Patient data: GDPR-compliant backups, fully verifiable

Yes. Art. 32(1) GDPR requires that the availability and resilience of systems are ensured and that personal data can be restored quickly after an incident. For health data under Art. 9 GDPR the bar is correspondingly high. Added to this are the retention obligations for treatment records.

The periods follow from the treatment context and professional regulations – under § 630f(3) BGB generally ten years after the end of treatment, in certain cases, for example under radiation protection law, considerably longer. Which period applies to your institution is for you or your legal advisors to decide. Technically we implement it through retention rules in the object storage: inside the period the backup is protected, afterwards it expires automatically.

Yes, for cloud use. Since 1 July 2024, § 393 SGB V has permitted care providers to process social and health data via cloud services only under certain conditions, which include a current C5 attestation of the processing entity. Since 1 July 2025 a C5 Type 2 attestation has been envisaged for this; the C5 equivalence regulation also allows certain alternative certifications combined with an action plan. centron holds a BSI C5:2020 Type 1 attestation for the ccloud³ and ISO 27001 certification based on IT-Grundschutz; you can obtain the current status of the attestation and the documents from the sales team.

§ 393 SGB V permits processing in Germany, the EU and the EEA as well as in third countries with an adequacy decision, provided the processing entity has a domestic establishment. Also check which locations and services are actually covered by your provider’s certificate – at centron these are the Hallstadt, Nuremberg and Frankfurt am Main locations.

Exclusively in German data centres, with no transfer to third countries. The deployment location for cloud workloads is our own data centre in Hallstadt near Bamberg. The corresponding evidence – certificates with scope, technical measures and the data processing agreement – is available in the Trust Center.

§ 393 SGB V requires processing in permissible regions, a domestic establishment, appropriate technical and organisational measures and a current C5 attestation. centron meets the location and establishment requirements and holds a BSI C5:2020 Type 1 attestation for the ccloud³ as well as ISO 27001 certification based on IT-Grundschutz. You can obtain the current status and the documents from the sales team.

Ideally automated and daily. Critical data can additionally be backed up at shorter intervals.

That depends on the volume and the infrastructure. Professional backup solutions allow practice operations to resume quickly – and with cProtect a failover system is ready in seconds if needed.

For medical practices, dental practices, specialist centres, medical care centres and other medical institutions with sensitive patient data.

Only if it sits beyond the attacker’s reach. Ransomware typically encrypts everything reachable from the infected system – including attached backups. That is why centron keeps backups in a separated environment and immutable via object lock: within the retention period they cannot be overwritten, not even with stolen credentials.

centron is responsible for platform and operations: data centres, virtualisation, network, monitoring, logging, platform backup, and incident, change, emergency and provider management. Your operating systems, your applications, your business processes and your content – including the patient data itself – remain your responsibility. This boundary is expressly recorded in the scope of our ISO 27001 certification and can therefore be evidenced in an audit.

An IT service provider supporting professional secrecy holders with data processing is an “other participating person” under § 203(3) StGB. The personnel involved must be bound to confidentiality – at centron this is implemented through corresponding staff obligations and the documented technical and organisational measures.

The data processing agreement under Art. 28 GDPR, the documentation of technical and organisational measures under Art. 32 GDPR, and the certificates and the C5 attestation including their scope. All documents are available in the Trust Center.