Data Protection and Information Security in Prehospital Emergency Care: A Literature Review of GDPR and ISO 27001

Background: The growing digitalization of healthcare has intensified the collection, processing, storage, and transmission of sensitive patient information. The General Data Protection Regulation (GDPR) establishes a regulatory framework for personal data protection within the European Union, while ISO/IEC 27001 provides a structured framework for information security management. These requirements are particularly relevant to healthcare, where information systems process sensitive patient data. Objective: This study aimed to examine the extent to which GDPR requirements and ISO 27001 principles have been studied and applied in prehospital emergency healthcare and to identify evidence from the broader healthcare sector that could inform their future implementation in emergency medical services. Methods: A literature review was conducted using PubMed, Scopus, Web of Science, and Google Scholar. Searches initially combined terms for prehospital emergency care with terms for GDPR, ISO 27001, information security, and data safety. Because no studies specifically addressed prehospital emergency setting, the search was subsequently expanded to the broader healthcare domain. GDPR-related publications from 2016 onward and ISO 27001-related publications from 2005 onward were included. Results: A total of 1,115 records were initially identified, and 53 publications were ultimately included. No publication specifically addressed data protection or ISO 27001-based information security in prehospital emergency healthcare. Of the 53 included studies, 45 concerned GDPR and healthcare, and eight concerned ISO 27001 and healthcare. The literature covered GDPR implementation in healthcare organizations, health professionals’ awareness and compliance, national regulatory implementation, digital and mobile health, patient health-data sharing, electronic health records, and ISO 27001 implementation in healthcare environments. Conclusions: A clear research gap exists regarding data protection and information security in prehospital emergency healthcare. Evidence from the wider healthcare sector underscores the importance of GDPR compliance, staff awareness, information security management, and appropriate technical and organizational safeguards. Further empirical research on ambulance services, emergency medical personnel, and prehospital health information systems is needed.