CHI DPC Decision: Paper Records and Practice Review Checks

Editorial correction, 3 October 2026: This article now distinguishes the orders made against CHI from the assessment each private practice needs to undertake. We removed claims that EU hosting or switching to digital records guarantees compliance.

What did the DPC announce?

On 1 October 2026, the Data Protection Commission published an announcement about its decision concerning children's paper health records at CHI's Tallaght facility. It found infringements of Articles 5(1)(f) and 32(1) GDPR involving records in an NCHD office and confidential waste. The DPC reprimanded CHI and ordered it to finalise two draft DPIAs, implement the resulting measures and provide the assessments to the regulator. These were orders directed at CHI in that inquiry. The announcement said the full decision would follow. Read the DPC's announcement.

A paper-record walkthrough for private rooms

For a practice manager, a useful response is to examine the actual document journey. A written policy cannot show whether a visiting clinician knows where to leave a chart, or whether a collection delay leaves disposal containers overfilled. The following are suggested questions for your own review, rather than additional orders from the DPC.

• Receipt: Where do deliveries and printed referrals wait? Can someone in the waiting area see names or documents?
• During a session: Who can enter the room when staff step away? Where are files kept between appointments?
• Movement: When a record changes rooms or sites, who records the handover and checks arrival?
• Storage: Who holds keys or access permissions? What happens when a staff member leaves?
• Disposal: Who checks container capacity and arranges an alternative if a collection is missed? What evidence confirms the agreed disposal process?

Use a review sheet with columns for the location, observed gap, responsible person, action and recheck date. Record what you saw rather than marking an entire area safe because a policy exists. For example, an unresolved handover gap needs an owner and follow-up, not just a new policy title.

Decide the DPIA scope from your processing

A DPIA is mandatory under Article 35 where processing is likely to result in high risk to people's rights and freedoms. The DPC provides criteria and a list of processing operations requiring one. Check these against the nature, scale, context and purpose of your practice's work; the CHI orders do not create a universal two-document template for every private clinic. Record the assessment and seek appropriate data-protection expertise where the answer is uncertain. See the DPC's DPIA guidance.

Evaluate digital systems with the same care

Reducing unnecessary printing may change the risks, but scanning documents does not resolve every issue. Before changing systems, ask who can access each record, what access history is available, how exports work and what happens to retained copies. Agree how the practice will validate a migration before relying on the new record.

Neither a hosting location nor a software purchase establishes that a practice complies with GDPR. Evaluate the supplier's documented controls alongside the practice's own procedures. For Ask Brigid, start with the published security and data-protection information and the switching checklist; confirm the scope that applies to your intended use.

Ask Brigid is onboarding a small number of founding consultant practices. Request early access and we will reply with current availability and the next step.