Data protection is usually explained in articles and acronyms. This page explains it in the only terms that count: what happens to a person when each duty is kept, or not. It is the same education built into ROPAi, where every line appears at the moment you make the decision it describes. Free to read, free to borrow for your team.
The first question is the only one that matters at the bedside: is this use of confidential patient information actually justified? Every register entry should be able to answer it.
Every extra field collected is extra exposure for the patient with zero extra care. Minimum necessary is not a limit on care. It is a limit on harm.
Confidentiality is the deal that makes patients tell clinicians the truth. Handling data lawfully is how the deal is kept.
When responsibility for patient data is everyone’s, it is no one’s. A named owner is the difference between a culture and a hope.
This choice creates a balancing duty: you will need to show the person’s interests were weighed and not overridden.
Consent must be as easy to withdraw as it was to give. Choosing it means building for the day someone says no.
Necessary means necessary: only the processing the agreement genuinely requires is covered.
This basis borrows its strength from a specific law. Record which one, because someone will ask.
This data can harm people just by being known. An extra condition is required on top of the lawful basis.
The safest record is the one you no longer hold. Short retention is protection, not loss.
The signed safeguard is the protection that travels with the data. Without it, the transfer stands unguarded.
Inside ROPAi, these lines appear where they belong: on your live evidence, at the moment of the decision, in the voice of the people your data is about. The register that watches itself, and teaches while it does.
Get early access