Find out what personal data you administrate, where you store personal data and whether you transmit personal data. Remember to think of the personal data of your employees (personnel files, time recording systems, rosters, tax advisors, email programs, documents containing personal data, websites, photos, quality management systems or practice management software), your customers (registration forms, practice management software, diagnostic equipment, examination forms for laboratory tests, teleradiology and hereditary diseases, photos or websites) and all veterinary practices, organisations und enterprises (third parties) who you work with (the contact details of your contact person, bank transfers/reverse transfers or contracts). 

If you use VetZ products, you will find personal data in easyVET, easyIMAGE, XDR, XCR, vetsXL.com and petsXL.com.

Specify which personal data you process, how personal data is used, who can access personal data and to whom you transmit personal data. To do this, you, as the controller, must prepare a written record (your data governance policy or, in the language of the GDPR: a documentation of your processing activities) where you describe in a detailed and structured way how you ensure that the processing of personal data in your practice, your enterprise or your organisation is compliant with the GDPR. This document enables you to show to your employees, customers and third parties that you are transparent and to protect yourself in matters of data protection law. The document must contain a list of all the applications, procedures and files you use when processing personal data (examples can be found in Step 1). It must describe what technical and organisational measures you have taken to protect personal data. And it must list all processors (for example your payroll office, your laboratory or VetZ/vetsXL.com) to whom you transmit personal data. Please keep in mind that this document is a dynamic document and that you have to update it as soon as the processing of personal data at your practice, your enterprise or your organisation changes.

The following VetZ products must appear in your documentation if you use them: easyVET, easyIMAGE, XDR and XCR, vetsXL.com and petsXL.com as applications and VetZ as a processor if you use vetsXL.com or petsXL.com.

Put security mechanisms into effect to protect personal data, to identify data breaches in time and to reliably prevent the misuse of data. Security measures may take many forms and place highly diverse technical and organisational demands on you. The technical demands include secure firewalls, up-to-date anti-virus protection, encryption and pseudonymisation, data backup and recovery procedures and secure password protection for all applications and services which you use. The organisational demands include that you process only the personal data that you really need for the intended purpose – and only for as long as you need it. For example, if you collect a pet owner’s personal data, you usually do not need his or her date of birth or profession or national insurance number. The organisational demands also include ensuring the confidentiality, integrity and availability of the systems and services employed. It is especially important to review the effectiveness of the technical and organisational measures on a regular basis and to raise awareness of data protection and information security in your practice, enterprise or organisation.

VetZ products protect personal data through clearly defined access controls (password protection), encryption when storing and transmitting data and providing a high level of communications and systems security.

Document how you process personal data and update your privacy policy. The EU General Data Protection Regulation sets new standards not only for processing personal data, but also for documenting how personal data is processed. You therefore have to document not only the purpose of the processing but also the category of the processed data and your technical and organisational security measures, and to name any third parties to whom you transmit personal data. Your documentation must be transparent both internally and externally and has to be trackable. It has to allow you, your employees and your customers to clearly and unambiguously understand how you process personal data. If there is a breach of data security or a case of data misuse, you must report, document and store the incident.