# Health Data Processing Assessment Workflows

## Workflow 1: Health Data DPIA Screening
1. Identify whether processing involves health data under Art. 4(15).
2. Determine if processing is large-scale (Art. 35(3)(b) trigger).
3. If large-scale → DPIA mandatory.
4. If not large-scale → screen against WP248 criteria (C4 always met for health data; if any other criterion met → DPIA required).

## Workflow 2: Art. 9(2) Exemption Selection
1. Is processing for healthcare provision? → Art. 9(2)(h) with professional secrecy.
2. Is processing for clinical research? → Art. 9(2)(j) with Art. 89(1) safeguards.
3. Is processing for public health? → Art. 9(2)(i).
4. None of the above? → Art. 9(2)(a) explicit consent required.

## Workflow 3: Clinical Trial Data Protection
1. Obtain separate GDPR consent alongside CTR informed consent.
2. Pseudonymise data with PI holding re-identification key.
3. Assess international transfers for multi-centre trials.
4. Document retention periods reconciling CTR (25 years) with GDPR minimisation.
5. Conduct DPIA covering all trial processing activities.