GDPR for dental practices in the UK

UK dental practices process some of the most sensitive personal data of any small business: patient health records, X-rays, medical history, financial information. Under UK GDPR, health data is a "special category" requiring heightened protection. The General Dental Council (GDC) and the ICO both have specific expectations for healthcare providers. Scan your practice website for UK GDPR issues to check whether your privacy notice, cookie banner and trader details are in order.

---

Patient data as special category

Health data is a special category of personal data under UK GDPR Article 9. For dental practices, this covers:

• Clinical records, treatment plans and notes
• Dental X-rays and other imaging
• Prescribed medications and allergy information
• Referral letters and specialist reports
• Payment and insurance information (when linked to health treatment)

What this means in practice:

• You need a lawful basis under Article 6 plus a special-category condition under Article 9. The standard combination for clinical care is Article 6(1)(c)/(e) (legal obligation / public task for NHS work or contract for private) plus Article 9(2)(h) (provision of health treatment), supplemented by Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018 which provides the UK-specific authorisation
• You must implement stronger technical and organisational security measures
• Staff must be trained on data protection and the common-law duty of confidentiality
• Access must be strictly limited to those who need it for patient care

NHS-contracted practices must also complete the annual Data Security and Protection Toolkit (DSPT), the NHS Digital framework for healthcare data protection assurance.

---

Record retention

Standard UK retention periods for dental records, drawn from NHS Digital's Records Management Code of Practice 2021 and GDC guidance:

After the retention period, patient records must be securely destroyed (shredded, not simply deleted without proper data wiping for digital records).

---

Online booking systems

Dental practices increasingly use online booking and practice-management systems such as Software of Excellence (Exact), SOE, Kiroku, Dentally, Carestream R4 and similar tools. Each of these systems processes patient personal data on your behalf.

Your obligations:

• Sign a Data Processing Agreement (DPA) with your provider, required under UK GDPR Article 28
• Confirm the provider stores data on UK or EU servers (or has appropriate transfer safeguards under the IDTA or UK Addendum)
• Review the provider's own privacy policy and security certifications (Cyber Essentials Plus and ISO 27001 are standard expectations)
• Ensure only authorised staff can access patient records through the system

NHS-contracted practices must also confirm any system handling NHS patient data is compliant with the NHS Digital DSPT.

---

Your practice website

If your website has a contact form, appointment-request form or online booking integration, it processes personal data.

Required on your practice website:

• Privacy notice explaining how patient data is collected and processed
• Cookie banner if you use analytics (Google Analytics uses cookies that identify visitors)
• Companies House number and registered office in your footer (Companies (Trading Disclosures) Regulations 2008, if you're a registered company)
• GDC registration number displayed (professional body requirement under the Dentists Act 1984 and GDC Standards)

The GDC has consistently reminded registrants that patient-facing communications, including websites, must comply with the GDC's Standards for the Dental Team, including in relation to confidentiality and the use of testimonials.

---

Data breach procedure

If patient records are accessed without authorisation (a cyberattack, a lost device, a misdirected email), you must:

1. Identify and contain the breach
2. Assess the likely impact on patient rights and freedoms
3. Notify the ICO within 72 hours via ico.org.uk/for-organisations/report-a-breach
4. If the breach poses high risk to patients: notify the affected patients directly
5. Document the breach and your response

Health data breaches almost always meet the notification threshold due to the sensitivity of the data involved.

NHS-contracted practices must additionally report through the DSPT incident reporting tool, which feeds the breach into NHS England's incident management framework.

---

Practical checklist for dental practices

---

Check your practice website

Free website compliance check →

---

Sources

• General Dental Council, Standards for the Dental Team
• NHS Records Management Code of Practice 2021
• ICO, UK GDPR guidance and resources
• UK GDPR Article 9, Special categories of data

---

This is technical analysis, not legal advice. Consult the GDC and a data protection specialist for specific guidance.