GDPR for dental practices in the UK

UK dental practices process some of the most sensitive personal data of any small business: patient health records, X-rays, medical history, financial information. Under UK GDPR, health data is a "special category" requiring heightened protection. The General Dental Council (GDC) and the ICO both have specific expectations for healthcare providers.

---

Patient data as special category

Health data is a special category of personal data under UK GDPR Article 9. For dental practices, this covers:

• Clinical records, treatment plans, and notes
• Dental X-rays and other imaging
• Prescribed medications and allergy information
• Referral letters and specialist reports
• Payment and insurance information (when linked to health treatment)

What this means in practice:

• You need a lawful basis under Article 6 plus a special-category condition under Article 9. The standard combination for clinical care is Article 6(1)(c)/(e) (legal obligation / public task for NHS work, or contract for private) plus Article 9(2)(h) (provision of health treatment), supplemented by Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018 which provides the UK-specific authorisation
• You must implement stronger technical and organisational security measures
• Staff must be trained on data protection and the common-law duty of confidentiality
• Access must be strictly limited to those who need it for patient care

NHS-contracted practices must also complete the annual Data Security and Protection Toolkit (DSPT), the NHS Digital framework for healthcare data protection assurance.

---

Record retention

Standard UK retention periods for dental records, drawn from NHS Digital's Records Management Code of Practice 2021 and GDC guidance:

After the retention period, patient records must be securely destroyed (shredded, not simply deleted without proper data wiping for digital records).

---

Online booking systems

Dental practices increasingly use online booking and practice-management systems such as Software of Excellence (Exact), SOE, Kiroku, Dentally, Carestream R4, and similar tools. Each of these systems processes patient personal data on your behalf.

Your obligations:

• Sign a Data Processing Agreement (DPA) with your provider — required under UK GDPR Article 28
• Confirm the provider stores data on UK or EU servers (or has appropriate transfer safeguards under the IDTA or UK Addendum)
• Review the provider's own privacy policy and security certifications (Cyber Essentials Plus and ISO 27001 are standard expectations)
• Ensure only authorised staff can access patient records through the system

NHS-contracted practices must also confirm any system handling NHS patient data is compliant with the NHS Digital DSPT.

---

Your practice website

If your website has a contact form, appointment-request form, or online booking integration, it processes personal data.

Required on your practice website:

• Privacy notice explaining how patient data is collected and processed
• Cookie banner if you use analytics (Google Analytics uses cookies that identify visitors)
• Companies House number and registered office in your footer (Companies (Trading Disclosures) Regulations 2008, if you're a registered company)
• GDC registration number displayed (professional body requirement under the Dentists Act 1984 and GDC Standards)

The GDC has consistently reminded registrants that patient-facing communications — including websites — must comply with the GDC's Standards for the Dental Team, including in relation to confidentiality and the use of testimonials.

---

Data breach procedure

If patient records are accessed without authorisation (a cyberattack, a lost device, a misdirected email), you must:

1. Identify and contain the breach
2. Assess the likely impact on patient rights and freedoms
3. Notify the ICO within 72 hours via ico.org.uk/for-organisations/report-a-breach
4. If the breach poses high risk to patients: notify the affected patients directly
5. Document the breach and your response

Health data breaches almost always meet the notification threshold due to the sensitivity of the data involved.

NHS-contracted practices must additionally report through the DSPT incident reporting tool, which feeds the breach into NHS England's incident management framework.

---

Practical checklist for dental practices

---

Check your practice website

Free website compliance check →

---

Sources

• General Dental Council, Standards for the Dental Team
• NHS Digital, Records Management Code of Practice 2021
• ICO, Health sector guidance
• UK GDPR Article 9, Special categories of data

---

This is technical analysis, not legal advice. Consult the GDC and a data protection specialist for specific guidance.