What does the Client Data Act require from health and social care staff?

In brief

The Act on the Processing of Client Data in Healthcare and Social Welfare requires more than general awareness. Section 7 requires written instructions for handling client data and sufficient staff expertise and competence in that handling. In practice, staff must understand confidentiality, work-based access rights, reliable identification, the basics of personal data protection and the rights of the person whose data is handled. The General Data Protection Regulation adds the general data protection principles and security duties that health and social care work must also follow.

The Client Data Act makes competence a management and daily-work duty

Client data means information about a patient or social welfare client. In everyday work it can be a diagnosis, a medication note, a care plan, a social welfare assessment, a contact detail or an entry in a client record.

The Act on the Processing of Client Data in Healthcare and Social Welfare, section 7, puts the duty on the responsible director of the service provider and on the pharmacist. They must give written instructions on how client data is handled and on the procedures that must be followed. They must also ensure that staff have sufficient expertise and competence in handling client data.

This makes competence a management issue and a daily-work issue at the same time. Written instructions do not help if employees do not understand when they may open a record, what they may do with it and when they must ask for guidance. Training is therefore not only an induction topic. It is part of controlling how client and patient data is used in practice.

The Act also defines who the controller is in key situations. A controller is the party that decides why and how personal data is handled. For example, it decides what client data is collected and for what service purpose it is used. Under the Client Data Act, section 13, the controller in public health and social care is the service provider responsible for organising the service, unless another law provides otherwise. In private health and social care, the controller is the service provider with whom the client has made the service contract. In occupational healthcare, the controller is the service provider with whom the employer has made the occupational healthcare service contract, or the employer that organises occupational healthcare itself under the Occupational Health Care Act provision referred to in section 13.

For a decision-maker, this matters because competence must match the controller’s role. The organisation must be able to explain its own instructions, roles and access practices. It cannot rely only on the fact that an employee belongs to a regulated profession.

Confidentiality is the permanent starting point

The Client Data Act, section 4, states that social welfare and healthcare client data are permanently confidential. In practice, confidentiality is not a temporary project rule. It applies as the normal baseline for patient and client records.

The same section says that a document, copy or printout containing confidential client data must not be shown or disclosed to an outsider or made available for an outsider to view or use. In daily work, an outsider can be a person who is not participating in arranging or providing the relevant health service, social service or related task for that client.

This affects ordinary situations. An employee may not look at the record of a relative out of concern. A colleague may not browse information because the case is interesting. A paper printout may not be left where a person outside the service task can read it.

Section 4 also allows necessary processing inside healthcare and social welfare units despite confidentiality rules. In healthcare units, staff may handle patient data in the service provider’s register when it is necessary for carrying out the patient’s care. In social welfare units, staff may handle client data in the service provider’s register when it is necessary for carrying out social welfare.

The key word is necessary. Competence must therefore include judgement. Staff need to recognise the difference between information that is useful, information that is interesting and information that is necessary for the task.

Access rights are based on work duties and necessary need

Access right means permission to use data in a system. A simple example is a nurse who can view medication information needed for today’s care, but not unrelated records that have no link to the task.

The Client Data Act, section 9, requires the right to use client data to be based on the work duty of the health or social care professional, or another person handling client data, and on the service being provided. The person may use only the necessary client data needed in their work duties.

The same section requires a technically verified care or client relationship, or another task linked to arranging and providing the client’s social and health service, as the basis for processing. This means that access is not only a question of trust. The system and the organisation’s procedures must support the link between the person, the task and the client.

Section 9 also requires the service provider and the pharmacy to define what necessary client data different professionals and other persons handling client data may use. They must keep a register of users of their information systems and client registers, and of those users’ rights to access client data.

The Client Data Act, section 8, adds that the client, the service provider, the pharmacy, other parties to client data processing and their representatives, as well as information technology devices and national information system services, must be identified reliably. For staff competence, this means that identification is not just an information technology detail. Employees must understand why shared accounts, weak identification practices or unclear user roles can undermine lawful access control.

Competence must also cover the basics of personal data

Health and social care competence cannot be limited to the sector-specific Act. The General Data Protection Regulation also applies to personal data.

Personal data means information relating to an identified or identifiable natural person under the General Data Protection Regulation, Article 4. A name is personal data. So is a personal identity code, location data, an online identifier or a combination of details that makes a person identifiable. In health and social care, many ordinary work notes identify a person directly or indirectly.

Processing means almost any action done to personal data under Article 4. It includes collecting, recording, storing, viewing, using, disclosing, restricting, deleting and destroying data. Opening a record is processing. Correcting an address is processing. Sending a document to another service provider is processing.

Article 9 of the General Data Protection Regulation gives special protection to sensitive types of data. Health data is included in these special categories. Article 9 contains a general prohibition and then lists situations where that prohibition does not apply. For health and social care, the relevant legal idea is that processing may be possible when it is needed for preventive or occupational medicine, medical diagnosis, care or treatment, social or healthcare services, or management of those services, on the basis of Union or Member State law or a contract with a health professional, and with the required conditions and safeguards.

The General Data Protection Regulation, Article 5, sets the general principles. Staff should understand these as practical rules:

• lawfulness, fairness and transparency: data is handled on a valid basis and in an understandable way;
• purpose limitation: data collected for care or a social service is not freely available for another purpose;
• data minimisation: only necessary data is used;
• accuracy: incorrect data must be corrected when needed;
• storage limitation: identifiable data is not kept longer than necessary for the purpose;
• integrity and confidentiality: data is protected against unauthorised or unlawful processing and accidental loss or damage.

Article 5 also says that the controller is responsible for compliance with the principles and must be able to demonstrate that compliance. For decision-makers, this is why evidence of competence matters. It supports accountability, not only awareness.

A wider overview of general staff skills is covered in What data protection skills does every employee need?.

What health and social care staff must know in practice

The legal requirements become operational only when they are translated into work situations. For a health and social care organisation, staff competence should cover at least these work abilities:

Work situation	What the employee must understand
Opening a client or patient record	Access must be linked to the work duty, the service and necessary need under the Client Data Act, section 9.
Discussing a case with a colleague	Confidentiality remains the starting point under section 4, and the colleague must have a role in the service or related task.
Printing or copying a record	A document, copy or printout containing confidential client data must not be shown or made available to outsiders under section 4.
Using a system account	Reliable identification is part of lawful processing under section 8, and the organisation must know users and access rights under section 9.
Recording or correcting data	The General Data Protection Regulation principles on accuracy, purpose limitation and minimisation apply under Article 5.
Handling health data	Health data is a special category of personal data under Articles 4 and 9 of the General Data Protection Regulation.
Receiving a data subject request	The controller must support the person’s rights under Articles 12 to 20 of the General Data Protection Regulation.
Protecting systems and records	Security must match the risks of the processing under Article 32 of the General Data Protection Regulation.

Article 32 of the General Data Protection Regulation also matters for staff. It requires the controller and processor to ensure a level of security appropriate to the risk by technical and organisational measures. It also requires measures to ensure that a person acting under the authority of the controller or processor, and having access to personal data, processes that data only on instructions from the controller unless Union or Member State law requires otherwise.

In daily work, this links training, access rights and system security. A system may have logs and access controls, but the employee still needs to know the rule behind the control. A log is not a licence to browse. It is part of the organisation’s ability to protect data and show what happened.

Data subject rights are also part of health and social care competence

A data subject means the natural person whose personal data is handled. In health and social care, this is often the patient, the social welfare client or another identifiable person in the record.

The General Data Protection Regulation, Article 12, requires the controller to provide information in a concise, transparent, intelligible and easily accessible form, using clear and plain language. It also requires the controller to facilitate the exercise of rights under Articles 15 to 22. When a request is made, Article 12 requires information on action taken without undue delay and in any event within one month of receiving the request. That period may be extended by up to two further months when needed because of the complexity and number of requests, and the controller must inform the person of the extension within one month of receiving the request.

Articles 13 and 14 require information to be given when personal data is collected from the person or from elsewhere. Articles 15 to 20 cover rights such as access, rectification, erasure, restriction, notification of rectification or erasure or restriction, and data portability.

Staff do not all need to decide legal edge cases. They do need to recognise a request. A patient asking for a copy of their data may be exercising the right of access under Article 15. A client pointing out an incorrect address or wrong entry may be asking for rectification under Article 16. A person asking for deletion may be invoking Article 17, but health and social care records may also involve legal duties and public-interest tasks that affect the outcome.

Competence therefore means knowing when to handle a routine correction and when to route the matter to the controller’s process.

The duty does not mean an unlimited training format or one ready-made model

The Client Data Act, section 7, requires written instructions and sufficient expertise and competence. It does not prescribe a single training format, a fixed course length or one national template.

The duty also does not mean that every employee gets the same access. Section 9 points the other way. Access must follow the work duty, the service and necessary need.

The duty does not remove the need for local judgement. Public service providers, private providers, pharmacies and occupational healthcare settings may have different controller roles under section 13. Their instructions and training evidence should match those roles.

The General Data Protection Regulation also leaves practical implementation to the controller in many respects. Article 32 requires security that is appropriate to the risk. That requires assessment. A small task with limited access and a broad role with access to many records do not carry the same risk.

This is the honest limit. The law sets the obligation to instruct, ensure competence, control access, protect confidentiality and support rights. It does not turn any single certificate into full compliance by itself.

For decision-makers, the issue is evidence, not only training

The core question is not whether staff once heard about confidentiality. The question is whether the organisation can show that staff have been given clear instructions and have sufficient competence for the client and patient data they handle.

That evidence should connect to the legal duties:

• the Client Data Act, section 7, for written instructions and sufficient competence;
• section 4 for permanent confidentiality;
• section 8 for reliable identification;
• section 9 for work-based and necessary access rights;
• section 13 for controller roles;
• the General Data Protection Regulation, Article 5, for principles and accountability;
• Articles 12 to 20 for data subject rights;
• Article 32 for processing security.

For a municipality, wellbeing services county, private provider, pharmacy or occupational healthcare provider, this turns data protection competence into a governance control. It supports onboarding, access management, internal guidance and customer trust. It also gives management a clearer way to ask whether the organisation’s daily handling of client and patient data matches the duties that apply to it.

Short, repeated learning can help keep these rules close to everyday work. The practical learning model is discussed further in Microlearning at work: why short and repeated beats the training day.