GDPR in a Belgian veterinary practice: what actually applies

Why a veterinary practice is in scope at all

GDPR protects personal data about identified or identifiable people. Animal health data is not personal data in itself — but it is attached to an owner's name, address, phone number, email, payment history and sometimes their financial difficulties, and all of that is.

So a veterinary practice is a data controller with a real, ordinary obligation. Not a hospital-grade one, but not nothing either.

What a practice is expected to have

• A register of processing activities — what you hold, why, and for how long
• A lawful basis for each use, including reminders and marketing, which are not the same thing
• Retention periods, and actual deletion when they expire
• A way to answer an access request without exporting the whole database
• A way to correct and, where applicable, erase
• A processor agreement with every supplier that touches client data, including your practice software
• Somewhere to record a breach, and the reflex to report it in time

The retention question vets ask most

Erasure is not absolute. Where you are legally required to keep records — medical records, medicine and antimicrobial registers, invoicing and accounting records under Belgian rules — the retention obligation takes precedence over a request to delete.

The practical consequence: you need to be able to remove marketing consent, contact details and commercial history for a departing client while retaining what the law requires you to keep. A system that can only delete a client wholesale cannot do that, and a system that can only refuse cannot either.

What to ask a software supplier

These are the questions that separate an answer from a brochure.

• Where is our data physically stored, and under whose jurisdiction?
• Is our practice's data isolated from other practices, or filtered by a query?
• Can we export everything you hold about one specific client, on demand?
• Is there an audit trail showing who looked at what, and can we read it ourselves?
• Can each staff member have their own account, or does the pricing push us to share logins?
• What happens to our data on the day we leave?

Common questions