Data Protection Legislation

I am afraid that you will need a Data Protection Officer and a Data Protection Impact Assessment because your organization is going to process on a large scale the health data which belong to a particular category of data under Article 9 GDPR.

Here you can find more information about the DPO and the DPIA process:

• How to hire the right DPO? https://advisera.com/eugdpracademy/blog/2018/08/27/how-to-hire-the-right-dpo/
• 5 phases of the EU GDPR Data Protection Impact Assessment: https://advisera.com/eugdpracademy/knowledgebase/5-phases-of-the-eu-gdpr-data-protection-impact-assessment/

If you need to know how to implement GDPR in your organization you can consider enrolling in our free EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//