Yes, dental practice staff can use AI tools under UK GDPR, but only for tasks the practice has decided on and documented. Before anyone puts patient information into a tool, the practice needs a lawful basis for the task, a processor contract with the vendor, a data-protection impact assessment where the use is high-risk, and a written approved-tools list.
Most dental GDPR guidance was written before staff had a chatbot open in the next tab. It covers records, consent for marketing and subject access requests, and says nothing about whether the hygienist can paste a clinical note into an AI tool at lunchtime. The list below fills that gap: staff AI uses sorted into allowed, conditional and banned, with the paperwork behind each. It is practical guidance and not legal advice: have your data-protection adviser or your indemnity provider confirm how it applies to your practice.
What the General Dental Council has and hasn't said
At the time of writing I could not find dedicated AI guidance from the General Dental Council (GDC) for dental teams. Three things it has done are on its own website. In September 2026 it signed a joint statement of intent with the Professional Standards Authority and other health and social care regulators, committing them to develop a set of high-level principles for how they will regulate the use of AI. In October 2026 it published research on AI in dental education and said it would consider the report's recommendations. And its consultation on a new Framework for Professionalism, which would replace the Standards for the Dental Team with four principles backed by expectations and guidance, ran from 2 June to 31 August 2026. So the position is: no AI-specific rulebook yet, but the existing standards on confidentiality, record-keeping and professional judgement apply to any work an AI tool helps with. A dentist remains answerable for a note the dentist signs, whoever drafted it.
That gap makes your own written rules more important, not less. Regulators and patients will judge the practice on what it decided and recorded.
The four pieces of paper that come before any AI tool
1. A lawful basis (Article 6) and a health-data condition (Article 9)
Every use of personal data needs a lawful basis under Article 6 of UK GDPR. Patient records also count as special category data because they relate to health, so you need a second condition under Article 9. For care delivery, practices commonly rely on the health or social care condition in Article 9(2)(h), which applies when the data is handled by or under the responsibility of a professional bound by confidentiality. The Article 6 basis for a private practice is often contract (providing the treatment the patient has asked for) or legitimate interests, depending on the task. The point for staff is that the basis attaches to a purpose, not to a tool. "Providing care" may justify a clinical note. It does not automatically justify using patient messages to train a marketing chatbot. Ask your adviser to record the basis for each AI task in your records of processing.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy now2. A processor contract (Article 28)
If a vendor handles patient data on your behalf, it is a processor, and Article 28 requires a written contract. It sets out that the vendor acts only on your documented instructions, binds its staff to confidentiality, keeps the data secure, uses sub-processors only with your prior written authorisation, helps you meet patient rights, deletes or returns data at the end, and gives you the information you need to show compliance, including audits. Good vendors publish a standard data-processing agreement. Free consumer plans generally do not offer one for your practice, which is why they sit in the "no patient data" column below. If the vendor sends data outside the UK, the transfer needs its own safeguards, so ask where processing happens.
3. A data-protection impact assessment (Article 35)
An impact assessment (DPIA) is a written risk assessment you complete before starting processing that is likely to be high risk. Article 35 names new technologies as a particular concern, says large-scale processing of special category data always needs one, and has the regulator publish a list of other processing that does. A small practice may not be processing at large scale, but new technology combined with health data tends to trigger one anyway. An AI scribe or receptionist that handles patient audio or messages is a safe candidate for a DPIA; a tool used to reword a staff rota is not. If you are unsure, do the assessment, because it is quicker than defending its absence. For a worked example, see the AI DPIA template for a receptionist, and for the decision itself do you need a DPIA before using AI tools.
4. An approved-tools list and a privacy notice that matches
Patients are entitled to be told how their data is used. If your privacy notice does not mention AI-assisted note taking, call handling or messaging, update it before the tool goes live. Keep the notice factual: what the tool does, why, who the vendor is, and how a patient can object. The approved-tools list, covered below, is the operational half of the same job.
Which staff AI uses are allowed, conditional or banned
| Use | Status | Why, and the condition |
|---|---|---|
| Reword a staff newsletter, write a job advert, plan a team meeting | Allowed | No patient data. Any account is fine. |
| Generic patient leaflet wording with no patient detail | Allowed | Clinician reviews before use. |
| Reply templates for patient emails, with placeholders | Allowed | Draft with placeholders, add names in the practice system. |
| AI scribe for consultations | Conditional | Processor contract, DPIA, patient notice, clinician reviews every note. |
| AI receptionist or call handler | Conditional | Processor contract, DPIA, disclosure that the caller is speaking to an AI, escalation rules. |
| Recall and reminder messaging with AI wording | Conditional | Lawful basis recorded; separate marketing consent rules apply to promotional messages. |
| Radiograph or image analysis tools | Conditional | Treated as clinical software; check regulation of the product, the contract and clinical oversight. |
| Pasting patient notes, names or images into a free chatbot | Banned | No contract, no control over retention or training. |
| Uploading the patient list to build a mailing or "analysis" | Banned | Excess disclosure; wrong purpose and no contract. |
| Letting AI decide treatment or what to tell a patient without clinician review | Banned | Professional responsibility stays with the clinician. |
Worked example: a four-surgery practice sets its rule
This is an illustration with invented details. A practice with four surgeries, eleven clinical staff and four reception and admin staff runs a survey of what tools people already use. Results: two dentists use a free chatbot to rewrite letters, a hygienist uses a phone app to dictate notes, reception uses an AI phrase tool built into the email system, and the practice manager has trialled a scribe on her own.
The owner and practice manager make four decisions in one 90-minute meeting. First, the free chatbot stays, for tasks with no patient data only. Second, the dictation app is stopped until its contract and data location are checked, because it has no business terms. Third, the email phrase tool is allowed after the practice manager confirms its terms with the email vendor: it is covered by the existing processor contract. Fourth, the scribe trial goes ahead as a formal pilot with two clinicians, a DPIA written first, and a patient notice added to the reception screen and website.
The deliverables are modest: a one-page approved-tools list, a three-page DPIA for the scribe, an updated privacy notice, and a staff reminder. Total time is perhaps two working days spread across a month. That is the real cost of "GDPR for AI" in a small practice: a few documents, not a legal department.
An approved-tools list you can copy
| Tool | Approved for | Patient data? | Contract and DPIA | Owner |
|---|---|---|---|---|
| Free chatbot (staff accounts) | Leaflets, adverts, templates with placeholders | No | Not needed | Practice manager |
| Email system's built-in drafting | Reply drafts | Only within the email system, per its terms | Covered by existing agreement, checked on [date] | Practice manager |
| Scribe (pilot) | Consultation notes, two clinicians | Yes | Processor contract signed [date]; DPIA reviewed [date] | Principal dentist |
| AI receptionist | Not approved | - | Pending contract | Practice manager |
Review it every quarter and whenever a vendor changes its terms or adds an AI feature. A new feature in software you already use can change the position without anyone noticing, so ask each vendor to tell you in writing when that happens.
Four situations staff will actually meet
The dictated note. A dentist wants to dictate into a phone app. Check whether the app sends audio to a vendor, whether it offers a business contract, and where data is processed. If none of that is clear, it fails the test and she keeps typing or uses the practice-approved scribe.
The anxious patient email. A patient writes about a painful extraction. The receptionist wants help with a kind reply. She pastes in the first line with the name removed and asks for a tone suggestion, then writes the reply herself. Better: she asks for a general reassurance template, then adds the patient detail in the practice system. Either way, nothing identifying leaves the practice.
The marketing idea. The owner wants AI to find lapsed patients and write messages. Using the practice's own system's reminder features is one thing, and the rules on electronic marketing and consent are another; do not upload a patient list into a general tool to do it. The tutorial on recalls and reminders with AI shows how to do it inside your own software.
The subject access request. A former patient asks for their records. Staff must not paste the full record into a chatbot to summarise it for the response, because that is a new disclosure to a vendor. Do the collation in the practice system, and if you use AI for redaction help, only a tool with the contract in place.
A filled-in DPIA summary for a scribe pilot
A DPIA does not need to be long. This extract is illustrative and shows the shape a short one takes for a two-clinician scribe pilot.
| Section | Entry |
|---|---|
| Purpose | Draft clinical notes from consultation audio so clinicians spend less time typing; clinician reviews and signs every note. |
| Data involved | Audio of consultations, transcript text, patient name and clinical details spoken aloud (health data). |
| Lawful basis and condition | Provision of care; health or social care condition for health data; recorded by principal dentist on [date]. |
| Vendor and role | Processor; standard data-processing agreement signed; sub-processors listed and reviewed. |
| Retention | Audio deleted after transcription per vendor settings; transcript kept only until the clinician files the note. |
| Risks | Wrong note content; a recording picks up another patient; data processed outside the UK; clinician over-trusts the draft. |
| Measures | Mandatory review before filing; microphones only in the consulting room; confirm processing location in contract; monthly audit of three notes; patient notice and opt-out. |
| Decision | Proceed with a three-month pilot; review on [date]. |
The strongest part of any DPIA is the "risks and measures" pair. Each risk needs a named measure that a person actually performs, such as "monthly audit of three notes", rather than "staff will be careful".
What a patient notice sentence can look like
Patients read short, plain statements. A sentence for the website and the reception screen might read: "We use an AI note-taking tool in some appointments. It records the conversation to help your clinician write notes, which your clinician checks before they go in your record. The tool's provider acts only on our instructions. If you would prefer we did not use it, tell us and we will write your notes in the usual way." Have your adviser confirm the wording suits your lawful basis. The tone matters: patients who feel the practice was open rarely object, and those who discover it later often do.
A before and after for reception wording
Here is a front-desk example showing how to get help without sending patient detail.
Before (banned): "Write a reply to Mrs [real surname], who had a root canal on the 12th and is now in pain and wants her money back." This puts a name, a treatment and a complaint into an unapproved tool.
After (allowed): "Write a warm, brief reply from a dental practice to a patient who is in pain after a procedure and is unhappy about the fee. Offer an urgent review slot and explain a manager will phone within one working day. Leave [first name] and [appointment details] as placeholders."
The model returns a draft with the placeholders intact. The receptionist fills in the name and details in the email system, where the data already lives. The time saving is nearly the same, and the risk drops to almost nothing. An illustrative output often over-apologises or promises something the practice cannot keep, such as a refund, so the manager removes any promise before sending.
A short staff policy you can adapt
AI USE AT [PRACTICE] - STAFF RULE
1. Use only the tools on the approved list.
2. Never enter patient names, contact details, records, images, appointment details or any combination that could identify a patient into a tool that is not approved for patient data.
3. Draft with placeholders. Add patient details inside the practice system.
4. Clinicians check every AI-drafted note before it goes in the record. You are responsible for what you sign.
5. Tell [role] before you try a new AI tool, or turn on an AI feature in existing software.
6. If you think patient data went somewhere it should not, tell [role] immediately. Early reports are always better than late ones.Rule 5 matters because the biggest risk in practice is not the tool you chose but the one a colleague quietly switched on. For rollout tactics, see GDPR and AI tools for a small business.
What to ask a dental software vendor in writing
- Will you sign a data-processing agreement covering patient data, and can we see it before we buy?
- Where is data processed and stored, and which sub-processors can access it?
- Is our content used to train or improve any model, and is that off by default?
- How long do you keep audio, transcripts and logs, and can we set or confirm deletion?
- How do you help us respond to a patient's request for their data, or to delete it?
- What happens when a clinician leaves the practice? Who owns the data in that account?
How to check your controls actually work
- Ask staff, without blame, what they used last month. Compare with the approved list. Differences are your risk register.
- Test a vendor claim. If a scribe says it does not keep audio, ask for the retention setting in writing and see it in the admin screen.
- Review three random AI-assisted notes against the recording or the clinician's memory, and log any errors.
- Check the patient notice mentions every AI tool that touches records, and that front-desk staff can explain it in one sentence.
- Plan for an incident. If someone pastes patient data into the wrong tool, who is told the same day, and who decides whether the breach must be reported to the regulator? Unless it is unlikely to put patients at risk, UK GDPR expects that report without undue delay and, where feasible, within 72 hours of the practice becoming aware of it. Write the names down.
Keeping the paperwork alive after launch
The documents above go stale quickly. Put three dates in the practice calendar: a quarterly review of the approved list, an annual re-read of each vendor agreement, and a check whenever a software update announces an AI feature. Keep the signed contracts, the DPIA and the dated screenshots of settings in one folder that the practice manager and principal can both open. If the regulator or an indemnity provider ever asks what you decided and when, that folder is your answer, and it costs almost nothing to maintain compared with reconstructing it later.
When a DPIA is overkill, and when it is not
Not every AI tool needs the same weight. A tool that rewrites staff rotas processes staff data at low risk, and a short note in your records is enough. A scribe that records clinical consultations, processing health data at scale with new technology, is the textbook case. The middle cases, such as an AI that drafts reminder messages from appointment data, depend on what data goes in and how far the output is checked. When in doubt, write the DPIA: it takes a few hours the first time, and it is easy to reuse for the next similar tool.
Many practices already deal with clinic-level wider questions. If you are comparing what an AI receptionist costs and what disclosure it needs, the cost guide for dental practices is the next stop, and consent, data and over-automation mistakes lists what goes wrong first.
If you would like help turning this into your practice's actual list and paperwork, that is a typical AI implementation consultation job.
Dental practice AI and data protection: common questions
Does the GDC say dental teams can use AI?
As far as I could find, the General Dental Council has not published dedicated AI guidance for dental teams yet. In September 2026 it signed a joint statement of intent with other health and care regulators to develop high-level principles on regulating AI, and its professional standards still apply to anything done with AI. Check its website for updates.
Do I need patient consent to use an AI scribe?
Consent for the clinical care and your lawful basis for processing are separate questions. You normally rely on a basis other than consent for records, but patients still need to be told clearly, and many practices ask before recording. Your data-protection adviser can confirm the right approach.
Can a receptionist use ChatGPT to reword emails to patients?
Yes, if the email contains no patient details and the account is an approved one. Use placeholders such as [first name] and add the details yourself after the draft. Names, treatment and appointment details together can count as health data.
Who is responsible if a vendor leaks patient data?
The practice remains the controller and answerable to patients and the regulator, and the vendor is a processor bound by your contract. That is why the processor contract and the vendor's security terms matter before staff use the tool.
Further reads
- Heidi Health for Dentists: Setup, Templates and Patient Consent — Setting up a dental scribe with patient consent.
- Explaining Dental Treatment Plans to Patients With AI — Explaining plans to patients without exposing records.
- Is an AI Scribe Worth It for a Small Private Clinic? — Whether a scribe pays back in a small clinic.
- Which Dental Front Desk Tasks Can AI Take Over? — Front-desk jobs worth handing to AI.
- AI Scribe for an NHS Practice: Registry, DTAC and DPIA Checklist — A scribe checklist with registry and DPIA steps.
- Are ChatGPT, Claude, Gemini and Copilot GDPR-Compliant? — How the big chatbot vendors compare on data terms.
- Dental Complaints Procedure: A Template and AI-Drafted Replies — A practice-side dental complaints procedure with timelines, a complaint log, reply templates and a safe way to have AI draft replies without patient data.
- Dental Equipment Maintenance Log: Service Dates and AI Reminders — A spreadsheet register for dental equipment with service dates, warranty flags and calendar reminders, plus AI that turns invoices and reports into rows.
- Dental New Patient Forms: A Digital Pack and an AI Completeness Check — Twelve forms for a digital new patient pack, each with a worked example, plus a completeness check that flags blanks, not health details.
- Dental Practice Policies and Procedures: Section List and AI Prompts — A section list for a dental policies and procedures manual, prompts that draft from your own routines, and the review steps that keep it safe.
- Dental Social Media Consent Form: Patient Photo Wording With AI — Sample wording for photo, video and testimonial consent, plus withdrawal, minors and platform clauses, and how to have AI draft it safely.
- Dental Practice Valuation Explained: Prepare Your Figures With AI — How buyers value a dental practice, and how to use AI to tidy your accounts, add-backs and patient data before a broker or accountant takes over.
- Free AI for Healthcare Providers: Six Free Tiers and Their Limits — Heidi, Carepatron, ChatGPT for Clinicians and three consumer free plans compared on limits, data terms and whether patient information belongs in them.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: UK GDPR Articles 6, 9, 28, 33 and 35 (legislation.gov.uk text); General Dental Council news on AI in dental education (October 2026) and its consultations page (Framework for Professionalism); vendor data-handling pages (checked November 2026). This is practical guidance, not legal advice; ask a data-protection adviser about your own practice.