What must I do for GDPR with records and owners' data?
The animal's data is not personal data. The owner's data is. The name, phone, address and e-mail tied to a record fall under Regulation (EU) 2016/679. The practice is the controller and is responsible for them.
Short answer
- Treat the owner's name, phone, address and e-mail as personal data.
- Inform the owner about the processing (Art. 13 GDPR) with a short notice at reception or on the website.
- Collect only what you need and limit access by role (Art. 5 and 32 GDPR).
- Sign a data processing agreement with your software provider (Art. 28 GDPR).
- A security breach is notified to the data protection authority, ANSPDCP, within 72 hours where there is a risk (Art. 33 GDPR).
What GDPR says (briefly)
- Art. 5: you collect little data, for one purpose, and keep it as long as necessary.
- Art. 13 and 15: the owner has the right to be informed and to ask for a copy of their data.
- Art. 28: the software provider is a processor and works under a written agreement.
- Art. 32 and 33: appropriate security measures and breach notification.
- Retention periods for veterinary medical records come from professional rules, not from GDPR. Check them with the College of Veterinarians.
Practical examples
- An owner asks what data you hold about them. You gather the contact details and list of their animals from the record.
- A new assistant gets access. You give only the role she needs and note the date.
- A reception laptop is lost. If the data was not encrypted, you assess the risk and decide whether to notify ANSPDCP.
Common mistakes
- The paper register sits on the counter, visible to clients.
- The whole team uses the same account and password.
- There is no agreement with the software provider.
How 4softvet helps
- Owners' data sits in one place, tied to the animal record, not in scattered notebooks and files.
- You can quickly find all of an owner's data when they ask for it.
- GDPR remains the practice's duty: software does not replace the privacy notice, the processing agreement or the risk assessment.