Staff Data Processing Authorization
Authorization to process personal data at a physiotherapy practice: who needs one, a template, the register of authorized persons and the processing agreement.
Mr Krzysztof hired a new receptionist. On her first day he showed her the patient booking system, gave her the password and said "you enter the visits, you'll pick up the rest on the go". From the first hour she had access to patients' names, phone numbers and parts of their visit history, with no signed document. A month later a lawyer friend asked him about authorizations for staff, and Mr Krzysztof answered: "she isn't a physiotherapist, only the therapists see the data".
That assumption is wrong. Everyone who actually sees patient data has access to it, regardless of position. Below we explain who at a practice needs an authorization, what the rules say, how an authorization differs from a processing agreement, how to write one and how to keep the register of authorized persons.
Short answer
The GDPR says that a person acting under the authority of the controller who has access to personal data processes it only on the controller's instructions (Article 29), and the controller must take steps to ensure this (Article 32(4)). The GDPR does not prescribe the form of the authorization. A special rule applies to medical records: data from them may be processed by persons practising a medical profession and by other persons performing auxiliary activities in providing services, on the basis of an authorization from the data controller (Article 24(2) of the Polish Act on Patient Rights). Reception staff with access to medical records therefore need an authorization, and a written form and a register are the simplest way to be able to demonstrate it (Article 5(2) and Article 24(1) GDPR).
Who at a practice needs an authorization
The key question is whether the person has access to patients' personal data, not whether they are a physiotherapist.
- Physiotherapists are persons practising a medical profession, so Article 24(2)(1) of the Act on Patient Rights entitles them to process data from medical records. Even so, it is wise to issue authorizations to therapists too, to define the scope and the controller's instructions (Article 29 GDPR). Professional confidentiality binds them separately under the Act (Articles 13 and 14).
- Receptionist. She performs auxiliary activities in providing services and sees names, phone numbers, appointment times and often the type of complaint. When she has access to medical records, Article 24(2)(2) requires an authorization from the controller, and paragraph 3 obliges her to confidentiality even after the patient's death.
- A person maintaining the ICT system that holds the records (for example an IT technician employed by the practice) falls into the same category of Article 24(2)(2); if it is an outside company, see the processing agreement below.
- Trainee or student. If the practice takes part in training (for example hosts trainees), records are made available to them only as far as necessary for teaching purposes, and they must keep confidentiality even after the patient's death (Article 26(3a) and (3b)). Issue the authorization before the first day of the placement; see student placements at a physiotherapy practice.
- A cleaner as a rule does not need access to data. If cleaning happens in reception where printed records lie or an unlocked computer is running, fix the organization of work so that access does not in fact occur, or regulate access formally.
- Accounting. If the accounting office is a separate entity and processes personal data on the practice's behalf, you need a processing agreement, not an authorization. The extent of its access to patients' data must be assessed individually.
A broader GDPR implementation is in GDPR at a physiotherapy practice, the full set of documents in the practice's GDPR documentation, and employment matters in hiring a physiotherapist -- contract and qualifications.
Authorization versus processing agreement
Both documents concern processing data by persons other than the controller itself, but they apply to different relationships.
| Criterion | Authorization (Articles 29 and 32(4) GDPR) | Processing agreement (Article 28 GDPR) |
|---|---|---|
| Who it covers | Persons acting under the controller's authority who have access to data | A processor handling data on behalf of the controller |
| Example | Receptionist, physiotherapist, trainee | Accounting office handling patients' data, software supplier |
| Form | The GDPR sets no form; writing is the simplest way to demonstrate it | A contract or other legal instrument; in writing, including electronic form (Article 28(9)) |
| Content | Scope and the controller's instructions | The elements in Article 28(3) (among others processing on documented instructions, confidentiality, Article 32 measures, deletion or return of data after the service ends) |
| When | Before the person is given access to data | Before processing begins on the controller's behalf |
At practices, Article 24(5) and (6) of the Act on Patient Rights also matters: performing a processing agreement must not disrupt the provision of services, in particular access to records, and the entity entrusted with processing is bound by confidentiality even after the patient's death. Contracts with suppliers are covered in processing agreements -- who a physiotherapist must sign one with. Borderline situations, such as a physiotherapist working on a B2B basis, need individual assessment: whether the person acts within the practice's structure on the controller's instructions (authorization) or as a separate entity (processing agreement or their own role as a controller). We do not settle that in this article.
What to put in the authorization
The GDPR prescribes no template and no content. Below are elements worth including (good practice, not a legal requirement).
| Element | What to enter |
|---|---|
| Person authorized | Name, position or role |
| Scope of data | Categories of data (identification, contact, health data) and the systems or files they can access |
| Scope of operations | For example inspection, entry, editing, disclosure as part of patient service, and what is not allowed |
| Controller's instructions | The person processes data only on the controller's instructions (Article 29 GDPR) |
| Confidentiality | A commitment to keep the data confidential, also after cooperation ends (for auxiliary staff this follows from Article 24(3) of the Act on Patient Rights) |
| Period | Until the end of employment or cooperation; for a trainee until the end of the placement |
| Date and signatures | The controller or a person authorized to issue authorizations, and the person authorized |
Sample wording (adapt it to your practice)
Authorization to process personal data no. [number]. On the basis of Articles 29 and 32(4) GDPR and Article 24(2)(2) of the Act on Patient Rights and the Patient Rights Ombudsman I authorize [name], [position], to process patients' personal data in the scope of: [categories of data] and operations: [inspection, entry, editing]. You process data only on my instructions and only to serve the practice's patients. You undertake to keep the data confidential also after cooperation ends. The authorization applies from [date] to [date or end of employment]. [Date, controller's signature, signature of the authorized person].
Register of authorized persons
The GDPR does not expressly require a register of authorizations. But the controller is responsible for compliance and must be able to demonstrate it (Article 5(2)), and organizational measures are to enable that (Article 24(1)). A simple register is the cheapest way to achieve it.
| No. | Name | Position | Scope of data and systems | Date granted | Date withdrawn | Controller's signature |
|---|---|---|---|---|---|---|
| 1 | [..] | Reception | Appointment diary, contact details | [..] | [..] | [..] |
| 2 | [..] | Physiotherapist | Patient records, practice system | [..] | [..] | [..] |
| 3 | [..] | Trainee | Observation under supervision, no entries | [..] | end of placement | [..] |
Two rules make the register easy to maintain:
- New person, new authorization. You do not "transfer" a predecessor's authorization.
- Departure, withdrawal. When a person stops working at the practice, withdraw the authorization, block access (change the password, deactivate the account) and note the date in the register. A register not updated for two years is as problematic as none at all.
[SP] Example -- Solo practice: Ms Ewa runs a one-person practice and employs a receptionist part-time. Before the first day she prepares a short authorization with the scope of access (contact details and the appointment diary, no access to full medical records). Only after it is signed does she hand over the system login.
[GR] Example -- Group practice: At a practice with eight physiotherapists and two receptionists the owner notices that the authorization of a therapist who left six months ago was never withdrawn. She introduces a procedure: the authorization is issued before the first day of work, and on departure it is withdrawn the same day and noted in the register.
Link to the Act on Patient Rights
The duty to authorize does not follow from the GDPR alone. Article 24(2)(2) of the Act on Patient Rights requires an authorization from the controller for persons who are not practising a medical profession but have access to medical records for auxiliary activities or system maintenance. Records are secured when access is guaranteed only to authorized persons under Article 24(2) and Article 26 (§ 1(4) of the Minister of Health regulation on medical records). The practice's organizational rules or security policy should therefore describe who has access to records and to what extent. At small practices the two bases often fit in one document.
Onboarding a new employee: the order matters
The authorization should be signed before the person gets access to data: a system login, a key to the paper-records cabinet, the reception computer password. See also onboarding at a physiotherapy practice and GDPR training for practice staff.
- Before the first day, prepare an authorization suited to the role.
- On the first day, before handing over logins, sign the authorization together with a confidentiality statement.
- Enter the person in the register with the date granted.
- Only now hand over access to the system, paper records and rooms with data.
- When cooperation ends, withdraw the authorization, block access and note the date.
Frequently asked questions
Does a person who cleans the practice need an authorization to process data?
It depends on their actual access. If cleaning takes place outside reception hours and records are always secured (locked cabinet, locked computer), an authorization is usually not needed. If the person cleans during reception hours, where printed records lie, either issue an authorization or change how the work is organized.
Must a trainee have an authorization if they only observe a physiotherapist at work?
If they can see patient data, for example the record in which the therapist notes the visit, yes. Limit the scope to teaching purposes (Article 26(3a) of the Act on Patient Rights), limit the period to the length of the placement, and issue it before the first day.
How does an authorization differ from a confidentiality statement?
The authorization defines what the person may do with the data. A confidentiality statement is a commitment not to disclose it to third parties, including after cooperation ends. They can be one document or two; the GDPR prescribes no form.
What are the consequences of having no authorizations for staff?
Articles 29 and 32(4) are among the controller's obligations, for breach of which the GDPR provides an administrative fine of up to EUR 10,000,000 or, for an undertaking, up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)(a)). The supervisory authority sets measures individually depending on the circumstances (Article 83(2)). We did not check the practice of the Polish data protection authority (UODO) on this point.
Legal status as of: 28 October 2026
Legal basis: Regulation (EU) 2016/679 (GDPR), Articles 5(2), 24, 28, 29, 32(4) and 83; Act of 6 November 2008 on Patient Rights and the Patient Rights Ombudsman (consolidated text Journal of Laws 2024 item 581, as amended by Journal of Laws 2026 items 26 and 791), Article 24(2)-(3) and (5)-(6) and Article 26(3a)-(3b); Minister of Health regulation of 6 April 2020 on medical records (consolidated text Journal of Laws 2026 item 1391), § 1(4). We did not check: guidance and practice of UODO, the 2018 Personal Data Protection Act, or the assessment of B2B arrangements (authorization or processing), which we leave for a lawyer to verify.
Last reviewed: 28 October 2026
The PREMIUM package contains instructions and a template for the authorization to process data, a processing agreement, a record of processing activities and a breach procedure. See the PREMIUM package or compare packages.
Related articles:
- GDPR documentation for a physiotherapy practice -- the full set
- GDPR at a physiotherapy practice -- the complete guide
- GDPR training for practice staff
- Onboarding at a physiotherapy practice -- which documents to prepare
- Student placements at a physiotherapy practice