We run a dental clinic – what do we need to put in order under the GDPR?

The Article 6 basis for the patient record depends on the situation: the contract with the patient (point (b)) or a legal obligation where health care legislation requires the record to be kept (point (c)). Which documents to keep and for how long is set by health care legislation – this page does not cover it; enter the period in your record according to that legislation.

Article 9(1) GDPR prohibits processing health data, but Article 9(2)(h) makes an exception where it is necessary for medical diagnosis, the provision of health care or treatment, on the basis of Union or Member State law or under a contract with a health professional. The condition is in Article 9(3): the data are processed by a professional subject to an obligation of professional secrecy under Union or Member State law or rules set by national competent bodies, or under that professional's responsibility, or by another person also subject to an obligation of secrecy under such law or rules.

In practice this means:

1. Do not use GDPR consent as the basis for processing treatment data. Consent can be withdrawn (Article 7(3) GDPR), while the record is still needed for treatment. So rely on Article 9(2)(h) for treatment data, not on consent. This does not affect the patient's consent to the treatment procedure itself, which is governed by health care legislation, not by the GDPR, and which this page does not cover.
2. Reception staff and assistants – our recommendation: set out that they work with patient data on the dentist's instructions and under the dentist's responsibility (the second limb of Article 9(3)), and write a confidentiality duty into their job description or employment contract. A contract clause does not by itself create a professional-secrecy obligation within the meaning of Article 9(3); it helps show that the work is done under the dentist's responsibility.
3. Limit access by role: reception sees the appointment calendar, not the X-rays.
4. The dental laboratory or the X-ray software supplier – check whether they process data on your instructions (a processor) or for their own purposes, and make the contract accordingly; with a processor it is mandatory (Article 28(3) GDPR).

Not always. Article 35(3)(b) GDPR makes an assessment required where special category data are processed "on a large scale". Recital 91 GDPR says: "The processing of personal data should not be considered to be on a large scale if the processing concerns personal data from patients or clients by an individual physician, other health care professional or lawyer."

So for an individual dentist's practice an assessment of patient records under Article 35(3)(b) is usually not needed. For a clinic where several dentists work in one shared patient system, recital 91 no longer applies on its own terms: assess the large-scale question by the number of patients, the volume of data, the duration and the geographical extent of the processing (Article 29 Working Party guidelines WP243, endorsed by the EDPB). This matters most for a chain of clinics. Our recommendation: write one sentence in the record explaining why you consider the processing not to be large-scale.

But note: the VDAI list makes an assessment mandatory for other clinic processes – above all video surveillance (see cameras below).

Where the patient can be identified – only with their explicit consent. A photo showing the condition of the teeth and the result of treatment reveals information about health, so it is to be treated as data concerning health (Article 4(15) GDPR). Article 9(2)(h) does not fit marketing – it is for treatment. That leaves Article 9(2)(a). If the person can be recognised in the photo – above all where the face is visible – Article 2.22(1) of the Civil Code (CK) also applies: a person's photograph may be displayed only with their consent.

How to set it up:

• A separate consent form, not in the treatment contract: which photos, where they will be published (website, social media, a conference), whether the face will be visible.
• Choices: "teeth only, no face" and "with face" – separately.
• Proof: a signed form or a record in the system with the date (Article 7(1) GDPR).
• Withdrawal: the patient may withdraw at any time (Article 7(3)); then remove the photo from your website and accounts.
• Photos from the patient record – our recommendation – do not use them for marketing without this consent, even if the face is not visible.

A reminder of an appointment already booked is not direct marketing. Article 2(1) of the Law on Legal Protection of Personal Data (ADTAĮ) defines direct marketing as activity aimed at offering goods or services to persons. A reminder offers nothing – it helps perform the contract, so the consent rule in Article 81 of the Law on Electronic Communications (ERĮ) does not apply to it.

A message such as "time for your check-up – book now with a discount" is different. It offers a service, so in our view it is marketing. It may be sent with prior consent (Article 81(1) of the Law on Electronic Communications, ERĮ). By e-mail you may also rely on the own-customer exception, where you obtained the address while providing a service, you offer your own similar services and the patient can object both when the address is collected and in every message (Article 81(2) ERĮ). The exception speaks of electronic mail contact details; Article 3(12) ERĮ treats a text message as an electronic mail message too, but whether the exception covers a phone number is unclear – so for SMS advertising it is safest to have consent. Do not mix the two in your reminders.

The same goes for a "rate your visit" message: Article 2(1) ADTAĮ also counts asking people's opinion about the goods or services offered as direct marketing.

At reception, at the entrance and in the corridor a camera is usually based on a legitimate interest in protecting property and people (Article 6(1)(f) GDPR). In examination and treatment rooms – no. Paragraph 37 of EDPB Guidelines 3/2019: monitoring is not to be expected in examination and treatment rooms.

Be careful in the waiting area, where patients sit and wait for treatment: paragraph 38 of EDPB Guidelines 3/2019 says that in places used for treatment and places where people stay or communicate, people's interests will often override the controller's legitimate interest. Film the entrance and the reception desk, not the seating.

Where cameras cover the reception or corridor, the clinic has two further duties besides the usual information for patients (a sign at the entrance and full information under Article 13 GDPR):

• An impact assessment. Item 6.2 of the VDAI list covers video surveillance in health care, social care and prison institutions, and item 10 covers monitoring of employees, including video data processed on premises where employees work. Carry out the assessment before switching the cameras on (Article 35(1) GDPR).
• Informing staff by signature or another way that proves it, giving all the information in Article 13(1) and (2) GDPR (Article 5(4) ADTAĮ).

Point the reception camera so that it does not see the screen with patient data.

No. The Article 30(5) GDPR exemption for enterprises employing fewer than 250 persons does not apply where the processing includes special categories of data. Health data are such data. In the record, enter the processes from the table with the purpose, the categories of patients and data, the basis, recipients (laboratory, software supplier), the retention period under health care legislation, a description of security measures and a note of whether an impact assessment was done (Article 30(1) GDPR).

This week, check whether the before-and-after photos on your website have signed consents; if not, take them down until you have consent. With the tool (in Lithuanian) you can find out free of charge whether you must keep a record of processing activities and which processes carry risk. An impact assessment for video surveillance can be ordered as a one-off procedure – €95 excl. VAT per process; video surveillance documents – €195 excl. VAT. We prepare record templates by sector, including for dental clinics.

Can a patient demand that we delete their record?
Where the law requires the record to be kept, the right to erasure does not apply to the extent that processing is necessary to comply with that legal obligation (Article 17(3)(b) GDPR). If you refuse erasure, reply to the patient without delay and within one month at the latest (Article 12(4) GDPR): explain why the record is kept and until when, and tell them they may lodge a complaint with the VDAI and seek a judicial remedy.

May we publish a before-and-after photo without the face and without consent?
If the patient cannot be identified at all from the photo and its caption, it is not personal data (Article 4(1) GDPR). But relatives often recognise teeth, a smile or a distinctive treatment, and captions often carry a name or a date. So the safest course is explicit consent under Article 9(2)(a) GDPR.

Does a camera at reception record health data?
Usually not, but a camera in a health care institution still falls under item 6.2 of the VDAI list, so an impact assessment is needed.

May we send the appointment reminder through a messaging app?
Our recommendation: only if the patient chose that channel, and do not name the procedure in the message. Enter the app in the record as a recipient or processor and check where it stores data.

• When is a data protection impact assessment needed? (in Lithuanian)
• A data protection impact assessment step by step
• Can we film our premises and grounds? (in Lithuanian)
• Consent to process data: how to ask for it and prove it
• A sports club and the GDPR

The law and the risk: Data protection impact assessment: what it consists of, how long it takes and how much work it needs from you – dat.lt

• Personal data and data concerning health – Article 4(1) and 4(15) GDPR.
• Prohibition and exceptions: explicit consent, health care – Article 9(1), 9(2)(a) and 9(2)(h) GDPR; professional secrecy – Article 9(3).
• Consent, contract, legal obligation, legitimate interest – Article 6(1)(a), (b), (c) and (f) GDPR.
• Proof and withdrawal of consent – Article 7(1) and 7(3) GDPR.
• Reply on refusal and the erasure exception – Article 12(4) GDPR; Article 17(3)(b).
• Processor contract – Article 28(3) GDPR; record contents – Article 30(1).
• Large-scale factors – Article 29 Working Party guidelines WP243 (endorsed by the EDPB).
• The concept of an electronic mail message – Article 3(12) of the Law on Electronic Communications (ERĮ).
• Information for staff – Article 13(1) and 13(2) GDPR; informing by signature – Article 5(4) of the Law on Legal Protection of Personal Data (ADTAĮ).
• Limits of the record exemption – Article 30(5) GDPR.
• Impact assessment – Article 35(1) and 35(3)(b) GDPR; individual physicians are not large-scale – recital 91 GDPR.
• When an assessment is mandatory in Lithuania – VDAI Director's order No 1T-35 (1.12.E) of 14 March 2019, list items 6.2 and 10.
• The concept of direct marketing – Article 2(1) of the Law on Legal Protection of Personal Data (ADTAĮ); marketing by e-mail and SMS – Article 81(1) and 81(2) of the Law on Electronic Communications (ERĮ).
• Right to one's image – Article 2.22(1) of the Civil Code (CK).
• Cameras in examination and treatment rooms and the waiting area – EDPB Guidelines 3/2019, paragraphs 37 and 38.

Legal texts checked on 2026-09-25: GDPR – official consolidated English text (OJ L 119, 4.5.2016) with corrigenda; ADTAĮ – e-tar.lt edition from 2026-06-30; ERĮ – from 2026-07-01; CK – from 2026-07-31; VDAI order No 1T-35 – current version (Lithuanian only; its wording here is our translation). This text is general information and is not individual legal advice.