GDPR for Medical and Dental Clinics in Ireland: Patient Data Rules (2026)

Last updated October 2026. General information only, not legal advice.

A GP surgery, dental practice or private clinic handles some of the most sensitive personal data there is, usually with a small team and off-the-shelf software. The GDPR and the Data Protection Act 2018 do not exempt small clinics, and the Data Protection Commission (DPC) has fined Irish healthcare providers for failures in record security. This guide sets out the patient data rules for medical and dental clinics in Ireland: lawful basis, the Data Protection Officer question, mandatory documents, retention, access requests, breaches and the Health Information Act 2026. The GDPR for Medical Clinics and GDPR for Dentists packs are self-complete template sets built around these obligations.

Health data is special category data

Patient records are “data concerning health”, a special category under Article 9 of the GDPR. Processing them is prohibited unless an Article 9(2) condition applies, and for clinics that condition is normally Article 9(2)(h): processing necessary for medical diagnosis or the provision of health care or treatment, carried out by or under the responsibility of a professional bound by professional secrecy. In Ireland, section 52 of the Data Protection Act 2018 gives effect to this, permitting processing for medical diagnosis, care and treatment and related purposes where it is carried out by or under the responsibility of a health practitioner and “suitable and specific measures” are taken to safeguard patients’ rights.

The practical consequence is that clinics should not rely on consent as the lawful basis for routine clinical records; consent can be withdrawn, which is incompatible with a duty to keep accurate records. Consent is for optional extras: marketing emails, before-and-after photos and research. Health research has its own regime under the Health Research Regulations 2018 (S.I. 314/2018), which require explicit consent and additional safeguards.

Do you need a Data Protection Officer?

Article 37(1)(c) makes a DPO mandatory where an organisation’s core activities consist of processing special category data “on a large scale”. A hospital clearly meets that test. The European guidance on DPOs treats an individual practitioner’s records as not large scale, and the Irish College of General Practitioners has told members that most general practices are not “large scale”, but there is no bright-line number, and a multi-site group or dental chain may well cross it. Whatever you conclude, document the analysis so it can be shown to the DPC if asked. Our guide on whether you need a Data Protection Officer in Ireland goes through the test in more detail.

Documents every clinic must have

Record of processing activities. Article 30 requires a written record of processing. The exemption for organisations with fewer than 250 employees does not apply where special category data is processed, so every clinic needs one, listing what data you hold, why, on what lawful basis, who it is shared with, how long it is kept and how it is secured.

Data protection impact assessment. Article 35(3)(b) requires a DPIA for large-scale processing of special category data, and the DPC’s published DPIA list adds processing where “suitable and specific measures” are required under the 2018 Act and processing of data about vulnerable people, including children. A new practice-management system, patient app, CCTV or AI-assisted tool should be preceded by a DPIA.

Processor contracts. Your software vendor, IT support company, cloud host, transcription service and laboratory all handle patient data on your behalf. Article 28(3) requires a written contract with each containing specific mandatory terms; the ICGP advises practices that they must have data processing agreements with anyone who accesses patient data.

Privacy notice and policies. Patients must be told how their data is used, through a privacy notice in the waiting room and on the website. Internally you need a data protection policy, access-control rules, a breach procedure, a retention schedule, staff confidentiality undertakings and recorded training.

How long to keep patient records

Retention periods come from professional codes and health-service policy rather than the GDPR itself, which only requires that data is kept no longer than necessary.

For dentists, the Dental Council’s Code of Practice on Professional Behaviour and Ethical Conduct (2022) is specific: records must be kept for at least eight years after the patient was last seen; for children, until at least the patient’s 25th birthday (26th if the young person was 17 when last seen). The Code also requires patients to be given a copy of their record within one month at no charge, even if their account is outstanding.

For doctors, the Medical Council’s Guide to Professional Conduct and Ethics (9th edition, 2024) does not set a number of years. It requires records to be kept for as long as required by law or as long as they remain clinically relevant, and points doctors to HSE records-management guidance. HSE schedules have historically used eight years after treatment or death for adults and the 25th/26th birthday rule for children, but the HSE adopted a revised National Records Retention Policy from 1 December 2025, so clinics should check the current schedule.

Patient access requests

A patient is entitled to a copy of their records under Article 15. You must respond within one month, extendable by two further months for complex requests, and the first copy must be free; a reasonable fee may be charged only for further copies. Access can be restricted under the Data Protection Act 2018 (Access Modification) (Health) Regulations 2022 (S.I. 121/2022), but only where disclosure would be likely to cause serious harm to the patient’s physical or mental health, and only for the part of the record concerned.

Data breaches

A personal data breach must be notified to the DPC within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to patients, and patients must be told without undue delay where the risk is high. Breaches you decide not to report must still be recorded internally. Most clinic breaches are mundane: a referral letter sent to the wrong patient, a results email to the wrong address, a lost unencrypted laptop. Our guide to what to do within 72 hours of a data breach in Ireland covers the process step by step.

Enforcement against Irish healthcare providers

In February 2023 the DPC fined Centric Health Ltd, a GP group, €460,000 after a 2019 ransomware attack affected around 70,000 patients, with roughly 2,500 records lost permanently because there was no backup. In August 2026 the DPC fined the HSE €645,000 over insecure, deteriorating paper records at two hospital sites. Both decisions turned on security and retention basics.

CCTV, reminders and marketing

Waiting-room CCTV can be justified on legitimate interests but needs signage at each entrance naming the controller and purpose, and a short retention period (the DPC regards more than a month as hard to justify). Appointment reminders are part of providing care, but marketing messages need consent under the ePrivacy rules and a clear opt-out.

What is changing: the Health Information Act 2026

The Health Information Act 2026, signed on 30 April 2026, gives further effect to the European Health Data Space Regulation (EU) 2025/327. It imposes a duty on health service providers to share personal health data digitally, requires copies on request, sets out steps when a provider ceases services, and establishes the framework for HSE electronic health records. It commences by ministerial order and, as far as can be confirmed at the time of writing, no commencement order has yet been made. The EHDS Regulation’s first obligations on patient summaries and ePrescriptions apply from March 2029.

What a template can and cannot do

The GDPR for Medical Clinics and GDPR for Dentists packs give you a record of processing, privacy notice, DPIA template, processor agreement, breach procedure, retention schedule and staff policies, each of which you complete yourself. They cannot tell you whether your practice is “large scale”, audit your IT security, or handle a DPC inquiry. If you receive a DPC complaint, suffer a significant breach or are selling or closing a practice, speak to a solicitor; the Law Society’s Find a Solicitor service lists practitioners by area. Our guide to data subject access requests in Ireland covers access in more depth, and the full set of GDPR templates is listed here.

Frequently asked questions

Do GP practices need a Data Protection Officer?

Only if their core activities involve processing health data on a large scale. European guidance treats an individual practitioner as not large scale, and the ICGP’s view is that most general practices are not, but larger groups may be. Document your decision either way.

How long should medical records be kept in Ireland?

The Medical Council requires records to be kept as long as the law requires or they remain clinically relevant, and refers doctors to HSE retention guidance, which has used eight years after treatment for adults and the 25th birthday for children. The Dental Council sets at least eight years after the patient was last seen, or the 25th/26th birthday for children.

Can a clinic charge for a copy of medical records?

Not for the first copy. Under Article 15 GDPR the first copy is free and a reasonable fee may be charged only for further copies or manifestly repetitive requests. The Dental Council’s Code separately requires dentists to provide a copy within one month at no charge.

Do I need patient consent to keep health records under GDPR?

No. Clinical records are processed under Article 9(2)(h) GDPR and section 52 of the Data Protection Act 2018 as necessary for medical diagnosis and care, not under consent. Consent is needed for optional uses such as marketing, photographs and research.

What is the GDPR data breach reporting time limit in Ireland?

72 hours from becoming aware of the breach, to the Data Protection Commission, unless the breach is unlikely to result in a risk to individuals. Patients must be informed without undue delay where the breach is likely to result in a high risk to them.

Sources: Data Protection Act 2018, s.52 (revised) · Data Protection Commission – Breach notification · Dental Council – Code of Practice (2022) · Medical Council – Guide to Professional Conduct and Ethics (2024) · Health Information Act 2026 · DPC decision – Centric Health Ltd

OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. For advice on your own situation, speak to a solicitor.