Medico-social · GDPR

Medical-social — GDPR: protecting highly sensitive data

The social and medical care sector processes some of the most sensitive health and social data, often concerning vulnerable individuals. GDPR imposes the highest level of requirements here: an exemption for health data, governance of data sharing, enhanced security. This guide details these obligations and a tailored roadmap.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • Medical and social care establishments and services are data controllers.
  • Identify an exemption.
  • Governing data sharing.
  • Secure and host.
  • Fines of up to €20M or 4% (specific public sector caps may apply).

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

Health data falls under Article 9 (processing prohibited except by exception); social data (child welfare, disability, addiction) is equally highly sensitive. Sharing between professionals, essential to care coordination, requires a strict framework (professional secrecy, need-to-know basis).

Health data hosting is subject to enhanced requirements.

Is the 'Medico-social' sector concerned?

Medico-social establishments and services are data controllers. The vulnerability of the populations served systematically raises the level of requirement.

Service providers (business software, hosting) are processors and must offer appropriate guarantees.

Detailed obligations

Identify an exception

Base the processing of health data on a specific exception under Article 9.

Frame data sharing

Formalise professional secrecy, need-to-know principles and access traceability.

Secure and host

Enhanced security and adapted health data hosting.

Protect vulnerable individuals

Adapting information and safeguards for minors and protected adults.

Master retention periods and DPIAs

Define appropriate retention periods and carry out the required DPIAs.

Sanctions & risks

Fines of up to €20M or 4% (specific public-sector caps may apply). A leak of data relating to vulnerable individuals is a major human and legal incident.

Common mistakes in the sector

  • 1Untracked sharing. Sharing without traceability or need-to-know.
  • 2Unsuitable hosting. Hosting health data without safeguards.
  • 3DPIA omitted. Ignoring the impact assessment.
  • 4Inadequate information. Failing to adapt information to vulnerable audiences.

Practical case

A social care service was sharing case files between professionals without traceability or access restrictions. The remediation establishes a need-to-know principle, access traceability, appropriate hosting and tailored information for the individuals supported and their representatives.

Compliance roadmap

  1. 1

    Map. Inventory processing activities and sharing.

  2. 2

    Secure. Health, accommodation, and security exception.

  3. 3

    Frame data sharing. Confidentiality and traceability.

  4. 4

    DPIA. Carry out the necessary assessments.

  5. 5

    Protect vulnerable individuals. Adapt the safeguards.

Frequently asked questions

An exemption under Article 9, often medico-social care, duly documented.

Back to the Medico-social guideMedico-social & AI Act

Take action on GDPR

Free assessment or a chat with an expert dedicated to medico-social.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the medico-social sector secured their compliance with DCO.

See testimonials