GDPR for dental practices

GDPR applies to a dental practice because it holds personal information about patients and staff, including health records. In practice that usually means paying the data protection fee to the Information Commissioner’s Office (ICO) unless you are exempt, telling patients how you use their information, keeping it only as long as you need it, and knowing what to do about a breach or a request for records.

The law here is the UK GDPR and the Data Protection Act 2018. The ICO notes that some of its guidance is under review following the Data (Use and Access) Act, so check its current pages. For a decision about your own practice, ask a data protection adviser or solicitor.

ICO registration for a dental practice

What people usually mean by ICO registration is paying the data protection fee. The ICO says organisations, including sole traders, that use personal information need to pay a data protection fee, unless they are exempt.

Its self assessment tells you whether you need to pay and how much. It takes about 10 minutes. If associates or other clinicians at your practice handle patient information on their own account, ask your adviser whether they need to pay separately.

Why health records need extra care

Health information is special category data under the UK GDPR, and the ICO says the special categories are framed broadly. It says health data can be about a person’s past, current or future health status, and covers specific details of medical conditions, tests or treatment. So a dental chart and a medical history form both count. The ICO says this kind of data carries more risk than other personal data, and you need a valid condition for handling it, as well as a lawful basis.

Do you need a data protection officer?

Under the UK GDPR, you must appoint a data protection officer (DPO) if:

you are a public authority or body, which needs particular care if you hold an NHS contract (see below)
your core activities need large-scale, regular and systematic monitoring of individuals
your core activities consist of large-scale processing of special category data or criminal offence data

For a private practice, the usual question is whether its processing counts as large scale. The ICO doesn’t give a number. It lists factors to consider: the number of people, the volume of data, the range of data, the geographical extent and how long or permanent the activity is.

Recital 91 of the UK GDPR’s source text says processing should not be considered large scale if it concerns patient data handled by an individual physician or other health care professional. That recital is about data protection impact assessments rather than DPOs, so treat it as a guide to what “large scale” means. A single-handed dentist is therefore in a different position from a group with many sites and a shared patient database. Anything between those two needs a judgement.

If you hold an NHS contract

For UK GDPR purposes, a public authority includes one as defined by the Freedom of Information Act 2000, and that Act’s list includes a person providing primary dental services under NHS arrangements or contracts, in respect of information relating to those services. The UK GDPR meaning applies only when performing a task carried out in the public interest or in the exercise of official authority. An NHS or mixed practice should therefore ask a data protection adviser whether it needs a DPO on this ground, rather than assuming the large-scale test is the only one.

The ICO says that if you decide you don’t need a DPO, it’s a good idea to record this decision. You can appoint a DPO voluntarily, but the same requirements of the position then apply.

What to tell patients and staff

The ICO sets out what privacy information you must always provide when you collect personal data from someone. It includes:

the name and contact details of your organisation
the purposes of the processing and the lawful basis for it
how long you will keep the data, or the criteria you use to decide
people’s rights, including the right to complain to the ICO

How long to keep records

The ICO says you must not keep personal data for longer than you need it, that you need to be able to justify how long you keep it, and that you need a policy setting standard retention periods wherever possible. Your indemnity provider can advise on how long to keep clinical records.

If there is a data breach

The ICO says that if a risk to people is likely, you must notify it as soon as possible, and where feasible within 72 hours. If the risk to people is high, you must also notify those people without undue delay. An email containing patient details sent to the wrong address is the kind of event to assess straight away. The ICO provides a self-assessment tool, and it says you should report what you know even if the picture is not yet complete.

If a patient asks for their records

A request for someone’s own information is a subject access request. The person does not have to use those words, and it just needs to be clear they are asking for their personal information. You must respond without undue delay and at the latest within one month. That period can be extended by two further months in some cases, such as a complex request.

The ICO has specific guidance on health information, including when serious harm rules can apply and who counts as the appropriate health professional.

Where CQC comes in

CQC’s mythbuster on dental care records says it may ask to see parts of a dental record during an inspection, and that it has powers under the Health and Social Care Act 2008 to access dental records for its functions, balanced against its data protection responsibilities.

If you hold an NHS contract, check what it requires on data security. Our page on the Data Security and Protection Toolkit covers that check. A short set of written policies makes much of this easier, and our page on dental practice policies explains how they fit together.

Compliance UK’s policy pack has about 30 templates that you can adopt, review and have the team read and sign, and you can see who has signed.

Sources

Sources checked on 10 November 2026.

GDPR for dental practices: what you need in place