External DPO - Healthcare and Digital Health
AUMANS AVOCATS acts as an external DPO for HealthTech, MedTech and digital health companies, combining expertise in data protection, knowledge of healthcare regulations and an understanding of the specific challenges involved in developing innovative solutions.
Innovative healthcare companies operate in a particularly complex environment. The development of a connected medical device, medical software, a digital platform or a solution using artificial intelligence may involve the processing of large volumes of health data, while also being subject to several European and national regulatory frameworks.
In this environment, the DPO cannot be limited to formally monitoring compliance with the GDPR. The DPO must understand the technologies being developed, the data being used, relationships with healthcare professionals and institutions, research and clinical evaluation processes, and the different stages of product development and deployment.
AUMANS AVOCATS therefore assists legal, Data, IT, security, medical, clinical and regulatory teams in integrating data protection into the company’s key strategic decisions.
As a member of France Biotech, AUMANS AVOCATS is part of the French healthcare innovation ecosystem and supports HealthTech and MedTech companies in their development projects in France and across Europe.
A DPO specialised in the HealthTech and MedTech environment
The DPO function takes on a particular dimension where a company’s activities rely on the processing of health data or on the development of technologies intended for patients and healthcare professionals.
The firm advises in particular companies developing:
medical devices and digital medical devices;
software intended for medical purposes;
connected medical devices;
remote monitoring or patient monitoring solutions;
digital health applications and platforms;
diagnostic or clinical decision-support tools;
solutions incorporating artificial intelligence systems;
platforms enabling the collection or analysis of health data;
solutions intended for clinical research or the use of real-world data.
This specialisation enables the DPO to integrate data protection directly into the product development lifecycle, rather than addressing it only when the product is placed on the market or deployed.
Integrating data protection from the product design stage
For a HealthTech or MedTech company, decisions made during product design may determine a significant part of its future compliance.
Data architecture, data location, the categories of information collected, retention periods, functionalities offered to users and relationships with technology providers must be analysed sufficiently early.
As part of its external DPO engagement, AUMANS AVOCATS assists its clients in particular to:
map processing activities related to products and services;
identify the purposes and legal bases of processing activities;
qualify the data used, in particular health data;
integrate the principles of privacy by design and privacy by default;
carry out and update Data Protection Impact Assessments (DPIAs);
define retention periods;
organise information provided to patients, users and healthcare professionals;
define procedures for exercising data subject rights;
analyse data flows and their location;
secure relationships with suppliers and processors;
govern international data transfers.
The objective is to integrate compliance into the development process so that it supports innovation rather than becoming an additional constraint at the end of the project.
Medical devices, software and personal data
Where a product constitutes a medical device or an in vitro diagnostic medical device, data protection requirements must be coordinated with the regulatory framework applicable to the product.
The firm assists manufacturers and software providers in analysing the interactions between the GDPR and, depending on the project, the Medical Device Regulation (MDR), the In Vitro Diagnostic Medical Devices Regulation (IVDR), and the requirements applicable to cybersecurity, hosting and interoperability of health data.
The DPO assists in particular with:
processing activities carried out by the device or software;
data collected from patients and healthcare professionals;
remote monitoring and patient monitoring functionalities;
data generated through use of the product;
conditions governing access to data by the manufacturer, healthcare professionals or partners;
reuse of data for research or product improvement purposes;
relationships with healthcare institutions using the solution;
agreements with hosting providers, cloud providers and other technical service providers.
Research, clinical evaluation and real-world data
The development and evaluation of healthcare products frequently involve research, clinical investigations or studies using health data.
The firm assists its clients in defining the framework applicable to these processing activities and ensuring their compliance with the GDPR, the French Data Protection Act and the CNIL Reference Methodologies.
The firm’s services may in particular concern:
clinical investigations of medical devices;
performance studies of in vitro diagnostic medical devices;
research involving or not involving human participants;
retrospective studies;
studies based on real-world data;
reuse of data generated in the course of care;
studies using data from health data warehouses;
access to databases or the French National Health Data System (SNDS).
The DPO can therefore support clinical and regulatory teams from protocol design through to the operational implementation of processing activities and ongoing monitoring of the research.
Artificial intelligence & health data
Where the development, training, validation or use of an AI system involves personal data, the DPO must be involved sufficiently early in the project.
AUMANS AVOCATS assists its clients in particular with:
determining the legal bases allowing the use of data;
reuse of existing health data;
anonymisation and pseudonymisation;
carrying out DPIAs;
providing information to data subjects;
transparency regarding processing activities;
data governance and data quality;
relationships with providers of AI models, solutions or infrastructure;
coordination between the requirements of the GDPR, the AI Act and applicable sector-specific regulations.
Health data warehouses and data valorisation
HealthTech and MedTech companies may need to create or use health data warehouses in order to develop their products, conduct research or evaluate their solutions.
AUMANS AVOCATS assists its clients with:
qualifying the warehouse project;
assessing its compliance with the CNIL framework;
preparing the necessary formalities;
defining the governance of the warehouse;
providing information to data subjects;
defining data access procedures;
governing subsequent research and reuse;
drafting data access and data sharing agreements;
anticipating developments relating to the European Health Data Space (EHDS).
A DPO integrated into teams and projects
The external DPO must be able to work closely with the teams that design and deploy products.
AUMANS AVOCATS assists senior management, legal and regulatory departments, as well as Data, IT, cybersecurity, R&D, medical and clinical teams.
The firm assists in particular with:
performing the DPO tasks provided for under the GDPR;
maintaining and developing the record of processing activities;
participating in project committees and governance committees;
reviewing new processing activities and new products;
carrying out or reviewing DPIAs;
developing internal policies and procedures;
training and raising awareness among teams;
supporting the selection and monitoring of processors;
responding to compliance questionnaires from clients and partners;
preparing audits by partners, investors or healthcare institutions;
assisting with relations with the CNIL and other data protection authorities.
Personal data breaches, cybersecurity and crisis management
The firm assists its clients in managing incidents and personal data breaches, in coordination with IT and cybersecurity teams and technical service providers.
This assistance includes in particular:
qualifying the incident;
assessing risks to individuals;
documenting the breach;
analysing contractual obligations towards clients and partners;
notifying the CNIL or competent authorities where required;
informing data subjects where necessary;
coordinating with the healthcare institutions and partners concerned;
supporting post-incident reviews and corrective measures.
AUMANS AVOCATS approaches the external DPO function as legal and strategic support integrated into the company’s development.
Our knowledge of health data, clinical research, medical devices, artificial intelligence and digital environments enables us to address data protection issues within their technological and regulatory context.
This approach gives HealthTech and MedTech companies access to a DPO specialised in their sector, capable of engaging with their teams and supporting their projects from initial design through to deployment in France and across Europe.
Follow the latest news from the firm on DPO...
Role of DPOs within EU Institutions: Mapping Obligations and Current Landscape
1. EDPS Guidelines on the Role of DPOs On 18 December 2025, the European Data Protection Supervisor (EDPS) published guidelines on the role of Data
Mapping personal data processing: methodology, steps and DPO’s role
Compliance with GDPR relies on a deep understanding of data processing within the organization. However, this knowledge cannot be improvised; it must be structured, exhaustive,
Role of the DPO and data governance: how to effectively collaborate?
Compliance with the GDPR cannot be limited to a formal or documentary approach. It presupposes the construction of a genuine governance framework, living, effective, and
Follow the latest news from the firm on Life Sciences law…
Research in health and new reference methodologies MR-001 and MR-003 of the CNIL: what changes for professionals and what recommendations ?
By four deliberations dated March 19, 2026, the French National Commission on Informatics and Liberty (CNIL) has updated its “reference methodologies” MR-001 and MR-003, which
Use of AI Systems in healthcare: how to meet multiple information obligations?
Healthcare professionals are increasingly using artificial intelligence systems (hereinafter “AI systems”) in their practices and in patient care. However, as deployers of these systems (under
GDPR and EHDS (Regulation on Health Data of the European Space (EHDS): Which rules for the processing of health data in Europe?
The entry into force of Regulation 2025/327 concerning the European Health Data Space (“EEDS” or “EHDS”) on 26 March 2025 constitutes a major advancement in