Dental practices hold some of the most sensitive personal data of any small business — medical records, NHS numbers, treatment histories, X-rays, and payment information.
That data is subject to both GDPR and, for NHS-linked practices, the NHS Data Security and Protection Toolkit (DSPT). In 2026, the requirements are stricter than ever — and enforcement is becoming more active.
What Data Do Dental Practices Hold?
Every patient record contains:
- Full name, date of birth, address and contact details
- NHS number (for NHS patients)
- Full medical history — conditions, medications, allergies
- Dental treatment history and clinical notes
- X-rays and other clinical images
- Payment and insurance information
This is special category data under GDPR — data relating to health — which attracts the highest level of protection and the most serious consequences for breaches.
What Are the Requirements for NHS Dental Practices?
NHS-linked practices are required to complete the NHS Data Security and Protection Toolkit (DSPT) annually. The DSPT covers ten data security standards across people, processes, and technology.
From a technology perspective, the DSPT requires:
- All devices that access NHS data to be protected and managed
- Multi-factor authentication for remote access to systems
- Regular data security training for all staff
- A process for reporting and managing data security incidents
- Backup and recovery arrangements for critical data
Practices that don’t meet DSPT requirements risk losing their NHS contract — a serious consequence for any NHS practice.
What Are the Requirements for Private Dental Practices?
Private practices are subject to GDPR and ICO requirements. As a data controller processing special category health data, you must:
- Have appropriate technical and organisational measures to protect patient data
- Conduct a Data Protection Impact Assessment for high-risk processing activities
- Report breaches to the ICO within 72 hours
- Be able to demonstrate compliance if investigated
The ICO has become increasingly active in investigating healthcare data breaches, and fines — while proportionate to the size of the business — are real.
What Are the Biggest IT Security Risks for Dental Practices?
Practice management software: Exact, Dentally, SOE, Carestream — all of these platforms hold complete patient records. If they’re not properly secured and kept up to date, they’re a significant risk.
Shared login credentials: Staff sharing a single login for the practice management system is extremely common. It makes it impossible to audit who accessed what and when — and means a compromised credential affects everyone.
Remote access: Many practices set up remote access during 2020 and haven’t reviewed the security of those arrangements since. Poorly configured remote desktop access is one of the most common entry points for attackers.
Unencrypted devices: A stolen laptop containing patient records that isn’t encrypted is a reportable breach. Encryption of all devices that hold patient data is a basic requirement.
What Should a Dental Practice Have in Place?
At minimum, in 2026:
Multi-factor authentication for all cloud services and remote access. Mandatory under Cyber Essentials and NHS DSPT.
Encrypted storage on all devices that hold or can access patient data — laptops, tablets, external drives.
Separate user accounts for each staff member in your practice management system — no shared logins.
A formal process for removing access when staff leave.
Regular backups of patient records, stored separately from your main systems and tested periodically.
A documented process for what to do if you suspect a breach.
How Onixed Ltd Helps Dental Practices
We provide IT security audits and managed IT support for dental practices across West Yorkshire. We understand both the GDPR requirements and the NHS DSPT framework, and we assess your setup against both.
Our network security audit covers your practice management system configuration, device security, remote access arrangements, backup status, and user access controls — producing a plain-English report with a prioritised action plan.
We serve dental practices across Dewsbury, Wakefield, Leeds, Bradford, Huddersfield and surrounding areas.
Free 30-minute consultation: calendly.com/onixed-support
Email: support@onixed.co.uk
Web: onixed.co.uk
Want to know where your business stands?
Book a free 30-minute IT security consultation with Onixed Ltd. No pitch, no obligation — just an honest assessment of your setup.
Book a Free Consultation →