concerning health on a large scale? [art. 35](https://conformitate.md/en/law-195-2024/article-35 "Data protection impact assessment") 12. Have you checked whether you must designate a data protection officer? Designation is mandatory where the clinic is a public institution or where its core activities consist of processing data concerning health on a large scale. [art. 37](https://conformitate.md/en/law-195-2024/article-37 "Designation of the data protection officer") Industry [Medical & dental clinics](https://conformitate.md/en/industries/medical-clinics) --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing