Patient data in dental practices falls under the strictest GDPR protections. Here's what you actually need to do — without the legal jargon.
Claire Dubois
Déléguée à la Protection des Données
Points clés
Dental health data is 'special category' under GDPR Article 9 — violations can reach €20M or 4% of turnover
You must respond to patient data access requests within 30 days and support data deletion
You have only 72 hours to notify your Data Protection Authority after a breach
Software handles the technical compliance — staff training and privacy policies remain your responsibility
Dental records contain health data — a "special category" under GDPR Article 9. This means the bar for compliance is higher than for regular personal data. Violations can result in fines up to €20 million or 4% of global turnover.
This isn't a reason to panic. Most compliance requirements are straightforward once you know what they are.
List every place patient data is stored (paper, software, email, cloud)
Document what data you collect and why (legal basis)
Know how long you retain records and when you delete them
Most EU countries require dental records to be kept for 10 years after the last treatment.
You must be able to:
Provide a patient all their data within 30 days of request
Delete data when legally permitted
Explain in plain language how you use their data (privacy notice)
Encrypt all data at rest and in transit (TLS 1.3+)
Log who accessed what and when (audit trail)
Support data export in a portable format
Have a signed Data Processing Agreement with you
All staff who touch patient data must be trained on:
Not sharing login credentials
Recognising phishing emails
What to do if a breach occurs (you have 72 hours to notify your supervisory authority)
Have a written plan. When a breach occurs, you must notify your national Data Protection Authority within 72 hours and affected patients if there's high risk to them.
DentinCloud provides automatic audit logs, full data export in portable formats, and includes data processing documentation for all EU clinics. This covers the technical side of compliance.
The organisational side — staff training, privacy notices, breach response procedures — remains your responsibility as the data controller.
GDPR compliance for a dental clinic is achievable in a weekend with the right software and a clear checklist. The fines for non-compliance vastly outweigh the effort required.
Prêt à moderniser votre cabinet ?
Essayez toutes les fonctionnalités Pro gratuitement pendant 14 jours. Commencez immédiatement, sans carte de crédit.
S'inscrire gratuitementClaire Dubois
Déléguée à la Protection des Données
