GDPR Compliance for Dental Software in the UK

Why dental software is high-risk for GDPR

Dental records are special category data under UK GDPR Article 9 — they reveal health information. This raises the regulatory bar: lawful basis requires explicit patient consent OR a vital interest / medical purposes exemption; security expectations are higher; breach consequences are more severe.

Every dental software application that processes patient identifiable data — PMS (Dentally, SOE Exact, R4), notes apps, AI scribes, patient communication tools (SMS, email), online booking, social media schedulers handling patient enquiries — falls under this regulatory regime. You as practice owner are the Data Controller. Every vendor is a Data Processor.

The Data Processing Agreement (DPA)

A written Data Processing Agreement is LEGALLY REQUIRED between you (Controller) and any third party (Processor) handling patient data on your behalf. UK GDPR Article 28. No DPA = no lawful basis to share patient data with the vendor.

• Identifies what data is processed
• Specifies the lawful basis and purpose
• Lists sub-processors (the vendor's third parties — AI providers, hosting, etc.)
• Documents security measures (encryption, access controls, training)
• Defines breach notification timeline (vendor to you within 24-72h)
• Sets data retention and deletion procedures
• Confirms data location (UK/EEA or valid transfer mechanism)

Patient consent for dental software

Most dental data processing relies on the "necessary for medical purposes" exemption (UK GDPR Article 9(2)(h)) rather than consent. This means routine PMS and notes app use doesn't require explicit patient consent — but you must document the lawful basis in your privacy notice.

AI scribes that record patient speech are a different matter. Best practice (and increasingly required): obtain explicit patient consent before recording. Verbal consent at appointment start is acceptable if documented in the note: "Patient consented to AI-assisted note-taking at start of appointment." Refusal must be respected without affecting their care.

Data location: UK, EEA, or international?

Where the data physically sits matters. UK GDPR allows transfer to:

• UK or EEA: free movement, no extra mechanism needed
• Countries with UK adequacy decision (Japan, South Korea, NZ, etc.): free movement
• USA / others: requires Standard Contractual Clauses (SCCs) or other valid transfer mechanism, plus transfer impact assessment

Many AI scribes use US-based AI providers (OpenAI, Anthropic). This is acceptable IF the vendor has documented SCCs and you've completed a transfer impact assessment. Ask vendors: "Where is patient data processed and stored? What's your transfer mechanism for non-UK/EEA processing?"

Security expectations

UK GDPR Article 32 requires "appropriate technical and organisational measures." For healthcare-grade software, expect:

• Encryption in transit (TLS 1.2+) AND at rest (AES-256)
• Multi-factor authentication available for all users
• Role-based access controls
• Audit logging of access to patient data
• Documented security certifications: ISO 27001, SOC 2, Cyber Essentials Plus (UK government standard)
• Annual or more frequent penetration testing
• Vulnerability disclosure programme
• Incident response plan with breach notification process

Breach notification — your 72-hour obligation

If your dental software suffers a breach involving patient identifiable data, you have 72 hours from awareness to notify the ICO. Late notification compounds the regulatory consequence. The vendor's DPA should require them to notify you immediately (typically 24-48h) so you can meet your own deadline.

The pragmatic GDPR checklist for dental practices

1. Maintain a register of all software processing patient data (PMS, notes app, AI scribe, communications, booking).
2. Have a written DPA with every vendor on that list. No DPA = stop using until obtained.
3. Confirm UK/EEA data location OR valid transfer mechanism for each.
4. Document security certifications for each vendor (ISO 27001, SOC 2, Cyber Essentials Plus).
5. Update privacy notice to list all data processors and your lawful basis for each.
6. Obtain explicit consent before AI scribes that record patient speech.
7. Train staff annually on data handling, breach recognition, and reporting procedures.
8. Test breach response process annually — table-top exercise.
9. Verify backup + deletion processes meet your retention policy.
10. Review the data register annually and on adding any new software.

Where Nosht fits

Nosht is architected to minimise GDPR exposure: no patient identifiable data is stored on Nosht servers. The structured note is generated in-browser and copied directly to your PMS — the patient name, DOB, and clinical detail never leave your PMS environment. This means your DPA scope is minimal and the breach notification surface is small.

Standard certifications: Cyber Essentials Plus, ICO-registered Data Controller for Nosht's own data, UK/EEA data hosting (Supabase EU + Netlify EU), encrypted at rest and in transit, SOC 2 Type 1 in progress.

Do I need a separate DPA with each software vendor?

Yes. Each Data Processor (vendor handling patient data on your behalf) needs its own written DPA. The vendor usually has a template; if they don't have one, that's a red flag for vendor maturity. Common omissions: communication platforms, online booking systems, accountants accessing patient lists.

Can I use US-based dental software in the UK?

Yes IF the vendor has appropriate UK GDPR cross-border transfer mechanisms (Standard Contractual Clauses + transfer impact assessment) and meets UK security expectations. Many US vendors have UK/EEA subsidiaries or compliant data centres. Ask explicitly about UK/EEA data residency vs international transfer.

What about patient consent for AI scribes?

Best practice is explicit consent (verbal or written) before recording patient speech. Document the consent in the note ("patient consented to AI-assisted note-taking"). Refusal must not affect care. Some practices include AI consent in their general practice consent forms; others ask per appointment. Either is acceptable if documented.

What's the ICO fine for a dental practice breach?

ICO fines start at around £8,500 for smaller breaches and can reach £17.5 million (or 4% of annual turnover for businesses) under UK GDPR. Real-world dental practice fines have typically been in the £5,000-£100,000 range. The reputational damage often exceeds the financial fine.

Is encryption required by GDPR?

GDPR Article 32 requires "appropriate" security measures — encryption is widely considered necessary for special category data like dental records. Practically: TLS 1.2+ for data in transit, AES-256 for data at rest. Vendors that don't encrypt patient data should be rejected.

Do I need to be ICO-registered?

Yes — every UK dental practice processing patient personal data must register with the ICO and pay the annual data protection fee (£40-£2,900 depending on practice size). This is separate from CQC registration. Without it, you can't lawfully process patient data and risk additional ICO action.