Connect
PetConnect
Cortex
Veterinary data protection starts by identifying the personal information a practice handles and the rules that apply to it. Owner contact details, staff records and account information need to be considered alongside clinical records. Buying software does not, by itself, establish legal compliance.
This guide focuses on practical preparation where EU GDPR applies. Applicability, local record-retention duties and cross-border arrangements need case-specific advice from a qualified professional; other jurisdictions have different requirements.
Map the information and the purpose#
Create a simple inventory of what you collect, why you need it, where it goes and who can access it. Include booking forms, invoices, staff files, messaging tools, backups and exports. Record the responsible person for each workflow and avoid collecting fields merely because a form allows them.
The European Data Protection Board’s small-business guide is an official starting point for understanding obligations and individual rights. Use it to structure a review with your privacy adviser rather than treating a generic checklist as a legal sign-off.
Clarify clinic and provider responsibilities#
For each service, establish the controller and processor roles, applicable processing terms and any subprocessors. Ask about retention, deletion, export and international transfers. Responsibilities depend on what the parties actually do; a product label is not enough.
Workflow | Question for the clinic and adviser |
|---|---|
Appointment collection | What purpose and lawful basis apply? |
Reminder or marketing message | Are these purposes separated appropriately? |
Staff access | Is access limited to the role and reviewed when it changes? |
Records request | Who verifies the requester and handles the response? |
Contract termination | What must be retained, returned or deleted, and by whom? |
Do not promise automatic deletion of every record on request. Applicable legal grounds, exceptions and retention obligations require assessment.
Prepare for a personal data breach#
A breach can involve unauthorized access, accidental disclosure, loss or unavailability of personal data. Where notification is required under GDPR, a controller must notify the authority without undue delay and, where feasible, within 72 hours of awareness. The exception concerns breaches unlikely to result in a risk to individuals’ rights and freedoms. A processor must notify its controller without undue delay; communication to affected people follows a separate high-risk assessment. See the EDPB breach guidance.
Prepare an incident contact list and a place to record discovery time, affected systems, actions and the assessment. Escalate promptly to the responsible privacy and security specialists; do not wait for a complete investigation before seeking advice.
Turn the review into an operational routine#
Keep open questions, evidence received, owners and review dates in one register. Revisit it when adding a communication tool, changing a provider or introducing an AI feature. Train staff on where to report mistakes without hiding them.
For technical procurement questions, use our cloud security checklist. To discuss Vetigen’s current contractual and technical arrangements, contact the team.
