What is the GDPR?

The General Data Protection Regulation (GDPR) governs personal-data protection and has applied since 25 May 2018. National legislation supplements it. Personal data concern identified or identifiable people, including contact details, professional user profiles and certain online identifiers.

Its scope does not depend simply on nationality. Besides EU establishments, offering services to people in the EU and monitoring their behavior there can be relevant. The European Data Protection Board's introductory guide explains the framework.

Which legal bases are available?

Consent is one possible basis, rather than the only one. Depending on purpose, contract performance, legal obligations or legitimate interests may be relevant. The basis must fit the actual processing operation; possessing an address does not permit every marketing use.

Health information belongs to specially protected categories. Processing needs both a general legal basis and an applicable condition under Article 9. Explicit consent is one possibility; the law also provides other limited conditions concerning matters such as care, public health and research.

What does this mean for pharmaceutical marketing?

Doctors' professional contact information is personal data too. Companies need defined purposes, proportionate collection, retention arrangements and appropriate information for individuals. Email advertising and device access additionally require consideration of rules such as Germany's UWG and TDDDG.

Professional login, CRM registration and newsletter subscription are different activities. Information should not be combined between them for new purposes without assessment. First-party data collected by the company remain subject to these requirements.

How can privacy be managed in practice?

Controllers determine purposes and essential means. Processors act under documented instructions; not every service provider automatically has that role. Permissions, deletion periods, suitable safeguards and, where relevant, international-transfer arrangements need to match actual information flows.

Individuals' rights include access, correction, erasure and objection under their respective conditions. Portability does not apply to all processing. A data protection impact assessment needs consideration where processing is likely to create high risk. The overview of legal bases supports the initial assessment.

Conclusion: Make purposes and responsibilities clear

Privacy starts with identifying which information is needed and why. Proportionate collection, understandable permissions and reliable processes support responsible healthcare communication. Consent does not remove the remaining data-protection duties.