# GDPR for Orthodontic Practices: A Plain-English Compliance Guide Publisher: Virtual Consultant Online Author: Virtual Consultant Online Published: 2026-06-21 Updated: 0001-01-01 Canonical URL: https://virtualconsultant.online/blog/gdpr-orthodontic-practices-plain-english-guide Citation metadata: https://virtualconsultant.online/citation.json?url=https%3A%2F%2Fvirtualconsultant.online%2Fblog%2Fgdpr-orthodontic-practices-plain-english-guide GDPR compliance is one of those topics that orthodontic practice owners know they need to take seriously, but which often gets pushed to the background behind clinical demands. The regulation has been in force since 2018 and the UK retained its provisions post-Brexit as UK GDPR — and yet many practices are still running on outdated consent forms, inadequate data retention policies, and unclear staff understanding of what is actually required of them. This guide is not a legal document. It is a plain-English overview of what GDPR means specifically for orthodontic practice operations, where the most common compliance gaps are, and what practical steps close them. For complex legal questions, practices should consult a specialist data protection solicitor or the Information Commissioner's Office (ICO) directly. Key takeaway GDPR for orthodontic practices centres on six areas: having a lawful basis for processing patient data, maintaining a written Record of Processing Activities (ROPA), keeping your privacy notice current and accessible, managing data subject rights requests, securing patient data appropriately, and having a documented breach response process. Most practices that are not formally compliant lack written documentation of things they already do in practice — the gap is in recording and policy, not in underlying intent. ## Why Healthcare Practices Face Higher GDPR Obligations Patient health data — including photographs of teeth and mouths, treatment records, medical histories, and anything else that relates to a patient's physical condition — is classified under UK GDPR as special category data . Special category data attracts a higher level of regulatory scrutiny and requires an additional legal basis for processing beyond the standard lawful bases available for ordinary personal data. For healthcare providers, the appropriate additional basis is typically Article 9(2)(h) — "processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment." This basis applies to your clinical records, treatment photographs, and health assessments. It does not, however, automatically extend to using patient data for marketing — that requires separate consideration. £17.5m Maximum UK GDPR fine (4% of global annual turnover or £17.5m — whichever is higher). Dental and healthcare breaches are regularly prosecuted 72hrs Maximum time after discovering a notifiable data breach to report it to the ICO — practices that miss this window face automatic penalties 1 month Time limit to respond to a Subject Access Request — missing this without good reason is a straightforward compliance failure ## The Six Core Obligations for Orthodontic Practices ### 1. Lawful basis for processing Every category of data you process needs a documented lawful basis. For an orthodontic practice, the main categories and typical bases are: Data Type Typical Lawful Basis Clinical records, treatment photographs, health history Article 9(2)(h) — healthcare provision Appointment booking and billing data Article 6(1)(b) — performance of a contract Marketing communications to existing patients Article 6(1)(f) — legitimate interests (for service updates); explicit consent for promotional content Using patient photographs in marketing Article 6(1)(a) — explicit consent (separate to clinical consent) Staff employment records Article 6(1)(b) and (c) — contract and legal obligation ### 2. Record of Processing Activities (ROPA) Every data controller must maintain a written ROPA — a document that maps what personal data you hold, why you hold it, where it comes from, where it goes, and how long you keep it. Most practices do not have a formal ROPA even though they have informal answers to all of these questions. The act of creating the ROPA forces those answers to become explicit, documented, and consistent. The ICO provides a template ROPA that can be adapted for dental practices. Creating one is typically a half-day activity for a practice with a single location, and it becomes the foundation document for all other compliance decisions. Manage patient data and consent compliantly Virtual Consultant Online handles patient consent documentation and data management within a platform built for UK orthodontic practice compliance. Learn more → ### 3. Privacy notice Your practice must have a current, accessible privacy notice that explains to patients (and staff, and enquirers) what data you hold about them, why, and what their rights are. The privacy notice must be: Written in plain language that a patient can understand Provided or signposted at or before the point of data collection (before a patient enquiry form is submitted, before clinical records are created) Available on your website and in your practice Reviewed and updated when your processing activities change ### 4. Data subject rights Patients (data subjects) have rights under UK GDPR that your practice must be able to fulfil: Right of access (Subject Access Request): A patient can request a copy of all personal data you hold about them. You must respond within one calendar month. Most practices already provide access to clinical records on request — the compliance gap is usually in having a formal SAR process and ensuring it covers all data held (emails, notes, photographs), not just the formal clinical record Right to erasure: Patients can request deletion of their personal data where you no longer have a legitimate purpose for holding it. Note: you have a legal obligation to retain clinical records for a minimum period (generally until the patient is 25, or for 10 years from last treatment for adults in private practice) — these records cannot be deleted on request during the retention period Right to object: Patients can object to processing based on legitimate interests, including marketing communications ### 5. Data security UK GDPR requires that personal data is processed securely. For orthodontic practices, this means: Patient management software protected by strong passwords and, ideally, two-factor authentication Encrypted storage for clinical photographs and sensitive data No patient data on personal (non-practice) devices without appropriate controls Staff training on data protection — this is a legal requirement, not optional Third-party processor agreements (Data Processing Agreements) with all suppliers who handle patient data on your behalf — including practice management software providers, email platforms, and cloud storage services ### 6. Breach response process A personal data breach — whether a misdirected email containing patient information, a stolen laptop with unencrypted records, or a software vulnerability — must be: Reported to the ICO within 72 hours of the practice becoming aware, if it is likely to result in a risk to individuals' rights and freedoms Communicated directly to affected patients if the breach is likely to result in a high risk to them Logged internally regardless of whether it meets the reporting threshold Having a written breach response plan — a one-page document naming who does what in the first 72 hours — means the practice is not making decisions under pressure when a breach occurs. Without one, the 72-hour reporting window is routinely missed. Important The BDA and the Information Commissioner's Office both publish guidance specifically for dental practices on GDPR compliance. The ICO also runs a free helpline for small organisations and offers a self-assessment tool at ico.org.uk. These resources are directly applicable to orthodontic practices and are the authoritative starting point for any compliance review — this article provides context only and is not legal advice. ## The Most Common GDPR Gaps in Orthodontic Practices Based on the most frequently cited areas of non-compliance identified in dental practice audits: No formal ROPA: The most common gap — practices know what data they hold but have not documented it formally Outdated privacy notice: Privacy notices written in 2018 that have not been reviewed since practice processes changed No DPAs with software providers: Using practice management software, email marketing tools, or cloud storage without Data Processing Agreements in place Conflating clinical consent with marketing consent: Using a signature on the clinical consent form as the basis for sending marketing communications — these are separate and require separate processes No staff GDPR training records: Training may have happened informally, but without a record it cannot be demonstrated to the ICO No documented data retention and deletion schedule: Practices that hold data indefinitely because no one has decided when to delete it Build Compliance Into Your Practice Operations Virtual Consultant Online is built for UK orthodontic practice compliance — from digital consent and patient documentation to secure data handling. See how it supports your compliance obligations alongside your clinical workflows. Explore the Platform → ## FAQs ### Does UK GDPR still apply after Brexit? Yes — the UK retained the GDPR framework after Brexit as UK GDPR, which is incorporated into domestic law by the Data Protection Act 2018. The substantive requirements are largely the same as EU GDPR. The Information Commissioner's Office (ICO) is the UK's supervisory authority for data protection matters and enforces UK GDPR. UK orthodontic practices must comply with UK GDPR; if the practice transfers any personal data to EU-based recipients, additional EU GDPR considerations may also apply. ### How long must an orthodontic practice keep patient records? For private orthodontic practice in England and Wales, the recommended minimum retention period for adult patient records is 10 years from the date of last treatment (or until the patient is 25 years old, if that is longer). For child patients, records should be retained until the patient turns 25 or for 10 years from last treatment — whichever is longer. These are minimums based on NHS guidance used as a reference standard; some practices retain records for longer for clinical or medico-legal reasons. Records within the retention period cannot be deleted on receipt of an erasure request — the data is processed under a legal obligation basis. ### Can we send marketing emails to patients without additional consent? You can send service-related communications (appointment reminders, treatment updates, recall reminders) to existing patients under legitimate interests without additional marketing consent. Promotional communications — newsletters, new service announcements, offers — require either explicit marketing consent or a careful legitimate interests assessment demonstrating that the patient would reasonably expect to receive this type of communication. The safest and most defensible approach is to obtain separate, explicit marketing consent from patients at registration or at a natural touchpoint during their care. ### Do we need separate consent to use patient photographs in our marketing? Yes — clinical photographs taken as part of the treatment record are processed under the healthcare basis and cannot be used in marketing without separate explicit consent. Consent to use photographs in marketing must be specific (the patient knows what they are consenting to), freely given (not linked to receiving treatment), documented, and easy to withdraw. Obtain this consent separately from the clinical consent form, and maintain a record of it. Patients who have consented to marketing use of their photographs retain the right to withdraw that consent at any time. ### What counts as a data breach for a dental practice? A personal data breach is any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to patient personal data. Examples in dental practice include: sending a patient email to the wrong address, losing an unencrypted device containing patient records, a ransomware attack on practice IT systems, or a member of staff accessing records without authorisation. Not all breaches require reporting to the ICO — only those likely to result in a risk to individuals. However, all breaches must be logged internally, and those that are reportable must reach the ICO within 72 hours of discovery. ### Does an orthodontic practice need to register with the ICO? Yes — most organisations that process personal data for purposes other than purely personal or household activities must pay a data protection fee and register with the ICO. There are a small number of exemptions, but healthcare providers processing patient data almost always fall outside them. ICO registration fees are tiered by organisation size and typically range from £40 to £60 per year for small practices. Failure to register when required is a civil offence that can result in fines. ### Does UK GDPR still apply after Brexit? Yes — the UK retained the GDPR framework after Brexit as UK GDPR, which is incorporated into domestic law by the Data Protection Act 2018. The substantive requirements are largely the same as EU GDPR. The Information Commissioner's Office (ICO) is the UK's supervisory authority for data protection matters and enforces UK GDPR. UK orthodontic practices must comply with UK GDPR; if the practice transfers any personal data to EU-based recipients, additional EU GDPR considerations may also apply. ### How long must an orthodontic practice keep patient records? For private orthodontic practice in England and Wales, the recommended minimum retention period for adult patient records is 10 years from the date of last treatment (or until the patient is 25 years old, if that is longer). For child patients, records should be retained until the patient turns 25 or for 10 years from last treatment — whichever is longer. These are minimums based on NHS guidance used as a reference standard; some practices retain records for longer for clinical or medico-legal reasons. Records within the retention period cannot be deleted on receipt of an erasure request — the data is processed under a legal obligation basis. ### Can we send marketing emails to patients without additional consent? You can send service-related communications (appointment reminders, treatment updates, recall reminders) to existing patients under legitimate interests without additional marketing consent. Promotional communications — newsletters, new service announcements, offers — require either explicit marketing consent or a careful legitimate interests assessment demonstrating that the patient would reasonably expect to receive this type of communication. The safest and most defensible approach is to obtain separate, explicit marketing consent from patients at registration or at a natural touchpoint during their care. ### Do we need separate consent to use patient photographs in our marketing? Yes — clinical photographs taken as part of the treatment record are processed under the healthcare basis and cannot be used in marketing without separate explicit consent. Consent to use photographs in marketing must be specific (the patient knows what they are consenting to), freely given (not linked to receiving treatment), documented, and easy to withdraw. Obtain this consent separately from the clinical consent form, and maintain a record of it. Patients who have consented to marketing use of their photographs retain the right to withdraw that consent at any time. ### What counts as a data breach for a dental practice? A personal data breach is any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to patient personal data. Examples in dental practice include: sending a patient email to the wrong address, losing an unencrypted device containing patient records, a ransomware attack on practice IT systems, or a member of staff accessing records without authorisation. Not all breaches require reporting to the ICO — only those likely to result in a risk to individuals. However, all breaches must be logged internally, and those that are reportable must reach the ICO within 72 hours of discovery. ### Does an orthodontic practice need to register with the ICO? Yes — most organisations that process personal data for purposes other than purely personal or household activities must pay a data protection fee and register with the ICO. There are a small number of exemptions, but healthcare providers processing patient data almost always fall outside them. ICO registration fees are tiered by organisation size and typically range from £40 to £60 per year for small practices. Failure to register when required is a civil offence that can result in fines. ## References - UK Information Commissioner's Office — Guide to UK GDPR (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources) - The authoritative reference for UK GDPR compliance requirements from the UK's data protection regulator. Includes specific guidance for healthcare providers, template documents (including ROPA templates), and a self-assessment tool for small organisations. - British Dental Association — GDPR for Dental Practices (https://www.bda.org/advice/gdpr) - BDA guidance specifically for dental practices on GDPR obligations, including data retention periods, consent requirements for different types of data processing, and specific issues relevant to dental healthcare providers. - NHS England — Records Management Code of Practice 2021 (https://www.nhsx.nhs.uk/information-governance/guidance/records-management-code/) - NHS records management guidance setting out minimum retention periods for healthcare records. While primarily for NHS practice, the retention periods are widely used as a reference standard by private dental and orthodontic practices for their own retention policies. - UK Information Commissioner's Office — Guide to UK GDPR (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources) - The authoritative reference for UK GDPR compliance requirements from the UK's data protection regulator. Includes specific guidance for healthcare providers, template documents (including ROPA templates), and a self-assessment tool for small organisations. - British Dental Association — GDPR for Dental Practices (https://www.bda.org/advice/gdpr) - BDA guidance specifically for dental practices on GDPR obligations, including data retention periods, consent requirements for different types of data processing, and specific issues relevant to dental healthcare providers. - NHS England — Records Management Code of Practice 2021 (https://www.nhsx.nhs.uk/information-governance/guidance/records-management-code/) - NHS records management guidance setting out minimum retention periods for healthcare records. While primarily for NHS practice, the retention periods are widely used as a reference standard by private dental and orthodontic practices for their own retention policies.