GDPR and Pharma Call Reporting: What a Small Distributor Actually Has to Think About

This is not legal advice. It is a practical description of where the questions usually sit for a small distributor, written so you know what to ask your own adviser rather than discovering it during an audit. If any of it applies to you, take it to a qualified data protection lawyer in your market.

With that said, here is the thing that catches people out.

The doctor is a data subject

A field rep writes: "Dr Bērziņš at the polyclinic is still unhappy about the reimbursement paperwork, said he'd try it on two patients after the September rota."

That is a record about an identified natural person, held by your company, and processed for a commercial purpose. It does not stop being personal data because Dr Bērziņš is a professional and the interaction was professional. Business-context data about an identifiable individual is still personal data.

Most distributors know this in the abstract. Where it gets uncomfortable is the second half of the sentence — the parts that are opinion, sentiment, and inference. Unhappy. Hostile to the rep. Probably won't switch. Those are personal data too, they are held about a named individual, and if that person asks what you hold about them, they are inside the answer.

The four questions that actually matter

Whatever system you use, spreadsheet or platform, these are the ones that come up.

1. What is your lawful basis? For B2B commercial contact with healthcare professionals, legitimate interests is the basis most distributors rely on — which requires you to have actually done and documented the balancing exercise, not merely to have concluded it in your head. The word "documented" is doing real work there. A legitimate-interests assessment you cannot produce is functionally one you did not do.

2. Are you accidentally holding health data? This is the one that turns a routine question into a serious one. Notes about a doctor are ordinary personal data. Notes that identify a patient — even indirectly, even in passing, even as "the patient in bed four" — are special category health data, with a much higher bar. Reps do not set out to record patient data. It happens because a clinical anecdote is how a doctor explains an objection, and the rep writes down what the doctor said. Your free-text field is where this arrives.

3. Can you answer a subject access request? A doctor writes and asks what you hold about them. You have one month. Can you find every note, across every rep, including the ones written by someone who left last year? If the record lives in three reps' notebooks and a shared spreadsheet, the honest answer is no.

4. What happens when a rep leaves? Two directions, both worth thinking about. The company data on their personal phone — does it go? And the records they created — do they stay findable by whoever takes over? Small distributors are usually more exposed on the first than they think, because field work has a long tradition of personal phones and personal notebooks.

Where the free-text box is the real risk

Every field CRM has one, and it is where the problems concentrate — because free text accepts anything, is rarely reviewed, and is exactly where an anecdote about a patient ends up. Practical things that reduce the exposure, none of which require a platform:

• Tell reps plainly what not to write. Not a policy document — one sentence they remember: never write anything that identifies a patient. Most reps have never been told this directly and are relieved to know where the line is.
• Keep the note about the professional interaction. The objection, the commitment, the product. Not the clinical story that carried it.
• Have a retention period and apply it. Field notes from six years ago are risk with no commercial value attached. Most distributors have no retention rule at all, which means the answer to "how long do you keep it" is "forever", and forever is a hard position to defend.
• Know where it physically lives. If the data sits with a processor outside the EEA, that is a transfer, and transfers need their own answer.

The uncomfortable comparison with a spreadsheet

Small distributors often stay on spreadsheets partly because it feels lower-risk — no vendor, no processor, no contract.

It is usually the opposite. A shared spreadsheet typically has no access log, no retention rule, no way to isolate one doctor's records for a subject access request, and a distribution history nobody can reconstruct — three copies on personal laptops, one emailed to a colleague in 2023, one in someone's downloads folder. It is not less regulated. It is only less visible, and less visible is worse when someone asks a question you have to answer in writing.

A system with per-user access, a retention setting, and the ability to export everything about one individual is not bureaucracy. It is the difference between a one-hour answer and a two-week reconstruction.

What to ask any vendor, including us

Five questions, and the answers should be in writing before you buy:

1. Where is the data hosted, and does it leave the EEA?
2. Is there a data processing agreement, and can I see it before signing?
3. Can I export everything about one individual without asking support?
4. Can I delete one individual's records without deleting the account?
5. Who inside the vendor can see my data, and under what circumstances?

Any vendor selling into European pharma should answer all five without hesitating. A vendor who treats these as unusual questions is telling you how many European customers they have.

The short version

You are not running a clinical trial. The obligations on a distributor doing commercial field work are manageable, and most of the risk sits in one place: the free-text note, and the patient story that occasionally lands in it.

Three things get you most of the way. Tell reps in one sentence what never to write. Keep the record where you can search it and export it per person. Decide how long you keep it, and actually delete.

The rest is your lawyer's job, and worth an hour of their time before it is worth a month of yours.