Medical data privacy in Spain: what the law says

What the law says

How Spain treats your health data.

The law: GDPR, with Organic Law 3/2018 (LOPDGDD)[S76][S112]
The regulator: Spanish Data Protection Agency (AEPD)[S112]
Health data: Health data is a special category under Article 9 of the GDPR. It may be processed only on a listed ground, such as your explicit consent or care by health professionals bound by secrecy.[S76]
Sending it abroad: Data moves freely within the European Economic Area. Leaving it needs an adequacy decision for the destination or other safeguards (GDPR Chapter V).[S76]
Medical records: Clinics must keep clinical records for at least five years from discharge for each episode of care (Article 17 of Law 41/2002).[S113]
EU adequacy: Not needed: as an EU member, the GDPR applies directly.[S76]
If there is a breach: Within 72 hours to the national authority where feasible, and to the people affected without undue delay when the risk to them is high (Articles 33 and 34).[S76]
Fines: Up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Article 83).[S76]

Sending your records

The law protects the clinic’s copy. How it gets there is up to you.

Email and messaging apps leave a readable copy on every server they pass through, in Spain and at home. The safest file is the one that stays encrypted on your own phone, shown to the doctor in the room or sent by a link that expires by itself.

Try the free privacy check

Questions

Spain: common questions.

Is it safe to email medical records to a clinic in Spain?

Email is protected between mail servers only when both providers support TLS, and it stays readable on each server afterwards. Once your records reach a clinic in Spain, local law applies: health data is a special category under Article 9 of the GDPR. It may be processed only on a listed ground, such as your explicit consent or care by health professionals bound by secrecy. For a full history, use a channel where you hold the key, such as a link that expires by itself.

How does Spain protect health data?

Health data is a special category under Article 9 of the GDPR. It may be processed only on a listed ground, such as your explicit consent or care by health professionals bound by secrecy. Breaches must be reported within 72 hours to the national authority where feasible, and to the people affected without undue delay when the risk to them is high (Articles 33 and 34). The regulator is the Spanish Data Protection Agency (AEPD).

Can a clinic in Spain send my medical records abroad?

Data moves freely within the European Economic Area. Leaving it needs an adequacy decision for the destination or other safeguards (GDPR Chapter V). Clinics must keep clinical records for at least five years from discharge for each episode of care (Article 17 of Law 41/2002).

Keep reading

More on Spain, and elsewhere.

Sources are numbered in the text and listed in full in the reference list.

Medical data privacy in Spain.