GDPR and NEN 7510: how they fit together in healthcare
Health data is the most sensitive personal data there is. The Algemene verordening gegevensbescherming (AVG, General Data Protection Regulation, GDPR) classifies it as special category personal data and sets strict requirements for processing it. NEN 7510 fills in those requirements for the Dutch healthcare sector. The two are not alternatives. They are complementary frameworks. Together, they describe what appropriate security for patient data means.
GDPR article 9: special category personal data
Article 9 of the GDPR prohibits the processing of special categories of personal data. Health data falls into that category. Processing is only allowed if a specific exception applies.
For healthcare organisations, the healthcare exception usually applies. Processing is allowed when it is necessary for medical diagnoses, the provision of healthcare or the management of healthcare systems (article 9(2)(h)). That exception is a necessary condition, but not a sufficient one. You must also meet the principle of article 32 GDPR: appropriate technical and organisational security.
The Autoriteit Persoonsgegevens (AP, Dutch Data Protection Authority) supervises compliance with the GDPR in the Netherlands. After a data breach involving health data, it can investigate and impose fines. NEN 7510 certification is provable evidence of appropriate security.
What does NEN 7510 add to the GDPR?
The GDPR requires “appropriate security”, but it does not explain exactly what that means for healthcare organisations. NEN 7510 fills in that open standard.
This works as follows. The Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg (Wabvpz, Supplementary Provisions for Processing Personal Data in Healthcare Act) refers to NEN 7510 through the Besluit elektronische gegevensverwerking door zorgaanbieders (Decree on Electronic Data Processing by Healthcare Providers). The standard is therefore the concrete interpretation of “appropriate measures” in the healthcare sector.
If something goes wrong, for example a data breach or a ransomware attack, supervisors look at NEN 7510. Did you comply with it? Can you prove it? Certification is then the strongest evidence.
| Aspect | GDPR | NEN 7510 |
|---|---|---|
| What it is | European regulation, directly applicable | Dutch standard, not automatically mandatory but strongly recommended |
| What it requires | Appropriate technical and organisational measures | Elaboration of those measures for the healthcare sector |
| Supervisor | Autoriteit Persoonsgegevens (AP) | IGJ and AP together |
| Sanctions for non-compliance | Fines of up to 4% of global annual turnover | Loss of certificate, supervision, damage from incidents |
| Duty to report data breaches | Yes, within 72 hours to the AP | Supports compliance through the incident management process |
The reporting duty: GDPR and NEN 7510 in practice
When there is a data breach involving patient data, the link between the GDPR and NEN 7510 becomes concrete.
The GDPR requires you to report a data breach to the Autoriteit Persoonsgegevens within 72 hours, if the risk to data subjects is not negligible. For breaches involving health data, that risk is almost always present. You must also inform the data subjects (patients) if the breach poses a high risk to their rights and freedoms. For how the deadline runs and how to report, see reporting a data breach to the AP.
NEN 7510 supports this through the incident management process. You have an incident register, a procedure for handling security incidents, and clear roles for who does what during an incident. This makes it possible to act quickly, assess whether a breach must be reported, and report it on time.
An organisation without a good incident management process often misses the 72-hour deadline for the GDPR report. Not because it does not want to report, but because it cannot find out quickly enough what exactly happened and how many people were affected.
Patient rights: GDPR and NEN 7513
Patients have rights under the GDPR: the right of access, the right to rectification, and the right to erasure (limited in healthcare). But they also have the right to know who has viewed their record. That last right is set out in the Wabvpz and is technically implemented through NEN 7513.
If a patient asks who has looked at their file, you must be able to tell them. That requires logging that meets NEN 7513: automatic, complete, with a personal record of every access. This is not only a NEN 7513 requirement. It is also how you give effect to the right of access under the GDPR in healthcare.
Processor agreements: GDPR article 28 and NEN 7510
The GDPR requires you to have a written agreement (verwerkersovereenkomst, processor agreement) with every party that processes personal data on your behalf. These are your processors: the EPD supplier, the hosting provider and the IT administrator.
NEN 7510 sets additional requirements for the content of those agreements. They must also cover information security obligations. What measures does the processor take? How does it handle incidents? Does it hold its own NEN 7510 or ISO 27001 certificate?
In practice, it is best to use one combined agreement that covers both the GDPR processor terms and the NEN 7510 security requirements.
Data protection officer (FG, functionaris gegevensbescherming)
Many healthcare organisations are required to appoint a data protection officer (FG, functionaris gegevensbescherming). These are organisations that process special category personal data on a large scale, which applies to almost all healthcare providers.
The FG monitors compliance with the GDPR within your organisation. In the NEN 7510 context, the FG works closely with the information security officer (CISO or equivalent). In small organisations, this is sometimes the same person, or an external adviser who fills both roles.
What NEN 7510 is not: a privacy standard
A common misconception is that NEN 7510 covers everything about privacy. It does not. NEN 7510 is about information security: the availability, integrity and confidentiality of health information. Privacy is broader than security.
The GDPR also covers the lawfulness of processing, data minimisation, retention periods and the rights of data subjects. Those topics fall outside NEN 7510. You therefore need both: NEN 7510 for security, and a good privacy policy and register for broader GDPR compliance.
Data exchange and the GDPR
Each time you exchange patient data with another healthcare organisation, you take on risks. The GDPR requires that such exchange is lawful and secure. NEN 7512 describes how that exchange is secured technically and organisationally. NEN 7512 is therefore also a tool for GDPR compliance in secure data transfer. For individual emails and chat messages containing patient data, NTA 7516 for secure email in healthcare applies.
Further reading
- NEN 7510 requirements: the security requirements of the standard in detail
- NEN 7513 logging: logging of access to patient records
- NIS2 and the Cyberbeveiligingswet (Dutch Cybersecurity Act): the new cybersecurity legislation for healthcare
- Autoriteit Persoonsgegevens : the privacy supervisor in the Netherlands
- Wabvpz on wetten.overheid.nl : the act that refers to NEN 7510