Home › Dental, physio and aesthetics clinics › CQC, GDC and patient data
CQC, GDC and patient data
How long to keep dental patient records: 11 years for NHS clinical records, two years in the contract, and the reply when a patient asks you to delete them
NHS dental clinical records are kept for 11 years, the contract minimum is two, and a deletion request needs a reply within one month. Reply wording included.
NHS dental practices in England keep clinical care records for 11 years. The contract itself asks for two, and a patient who asks for a record to be deleted is owed an answer within one month. Those three figures come from three different places, and front desks mix them up.
Free tool
Dental records deletion request reply maker
Fill in when the request arrived and when the patient's last course of treatment ended. The reply says what has been deleted and gives the date the clinical record will be destroyed, 11 years on.
- Send it within one month of the day the request arrived, and confirm first that the person is the patient or is entitled to act for them.
- The 11 years is the period published for NHS clinical records. If your retention policy sets a different period for private records, change that sentence and the date.
- Check a child's record against the Records Management Code before you give a destruction date.
- Record the decision in the patient's file and in the request log.
The rule this rests on: ICO guidance on the right to erasure (reply within one month; a refusal gives the reasons and the right to complain); NHS Business Services Authority knowledge base article KA-01913 (clinical records kept for 11 years). A draft to check and adapt, not legal advice. Regulated work: a GDC-registered professional or the practice manager reviews every patient-facing draft before it is sent; nothing here is clinical advice and the AI assistant writes nothing clinical.
Works in your browser. Nothing you type leaves this device.
The three figures
| Figure | What it covers | Where it comes from |
|---|---|---|
| 2 years | The patient record, treatment plans, radiographs, photographs and study casts, counted from the end of the course of treatment | GDS Contracts Regulations 2005, Schedule 3, paragraph 32(4) |
| 11 years | Clinical care records in an NHS dental practice | NHS Business Services Authority, citing the NHS Records Management Code of Practice |
| 2 years | Finance-related records, and the PR form from the end date of the course of treatment | NHS Business Services Authority |
| 1 month | The reply to a request for deletion or for a copy of the record | ICO guidance on erasure and subject access |
The two-year figure is the least the contract allows. The 11-year figure is the retention period the NHS publishes for the clinical record, and it is the one to put in the retention policy.
The NHSBSA answer does not say which date the 11 years run from. The regulation counts its two years from the date the course of treatment was completed or terminated, so the plain choice is to count the 11 from the same date, taking the patient's most recent course. Write that choice into the policy.
Private patients
The NHSBSA figure is addressed to NHS practices. For private records the law gives no number. The ICO says "The UK GDPR does not set specific time limits for different types of data", and asks for two things instead: a policy that sets standard retention periods, and a reason you can state for each period.
A mixed practice can adopt 11 years for both sets of records and record why: one rule is easier for the front desk to apply. Ask your indemnity provider whether it advises longer.
Children's records
Search results for the Code of Practice give a longer period for children, to the 25th birthday. We could not open the Code's schedule on 1 October 2026 to confirm it, so check the Code before you set a date on a child's record.
A worked example
A patient's last course of treatment was completed on 14 March 2016. They have not been back.
- The contract minimum of two years, beginning with 14 March 2016, ended on 13 March 2018.
- Eleven years from 14 March 2016 is 14 March 2027.
- On Monday 5 October 2026 the patient emails asking for everything to be deleted. The record is ten and a half years old and inside the retention period. The reply is due by Thursday 5 November 2026.
When a patient asks you to delete their record
The ICO's rules for an erasure request are short. A request can be made verbally or in writing, to any member of staff, and need not use the word "erasure". The practice must answer "without undue delay and at the latest within one month". In most cases it cannot charge a fee.
The right is not absolute. The ICO lists the cases where it does not apply, and three fit a dental record: the processing is necessary for the provision of health care by a professional bound by confidentiality, it is needed to comply with a legal obligation, or it is needed for the establishment, exercise or defence of legal claims.
So the usual answer is in two parts: the clinical record stays until the retention date, and anything the practice has no need to keep goes now. The steps:
- Log the request with the date it arrived and who took it.
- Confirm the person is the patient, or is entitled to act for them.
- Check the retention date for the clinical record.
- Delete or stop what you do not need: marketing consent, newsletter lists, and recall messages if the patient no longer wants them.
- Reply in writing inside the month. A refusal must give the reasons and tell the patient they can complain to the practice, complain to the ICO or go to court; UK GDPR Article 12(4), as amended, now lists the complaint to the practice first.
- Record the decision in the patient's file and in the request log.
The reply
Dear [name],
We received your request on [date] to delete the records we hold about you.
We have deleted [your marketing preferences and your email address from our newsletter list] [and we will not send you recall reminders].
We are not able to delete your dental record yet. We keep clinical records for 11 years after a patient's last course of treatment, which for you ended on [date]. The right to erasure does not apply to records a dental professional needs for the provision of health care, or to records needed for the defence of legal claims. Your record will be securely destroyed after [date], unless you return to us as a patient before then.
If you are unhappy with this decision you can complain to us at [contact], and you have the right to complain to the Information Commissioner's Office and to seek a remedy through the courts.
[Name, role]
When the patient wants a copy instead
A request for a copy is a subject access request. It can also be made verbally, "including via social media". The deadline is one month, which can be extended by up to two further months where the request is complex, and in most cases the copy is free.
A complaint often arrives with one of these requests attached. The complaints procedure has its own clock of three working days to acknowledge, and both clocks run at once.
Where this meets your other policies
The retention period belongs in the same document set as the data protection impact assessment for any AI tool, because a tool that reads records has to follow the same dates. The CQC front desk evidence list shows where records sit at inspection.
In the practice
Overlyft can set up an AI assistant that drafts patient messages for a person to approve and does not decide what is deleted. A GDC-registered professional or the practice manager reviews anything a tool drafts before it reaches a patient. This page is general information, not clinical or legal advice.
Where this comes from: NHS Business Services Authority knowledge base article KA-01913, "How long should NHS dental practices keep patient records for?"; National Health Service (General Dental Services Contracts) Regulations 2005, Schedule 3, paragraph 32; ICO guidance on storage limitation, the right to erasure and subject access. All read 1 October 2026. The NHS Records Management Code of Practice page would not load on that date and is cited only through the NHSBSA answer. Not legal advice; the practice's information governance lead owns the retention policy; UK GDPR Article 12(4) as amended, read on legislation.gov.uk 2026-10-02.
AEO Lookup editorial team
We write practical guides for people who run small UK firms, and we check every fact against its source on the date shown. Read how we review, or tell us if something has changed.
