Sector regulation
HDS v2 — French health data hosting certification
The certification required in France to host personal health data on behalf of third parties.
At a glance
- Type
- French regulatory certification
- Publisher
- Agence du numérique en santé (ANS)
- Version
- 2.0 (2024)
- Foundation
- ISO/IEC 27001:2022 + 31 specific requirements
37 requirements tracked · 106 shared controls
What is HDS?
Article L.1111-8 of the French Public Health Code requires a certification for anyone hosting personal health data collected during prevention, diagnosis, care or social and medico-social follow-up, on behalf of a third party. The framework is published by the French digital health agency (ANS).
Version 2.0, approved by decree in 2024, builds on ISO/IEC 27001:2022 and adds 31 specific requirements: scope, subcontracting, customer information, hosting contract and reversibility, and sovereignty requirements (storage in the European Economic Area, control of access from third countries, a public map of transfers). Since 16 May 2026, every valid certificate attests compliance with v2.
Key requirements
- 1
ISO 27001 ISMS covering hosting
The management system must cover all the hosting activities in the certificate scope.
- 2
ISMS additions
Interested parties and legal framework, feared events specific to health data, allocation of responsibilities, internal audits.
- 3
Hosting contract
Clauses required by the Public Health Code, customer information and reversibility.
- 4
Sovereignty
Storage exclusively in the EEA, control of access from third countries, analysis of exposure to non-European laws, public map of transfers.
Summary written by OK-GRC. The texts of ISO standards are protected by copyright and are not reproduced.
How OK-GRC helps
- HDS v2 requirements linked to 106 common controls, shared with your ISO 27001 ISMS
- Supplier register with data location and transfer mechanisms
- Supplier policy, cloud policy and data processing agreement templates
- Evidence tracking, internal audits and management review for the certification audit
Related frameworks
With ISO 27001 controls in place, your HDS starting score is about 38 to 54%.
The controls you put in place for HDS also count for:
Frequently asked questions about HDS
Can we store patient data in OK-GRC?
No. OK-GRC is for managing your compliance (policies, risks, evidence, audits) and is not an HDS-certified host: do not upload personal health data to it.
Is ISO 27001 certification enough for HDS?
No. It is the mandatory foundation, but the HDS audit also checks the framework’s 31 specific requirements, in particular the contractual and sovereignty requirements.
Informational content up to date as of October 2026; it does not constitute legal advice. Always check the official texts in force.
Ready to simplify your compliance?
Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.
14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment