Dental practices handle some of the most sensitive personal data in any professional context — health records, treatment histories, financial information, and increasingly, biometric data from digital imaging. GDPR compliance is both a legal requirement and a patient trust signal.
The six documents every dental practice needs
1. Data processing agreement (Auftragsverarbeitungsvertrag, AVV) with every external service provider who processes patient data — your billing service, your PMS vendor, your cloud storage provider, your email marketing platform.
2. A record of processing activities (Verarbeitungsverzeichnis) that documents what data you hold, where it is stored, who has access, and for how long.
3. A data protection policy for patients explaining what data you collect, why, and how they can exercise their rights.
4. Staff data protection briefing records showing that every team member has been trained on data handling rules.
5. A breach response plan that defines who is responsible and what steps to take within the 72-hour reporting window if a breach occurs.
6. A data deletion schedule documenting how long each category of patient record is retained before secure deletion.
Common GDPR mistakes in dental practices
The most frequent violations we see: WhatsApp used for patient communication without consent, patient data sent via unencrypted standard email, no AVV signed with the billing service, and patient photos stored in personal phone gallery apps without data processing agreements.