GDPR marketing for dental practices: emails, texts and consent

GDPR marketing rules for a dental practice come from two laws working together. The UK GDPR governs how you use patients' personal data at all. The Privacy and Electronic Communications Regulations (PECR) govern marketing by email, text, phone and other electronic messages. Between them they decide whether you can email patients about whitening, text a lapsed patient, or segment your list by treatment. This guide sets out the rules in plain terms, with the dental cases that cause the most confusion.

What is direct marketing?

Direct marketing is advertising or marketing material directed at particular individuals, by any means. That is the definition the ICO uses in its guidance on direct marketing using electronic mail, and it is broad: any promotional material, sent to a named person or a specific address.

A note on names: the Information Commissioner's Office (ICO) became the Information Commission on 30 September 2026. Its role and powers are unchanged, and its published guidance still carries the ICO name.

The ICO is equally clear about what is not marketing. Messages sent purely for administrative or customer service purposes, often called service messages, are not direct marketing if they only give administrative information and do not promote anything. But if you add advertising or marketing material, the message becomes direct marketing.

For a dental practice, that line is everything:

The ICO lists confirming or reminding people about appointments as a service message. It does not address dental recalls directly, so keep recall messages strictly about the care that is due, with nothing promotional added. The rule of thumb: if a message would make sense with the promotional sentence deleted, delete it and send it as a service message. If the promotion is the point, treat it as marketing.

Do I need consent for marketing under GDPR?

For emails and texts to individuals, usually yes, but the rule comes from PECR rather than the GDPR itself. The ICO's brief guide to electronic mail marketing says you must not send marketing emails or texts to individuals without specific consent, with a limited exception for your own previous customers, known as the soft opt-in.

Under the UK GDPR, consent is only one of several lawful bases. The ICO notes that the Data (Use and Access) Act 2025 clarifies that direct marketing can be a legitimate interest. That matters for marketing PECR does not cover, such as post. It does not override PECR: for emails and texts, you still need consent or the soft opt-in.

"Electronic mail" is wider than email. The ICO says the same rule applies to texts, picture and video messages, voicemails and direct messages via social media.

The soft opt-in: can a dental practice use it?

The soft opt-in lets you send marketing emails or texts without consent, but only if every one of these conditions is met, according to the ICO's detailed guidance:

1. You obtained the person's contact details yourself.
2. You did so while selling, or negotiating to sell, a product or service.
3. You only market your own similar products and services.
4. You gave them a simple chance to opt out when you collected their details.
5. You give them a chance to opt out in every message after that.

For private patients, a practice that collected the details itself, gave a clear opt-out at the time and markets similar dental services can often meet these. The ICO says an opt-out hidden in a privacy policy does not count, and that forms should include a prominent opt-out box.

For NHS patients the position is less clear. The ICO's guidance turns on a sale or negotiations for a sale, and it does not address NHS dental care directly. Rather than build a campaign on an assumption, the safer course for NHS patients is to collect specific consent.

The soft opt-in never covers bought-in lists or details collected by someone else, even another company in your group.

What a good marketing consent statement looks like

The ICO says you can rely on consent where someone has specifically consented to emails or texts from you, for example by ticking an opt-in box. In practice a sound consent request on a new patient form or booking page:

• is a separate, unticked box, not bundled into terms or the privacy notice
• names the practice and the channels, for example email and text
• says what kind of messages, for example news about treatments and offers
• says how to stop, and that stopping is easy

Something like: "Tick if you would like [practice name] to email or text you about treatments, news and offers. You can unsubscribe at any time." Keep a record of when and how each person agreed. Under the UK GDPR, people can withdraw consent at any time, and it must be as easy to withdraw as it was to give.

Health data: why segmenting by treatment is different

Health data is special category data under the UK GDPR, and it is defined widely. The ICO's guidance on special category data says it includes information about the provision of health care that reveals something about a person's health status, and gives the example that you could infer health data from a list of appointments at a clinic or an invoice for a series of sessions. It also says that profiling which infers health status counts as processing special category data.

A plain list of a practice's patients may reveal little. A list of everyone who has had implants, gum treatment or a denture does. If you want to send different marketing to different treatment groups, you need an Article 9 condition as well as a lawful basis, which is a high bar for marketing. Take data protection advice before you do it.

The same caution applies to uploading patient lists to advertising platforms to build audiences. You are sharing personal data with that platform for marketing, and a treatment-based list carries health information with it.

Is an email address personal data under GDPR?

Yes, when it relates to an identifiable person, which nearly every patient email address does. That includes work addresses in the form firstname.lastname@company, because they identify a person. Treat your patient email list with the same care as the rest of the record: only the people who need it should have access, and it should not be shared with another business without a lawful basis.

Cookies, tracking and online ads

If you advertise online, the same law reaches your website. The ICO's guidance on storage and access technologies says cookies used for online advertising need consent, and that advertising purposes have never been exempt. Analytics cookies can now be set without consent under the statistical purposes exception, but only for aggregate statistics about how the site is used, with clear information and a simple, free way to object. Conversion tags for Google Ads or Meta are advertising, so they need consent.

What are the 7 GDPR principles?

The UK GDPR is built on seven principles, set out in the ICO's guide to the data protection principles:

1. Lawfulness, fairness and transparency
2. Purpose limitation
3. Data minimisation
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality (security)
7. Accountability

For marketing, the first two do most of the work. Be open about what you will send, and do not use data collected for clinical care for a different purpose patients would not expect.

What changed with the Data (Use and Access) Act

The ICO says all the data protection provisions of the Data (Use and Access) Act 2025 were in force by June 2026. For a dental practice's marketing, the changes that matter are:

• It confirms that direct marketing can be a legitimate interest under the UK GDPR.
• According to the ICO's summary of the PECR changes, it brings PECR enforcement into line with the UK GDPR, so enforcement mechanisms and penalties are the same in most cases.
• It adds a cookie exception for analytics, described above.
• It requires you to help people complain about your use of their data, acknowledge complaints within 30 days and respond without undue delay.

The new soft opt-in in the Act is for charities only. It does not change the position for dental practices.

What can you not do under GDPR and PECR?

• Email or text individuals marketing without consent or a valid soft opt-in.
• Use bought-in lists of email addresses or mobile numbers.
• Add promotions to reminders and still treat them as service messages.
• Hide the opt-out in a privacy policy, or make unsubscribing harder than subscribing.
• Ask patients to forward your offers to friends, or to give you their friends' details. The ICO advises against both.
• Keep sending after someone opts out.

Email marketing compliance checklist for dental practices

1. Sort your messages into service messages and marketing. Strip promotions out of reminders.
2. Check your patient forms. Add a separate, unticked marketing consent box with clear wording.
3. Record consent: who, when, how and what they agreed to.
4. Put an unsubscribe link or reply-to-stop option in every marketing message, and act on it promptly.
5. Keep a do-not-contact list and screen every send against it.
6. Never segment by treatment or upload patient lists to ad platforms without advice.
7. Update your privacy notice to describe your marketing and how to object.
8. Make sure advertising tags on your website only fire after consent.

Getting this right is also good marketing. Patients who chose to hear from you are the ones who open the email. Our guides to marketing for dentists and getting more dental patients cover what to send once the permissions are in place.