Privacy & GDPR

EU-hosted medical records and GDPR, explained for Irish patients

Health data is special category data under GDPR. Here is where it lives, who can see it, and the rights you can exercise at any time.

Written and clinically reviewed by Dr Waqar Syed, General Practitioner, Irish Medical Council reg. 4158826 min readUpdated 17 August 2026

Need to be seen today? Video or phone appointment with an Irish-registered GP, €39.

Book a GP

Medical information is 'special category' personal data under Article 9 of the GDPR. It attracts stricter protection than an email address or a delivery history, and processing it lawfully requires both a legal basis and an additional condition — for healthcare, that condition is the provision of medical care by professionals bound by confidentiality.

Why EU hosting matters

When records are stored inside the European Union, they stay under EU law and EU supervisory authorities — in Ireland's case the Data Protection Commission. There is no reliance on transfer mechanisms to third countries, no exposure to foreign access regimes, and a single, clear jurisdiction if you ever need to complain.

Consultation notes, prescriptions and documents are held on EU-based infrastructure.
Access is role-based: your treating clinician sees your record, administrators see only what their job requires.
Every access to a clinical record is written to an audit log.
Prescriptions travel to pharmacies over Healthmail, the HSE-approved secure channel, not ordinary email.

Your rights, and how to use them

Access

What it means in practice: Ask for a copy of everything held about you. It must be provided within one month.

Rectification

What it means in practice: Have factual errors corrected — a wrong date of birth, a mis-recorded allergy.

Erasure

What it means in practice: Ask for deletion. Clinical records have statutory retention periods, so this is not absolute; you will be told what must be kept and why.

Portability

What it means in practice: Receive your data in a machine-readable format to take elsewhere.

Objection & restriction

What it means in practice: Object to specific processing, such as marketing or review-request emails.

Complaint

What it means in practice: Raise a concern with the Data Protection Commission at any time.

Right	What it means in practice
Access	Ask for a copy of everything held about you. It must be provided within one month.
Rectification	Have factual errors corrected — a wrong date of birth, a mis-recorded allergy.
Erasure	Ask for deletion. Clinical records have statutory retention periods, so this is not absolute; you will be told what must be kept and why.
Portability	Receive your data in a machine-readable format to take elsewhere.
Objection & restriction	Object to specific processing, such as marketing or review-request emails.
Complaint	Raise a concern with the Data Protection Commission at any time.

Consent is not one big yes

Consent is recorded separately for different purposes: consent to treatment, consent to share a summary with your own GP, consent to record a consultation, and consent to receive optional emails. Each can be given or withdrawn independently, and withdrawing a non-clinical consent never affects your care.

Retention

Irish clinical records are retained for extended periods — for adults, typically eight years after the last contact, and for children until well into adulthood. That obligation is why an erasure request will usually restrict access rather than wipe a clinical note, and why you are told exactly what is retained.

You can request an export or an erasure decision from your patient portal, and you will receive a written response with a decision and reasons.

Frequently asked questions

Where are my records stored?

On EU-based infrastructure, under EU law and the supervision of the Irish Data Protection Commission.

Can I get a copy of my records?

Yes. Submit a subject access request from your portal or by email and you will receive a copy within one month.

Can I have my records deleted?

You can request it. Clinical records carry statutory retention periods, so some material must be retained; you will be told precisely what is kept and for how long.

How are prescriptions sent securely?

Through Healthmail, the HSE-approved secure email service linking prescribers and Irish community pharmacies.

Share this guide

Facebook X / Twitter LinkedIn Email

Talk to an Irish GP today

Same-day video or phone appointments, €39. Prescriptions sent securely to your pharmacy.

Book a GP — €39 How an online GP consultation works Data protection & EU hosting Privacy policy

This article is general health information for people in Ireland and is not a substitute for individual medical advice. If you have an urgent or severe symptom, contact your GP, an out-of-hours service, or call 112 or 999.