GDPR for Dental Practices: A Practical Compliance Checklist

Every dental practice in the EU handles some of the most sensitive personal data there is: medical histories, radiographs, treatment notes and payment details. That makes GDPR for dental practices a practical, everyday concern rather than a legal abstraction. The good news is that compliance for a typical practice is manageable once you break it into concrete tasks and assign an owner to each.

This checklist walks through the core obligations under the General Data Protection Regulation (GDPR) as they apply to dental clinics, from lawful basis and privacy notices to processor contracts and breach reporting. Practices in the UK follow the very similar UK GDPR alongside the Data Protection Act 2018.

Please note: this article is general information, not legal advice. National laws add rules on health records, retention periods and professional secrecy that vary by country. For decisions specific to your practice, consult a qualified data protection advisor or your national supervisory authority.

Why health data needs extra care

The GDPR treats "data concerning health" as one of the special categories of personal data under Article 9. Processing special category data is prohibited unless one of the listed conditions applies. For dental care, the relevant condition is usually Article 9(2)(h): processing necessary for medical diagnosis and the provision of health care, carried out by or under the responsibility of a professional subject to an obligation of professional secrecy.

In practice, a clinic does not normally need explicit consent to keep clinical records for treatment. You must still show that health data is used for that purpose, that access is limited to people bound by confidentiality and that security matches the sensitivity of the data.

Establish a lawful basis for each purpose

Under Article 6, every processing activity needs a lawful basis. For health data you also need an Article 9 condition. Write down the basis for each purpose.

• Providing treatment and keeping records: usually contract or legal obligation under Article 6, combined with the health care condition under Article 9(2)(h).
• Billing: contract and legal obligation under tax law.
• Appointment reminders: often legitimate interests or contract, since reminders support the care the patient booked. Check national e-privacy rules for SMS and email.
• Marketing newsletters and promotions: usually consent, which must be freely given, specific, informed and as easy to withdraw as to give.

Keep the purposes separate. Consent to receive marketing emails should never be bundled into the treatment consent form.

Keep a record of processing activities

Article 30 requires most controllers to maintain a record of processing activities. Smaller organizations have a limited exemption, but it does not apply where processing includes special category data, so in practice dental clinics should keep one. List purposes, data categories, recipients, retention periods and security measures.

Publish a clear privacy notice

Articles 13 and 14 set out what you must tell patients when you collect their data. A privacy notice for a dental practice should cover, in plain language:

• Who the controller is and how to contact you (and your DPO, if you have one)
• What data you collect and why, with the lawful basis for each purpose
• Who you share data with, such as labs, specialists, insurers and software providers
• Whether data is transferred outside the EU or EEA, and the safeguards used
• How long you keep records, or the criteria used to decide
• The patient's rights and how to exercise them
• The right to lodge a complaint with a supervisory authority

Share it on your website, at reception and with intake forms, and update it when you add a supplier or purpose.

Handle patient rights and access requests

Patients have several rights under the GDPR. The most common in dentistry is the right of access under Article 15, often called a subject access request.

Responding to an access request

1. Verify identity using reasonable, proportionate checks.
2. Respond without undue delay and within one month of receipt. Article 12 allows an extension of up to two further months for complex or numerous requests, provided you inform the patient within the first month.
3. Provide a copy free of charge. A reasonable fee is only allowed for further copies or for requests that are manifestly unfounded or excessive.
4. Include all personal data, such as notes, radiographs, correspondence and billing records, along with the supplementary information in Article 15.
5. Protect third parties by redacting information about other people where needed.

Other rights to plan for

• Rectification (Article 16): correct inaccurate data. For clinical notes, add a correction rather than deleting the original entry.
• Erasure (Article 17): this right is not absolute. It does not apply where you must keep records to meet a legal obligation, which often covers clinical records.
• Objection (Article 21): including an absolute right to object to direct marketing.
• Data portability (Article 20): applies to data processed by automated means on the basis of consent or contract.

A rights request needs no special wording and can arrive by phone, email or in person, so train reception to recognize one.

Set retention periods and stick to them

The storage limitation principle in Article 5 means you keep personal data no longer than necessary. The GDPR does not set retention periods for dental records. These come from national health, professional and tax rules, and they differ significantly between countries and for children's records.

• Document a retention schedule per record type, such as clinical records, radiographs and invoices.
• Base each period on national rules and note the source.
• Review periodically and securely delete or anonymize records that have passed their retention date.
• Include backups and retired systems.

Sign DPAs with your software vendors and other processors

Any supplier that processes personal data on your behalf is a processor. For a dental practice that typically includes practice management software, cloud storage and backup, email and SMS reminder services, IT support, payment processors and sometimes outsourced billing.

Article 28 requires a written contract, usually called a data processing agreement (DPA), that covers among other things:

• Processing only on your documented instructions
• Confidentiality obligations for the processor's staff
• Appropriate security measures
• Conditions for using sub-processors
• Assistance with patient rights requests and breach notification
• Deletion or return of data at the end of the contract

When choosing software, ask where data is hosted, whether it leaves the EU or EEA and which sub-processors are used. Keep signed DPAs on file.

Apply appropriate security measures

Article 32 requires security appropriate to the risk, taking into account the state of the art and the cost of implementation. For health data, the risk is high, so the bar is too. A practical baseline for a dental clinic:

• Individual accounts and role-based access. No shared logins. Reception does not need full clinical access, and access should be removed promptly when staff leave.
• Strong authentication, including multi-factor authentication where available.
• Encryption of laptops, mobile devices, backups and data in transit.
• Audit logs that record who viewed or changed patient records.
• Tested backups stored separately.
• Patching on every workstation.
• Physical security: locked server cabinets and screens hidden from the waiting area.

For new technology likely to pose a high risk to patients, check whether a data protection impact assessment (DPIA) under Article 35 is required.

Prepare for data breaches

A personal data breach includes lost or stolen devices, emails sent to the wrong patient, ransomware and unauthorized access by staff. Under Article 33, you must notify your supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals. Under Article 34, you must also inform affected patients without undue delay when the breach is likely to result in a high risk to them.

1. Write a short breach response procedure and name who leads it.
2. Contain the breach and assess the risk: what data, how many people, how sensitive.
3. Notify the authority and patients where required.
4. Record every breach internally, including those you did not need to report.

Train staff and consider a DPO

Many incidents start with human error, so training matters. Cover confidentiality, phishing, identity checks, rights requests and fast breach reporting. Refresh it regularly and at onboarding.

Article 37 requires a data protection officer when, among other cases, a controller's core activities consist of large-scale processing of special category data. Whether a dental practice meets that threshold depends on its size and context. Recital 91 indicates that processing patient data by an individual physician should not be considered large scale, while larger groups or multi-clinic organizations may be. If you are unsure, document your reasoning or ask your supervisory authority. Either way, name one person responsible for data protection.

For official guidance, the European Data Protection Board and national authorities such as the UK's Information Commissioner's Office publish practical resources.

Key takeaways

• Health data is special category data. Rely on the health care condition for treatment records and keep marketing consent separate.
• Document a lawful basis per purpose, keep a record of processing and publish a clear privacy notice.
• Answer access requests within one month, free of charge in most cases.
• Set retention periods from your national rules and delete data when they expire.
• Sign DPAs with every processor, including your practice software vendor.
• Use role-based access, encryption, audit logs and tested backups.
• Report qualifying breaches within 72 hours where feasible, and train staff regularly.

Your software choices make several of these steps easier. Pulse Dent offers EU data hosting, staff roles that limit who sees what and an audit log of changes to records. You can see plans and compare what each one includes.