The Irish Data Protection Commission has reprimanded Children’s Health Ireland over the physical security and management of children’s health records.
Technology is now embedded in almost every aspect of working life, and the rapid development of artificial intelligence has intensified the focus on digital data. However, the General Data Protection Regulation (GDPR) is not limited to personal data processed electronically.
Article 2 of the GDPR takes a broader approach. It applies to personal data processed wholly or partly by automated means, as well as to non-automated processing where the data forms part of, or is intended to form part of, a filing system. In practical terms, organised paper records can fall within the GDPR just as digital records do.
Although many regulatory inquiries concern digital processing, poor handling of physical records can equally lead to scrutiny and enforcement. The Data Protection Commission’s (DPC) recent decision concerning Children’s Health Ireland (CHI) is a clear example.
On 1 October 2026, the DPC announced its final decision following an inquiry into the physical safety and security of children’s health records at a CHI facility in Dublin.
A notable feature of the case is how the inquiry began. Following protected disclosures made to the DPC, the regulator carried out an unannounced inspection of the CHI facility on 16 July 2025. The DPC had learned that documents containing sensitive and special category data about children had overflowed from, and were later removed from, a confidential waste bin positioned beside the door to the Non-Consultant Hospital Doctor’s (NCHD) office.
The nature of the information made the risks particularly serious. Health and genetic data are special categories of personal data under the GDPR and receive additional protection. Article 9 generally prohibits their processing unless a specific exception applies. In healthcare, one relevant exception may arise where processing is necessary to protect the vital interests of the individual or another person, and the individual is physically or legally incapable of giving consent.
The inquiry examined whether CHI had adequately protected the confidentiality of children’s personal data held in paper records in the NCHD office and whether those records were properly managed and controlled.
The DPC found that CHI had infringed Article 5(1)(f) of the GDPR, the principle of integrity and confidentiality, by failing to process the personal data in a manner that provided appropriate security. This principle requires protection against unauthorised or unlawful processing and against accidental loss, destruction or damage through appropriate technical and organisational measures.
The DPC also found an infringement of Article 32(1). CHI had not implemented technical and organisational measures that provided a level of security appropriate to the risks affecting personal data held in the NCHD office and placed in confidential waste bins.
Article 32 identifies several measures that organisations should consider when assessing appropriate security. These include pseudonymisation and encryption. Applying equivalent protections to handwritten healthcare records can be challenging, considering redacting each note may be costly and time-consuming, while removing identifying details at the point of care may be impractical. The difficulty, however, does not remove the obligation to assess the risk and adopt suitable safeguards.
Organisations should also maintain the ongoing confidentiality, integrity, availability and resilience of their processing systems and services. For paper records, this starts with understanding how documents move through the organisation, where they are stored, who can access them, and how they are securely disposed of. A structured review can reveal gaps that may otherwise remain unnoticed.
Another relevant measure is the ability to restore access to personal data promptly after a physical or technical incident. Availability is often discussed in the context of digital systems, but paper records are also vulnerable to fire, flooding, loss or damage. Organisations should therefore consider whether essential information can be recovered through secure physical or digital copies and whether recovery arrangements are regularly reviewed.
Finally, Article 32 refers to a process for regularly testing, assessing and evaluating whether security measures remain effective. This is where tools such as data protection impact assessments, control reviews and maturity assessments add practical value, as they help organisations move beyond written policies and examine how personal data is handled in day-to-day operations.
This requirement connects directly with the corrective measures imposed on CHI. In addition to issuing a reprimand, the DPC ordered CHI to bring its processing into compliance with Articles 5(1)(f) and 32(1). It also required CHI to complete and finalise draft Data Protection Impact Assessments (DPIAs) concerning the processing of healthcare records in the NCHD office and the management of confidential waste.
CHI was also required to implement fully the technical and organisational measures identified in the final DPIAs and provide copies of the completed documents to the DPC within four weeks of the decision.
DPIAs should not be treated as one-off compliance documents. When they are completed thoroughly and reviewed at appropriate intervals, they can help organisations understand their processing activities, identify weaknesses, prioritise proportionate controls and demonstrate that privacy risks are being actively managed.
The CHI inquiry is a timely reminder that an effective data protection programme must cover the full lifecycle of personal data, wherever and however it is held. Physical records deserve the same disciplined attention as digital systems: clear ownership, proportionate safeguards, secure disposal, regular testing and meaningful risk assessment. Good data protection is not defined by the format of the record, but by the care taken to protect it.