Personal data protection in healthcare institutions: when a data protection officer is mandatory

A healthcare institution processes health data every day. The General Data Protection Regulation (GDPR) puts this data in a special category whose processing is prohibited in principle (Article 9(1) GDPR). That is why personal data protection in healthcare institutions has a stricter frame than elsewhere. A hospital must have a data protection officer: processing patient data is its core activity and is carried out on a large scale (Article 37(1)(c) GDPR). A state or municipal healthcare institution may also have the duty on another ground, if it meets the definition of a public authority or body (Article 37(1)(a) GDPR). Processing of patient data by an individual physician, according to a GDPR recital, should not be considered large-scale processing (Recital 91 GDPR).

Between these two examples lies a wide grey zone: private clinics, dental practices, laboratories, rehabilitation centres. Here we explain what the law says, how to check whether a data protection officer is mandatory for a healthcare institution, and what is at risk if the answer is wrong.

Personal data protection in healthcare institutions: why the rules are stricter

Data concerning health is personal data related to the physical or mental health of a person, including the provision of health care services (Article 4(15) GDPR).

Processing such data is prohibited unless an exception applies (Article 9(1) GDPR). For a healthcare institution the main exception applies where processing is necessary for medical diagnosis, treatment or the provision of health care and is based on law or on a contract with a health professional (Article 9(2)(h) GDPR). The exception has a condition: the data is processed by a professional subject to an obligation of professional secrecy, or under that professional’s responsibility (Article 9(3) GDPR).

Lithuanian law adds its own rules. The Law on the Rights of Patients and Compensation for Damage to Health (PTŽSAĮ) allows information about the facts of a patient’s life to be collected only where this is necessary to diagnose, treat or nurse the patient (Article 8(1) PTŽSAĮ). All information about the patient’s stay at the institution, state of health, diagnosis, treatment and prognosis, and all other personal information about the patient, is confidential, also after the patient’s death (Article 8(3) PTŽSAĮ). It may be given to others only with the patient’s written consent stating the basis for disclosure and the purposes of use, except in the cases listed in the law (Article 8(4) PTŽSAĮ). Persons whom the law entitles to receive such information get it only on a written request stating the legal basis, the purposes and the scope (Article 9(1) PTŽSAĮ).

The Law on the Health System (SSĮ) requires the protection of health information on computers to guarantee its confidentiality (Article 52(2) SSĮ). Health professionals may not, except in cases provided by law, breach the confidentiality of health secrets learned in the course of their professional duties (Article 52(3) SSĮ). How an employer, rather than a healthcare institution, handles health data is covered in our article Health data at work: what an employer may know.

State and municipal healthcare institutions: are they public bodies?

The GDPR requires a data protection officer where processing is carried out by a public authority or body (Article 37(1)(a) GDPR). The GDPR itself does not define this term. The Article 29 Working Party Guidelines on Data Protection Officers (WP243), endorsed by the European Data Protection Board, state that it is to be determined under national law (WP243, section 2.1.1).

In Lithuania it is defined by the Law on Legal Protection of Personal Data (ADTAĮ). Public authorities and bodies are state and municipal institutions and bodies, enterprises and public institutions that meet two conditions (Article 2(2) ADTAĮ):

• they are financed from state or municipal budgets and state monetary funds;
• they are authorised under the Law on Public Administration to perform public administration, or provide public or administrative services to persons, or carry out other public functions.

The Law on Health Care Institutions (SPĮĮ) assigns state and municipal personal health care public institutions and budgetary institutions to the Lithuanian National Health System (Article 3(1)(1) SPĮĮ). Such a public institution is established from state or municipal property and funds (Article 26(1) SPĮĮ). A municipal polyclinic or a state hospital therefore falls within the group of entities listed in the ADTAĮ. Whether it also meets both conditions must be checked against the specific institution’s articles of association and sources of funding. Money from the Compulsory Health Insurance Fund also meets the funding condition: the SPĮĮ names that fund among the state monetary funds when it refers to institutions maintained “from the budget of the Compulsory Health Insurance Fund and other state monetary funds” (Article 20(2) SPĮĮ). The law does not name healthcare institutions separately, so the conclusion should be written down.

For a hospital this answer does not change the duty: it must appoint a data protection officer under point (c) in any case (WP243, section 2.1.2). But it does decide the fine limits, because Article 33 ADTAĮ sets lower limits for public bodies than the GDPR. In its decision No 3R-252 of 13 February 2026, the State Data Protection Inspectorate calculated the fine for a district hospital that is a public institution (viešoji įstaiga) under the cap that Article 33(2) ADTAĮ sets for public bodies, although in its reasoning the decision describes the hospital as a budgetary institution. Several public bodies may share one data protection officer, taking account of their organisational structure and size (Article 37(3) GDPR).

A private clinic that has a contract with the National Health Insurance Fund belongs to the National Health System only for the term of that contract and only for those services (Article 3(1)(4) SPĮĮ). The ADTAĮ list begins with the words “state and municipal”, so in our assessment a private company does not become a public body merely because of such a contract. The law does not settle this point directly. If the clinic is a public institution (viešoji įstaiga) with private founders, the conclusion should be assessed separately and written down. WP243 recommends, as good practice, that private organisations carrying out public tasks designate a data protection officer, even though there is no obligation to do so (WP243, section 2.1.1).

A data protection officer for a healthcare institution: private clinics

For a private institution, a data protection officer is mandatory where its core activities consist of processing special categories of data on a large scale (Article 37(1)(c) GDPR). The same duty applies to a processor that handles patient data on behalf of another institution, if large-scale processing of such data is its own core activity (Article 37(1)(c) GDPR). Both conditions must be met.

Core activity. WP243 explains that a hospital’s core activity is providing health care, but it could not do so safely and effectively without processing health data. Processing that data is therefore one of a hospital’s core activities (WP243, section 2.1.2). In our assessment, the same logic applies to any institution whose activity is treatment or testing. The question is decided by the second condition.

Large scale. The GDPR does not define it. WP243 does not give a number that would fit all situations either (WP243, section 2.1.3). Four factors are assessed: the number of data subjects (as a specific number or as a proportion of the population), the volume and range of data, the duration of the processing and its geographical extent. The guidelines list processing of patient data by a hospital in the regular course of business as an example of large-scale processing, and processing of patient data by an individual physician as an example that is not (WP243, section 2.1.3; Recital 91 GDPR). The guidelines stress that between the extremes, an individual physician and processing at the level of a whole country or across Europe, there is a large grey zone. The guidelines also warn that Recital 91 was written for impact assessments, so it does not apply to the data protection officer question in exactly the same way.

In our assessment, applying these factors, a single family doctor or dentist in their own practice is closer to the Recital 91 example. A chain of clinics in several cities, a multi-specialty centre or a laboratory serving many patients is closer to the hospital example. The law does not say where exactly your institution stands; a reasoned assessment does. WP243 recommends documenting that assessment so that, if needed, you can show the relevant factors were taken into account (WP243, section 2.1). When a data protection officer is mandatory in other sectors is covered in our article Do we need a data protection officer?.

What to do once a data protection officer is appointed

The data protection officer is designated on the basis of professional qualities, in particular expert knowledge of data protection law and practice (Article 37(5) GDPR). The officer may be a staff member or work under a service contract (Article 37(6) GDPR). The institution must publish the officer’s contact details and communicate them to the State Data Protection Inspectorate (Article 37(7) GDPR).

The data protection officer does not take over responsibility for the data. WP243 states plainly that compliance is the responsibility of the controller, not of the officer personally (WP243, section 4.1). Large-scale processing of patient data also requires a data protection impact assessment (Article 35(3)(b) GDPR), and the officer’s advice must be sought when carrying it out (Article 35(2) GDPR). What such an assessment involves is covered in our article DPIA: what it involves and how long it takes.

What can go wrong

A mandatory officer not appointed. A breach of Article 37 GDPR falls into the fine tier of Article 83(4)(a) GDPR. For a private clinic this means a fine of up to ten million euros or up to 2 % of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 83(4) GDPR). For a public body, Article 33(1) ADTAĮ sets a lower limit for such breaches: up to half a per cent of the body’s current-year budget and other income received in the previous year, but no more than thirty thousand euros. However, a public body that carries out economic commercial activity is subject to the general GDPR amounts (Article 33(3) ADTAĮ). The ADTAĮ does not define whether paid services to patients count as economic commercial activity, so in our assessment a healthcare institution should assess this in advance. More on this in our article GDPR fines for state and municipal institutions.

Leaked patient data. A diagnosis disclosed unlawfully breaches not only the GDPR but also the confidentiality requirements of the PTŽSAĮ (Article 8(3) and (4) PTŽSAĮ). Liability for the unlawful collection and use of confidential patient information arises under the law (Article 9(2) PTŽSAĮ). A patient who has suffered material or non-material damage has the right to receive compensation (Article 82(1) GDPR).

An officer on paper only. A person without expert knowledge of data protection law and practice does not meet the requirement of Article 37(5) GDPR. WP243 states that a person who does not meet the GDPR criteria, for example as to resources or guarantees of independence, cannot be considered a data protection officer (WP243, section 2.1, footnote 11). In our assessment, the institution then has an officer only on paper, and the duty under Article 37(1) GDPR remains unmet.

When to call a lawyer

• when you do not know whether your institution is a public body under the ADTAĮ;
• when a private clinic expands: opens a new branch, a laboratory or remote consultations;
• when you introduce a new patient registration or medical records system;
• when an authority, an insurer or an employer asks for information about a patient;
• when patient data has reached the wrong people;
• when you receive an inquiry from the State Data Protection Inspectorate about the data protection officer.