PDPA for dental clinics in Singapore

If you run a dental clinic, you're not just fixing teeth — you're holding a pile of sensitive patient data, most of it in a cloud system you didn't build. So this is worth ten minutes. Let's keep it plain.

Yes, the PDPA applies — and you need a DPO

There's no "we're just a small clinic" exemption. Singapore's PDPA applies to every organisation, and the first thing it asks of you is to appoint a Data Protection Officer (DPO) and make their business contact available. A dental clinic is no exception — solo practice or five-chair group, the rule is the same. If you've never formally named a DPO, that's the baseline gap to close first. (I wrote a fuller guide on this: does my clinic need a DPO?)

And because you handle health data, the PDPC treats a leak from a clinic as capable of causing significant harm — so you're held to a higher standard than a regular shop. On top of the PDPA, dental clinics also sit under MOH rules and the Healthcare Services Act (HCSA).

The data a dental clinic actually holds

It's more than you might picture. A typical dental clinic collects and keeps:

• ✓Patient records — full name, contact details, NRIC, medical and dental history.
• ✓Dental X-rays and clinical photos — imaging and before/after shots tied to a named patient.
• ✓Treatment plans and clinical notes — diagnoses, procedures, medications.
• ✓Financing and instalment data — for implants, braces or aligners, plus any third-party payment plan details.
• ✓Insurance and claims info — policy numbers, claim forms, corporate panel details.

Nearly all of it now lives in a cloud dental practice-management system — appointments, records, imaging and billing in one place. That's convenient, but it doesn't make the responsibility someone else's, as we'll see.

Where dental clinics actually slip

These are the everyday gaps that turn "we've been fine for years" into an incident:

• 1X-rays and clinical photos — how they're stored, who can open them, and how they're shared. Emailing an image to a specialist or a lab, or snapping a photo of a scan on a personal phone, is a real exposure if it's not done securely.
• 2The cloud practice-management system — good software is a strong start, but it only covers how the software holds data. The PDPA still holds your clinic responsible: you need your own DPO, your own policies, and your own consent process. Secure software plus no policies is still non-compliant.
• 3WhatsApp reminders — appointment and recall messages sent from a personal number, or a shared group with patient details in it, blur the line between clinic data and someone's private phone.
• 4Reception privacy — the next patient in the queue seeing a screen, a chart, or overhearing NRIC and treatment details read aloud at the front desk.
• 5Marketing without consent — sending promotions for whitening or aligners to patients who only ever consented to treatment. That's the single most common clinic mistake.
• 6Retention — keeping every record and image forever "just in case", with no schedule for what to delete and when.

The three consents to keep separate

This trips up more clinics than anything else. A patient agreeing to one thing is not agreeing to the others:

• 1Consent to treatment — clinical care. This does not, on its own, let you market to them.
• 2Consent to use their data — for running the clinic: records, billing, recalls, referrals.
• 3Consent to marketing — promotions, newsletters, "come back for a check-up" campaigns. This one is separate and must be freely given — and it can be withdrawn.

Using a before/after photo on your Instagram? That's its own consent again. When in doubt, ask — in writing.

How long to keep records

Two rules pull in opposite directions, and you need a schedule that reconciles them:

• ✓MOH generally wants medical records kept for at least 6 years for adults, and for children until they turn 21, plus 6 years.
• ✓The PDPA says don't keep data longer than you need it — once the purpose and the retention period are done, dispose of it securely.

So the answer isn't "keep everything forever" and it isn't "clear it out early" — it's a written retention schedule that satisfies MOH's minimum and then disposes of data properly. (More detail here: how long must a clinic keep patient records?)

So — what should you do?

Three practical steps. One, appoint a DPO (you legally must) and be honest about whether that person has the knowledge and the time. Two, get the everyday basics right — secure image storage and sharing, clean consent, sensible reminders, a private front desk. Three, write down a retention schedule that meets MOH and the PDPA.

If nobody on your team has the hours or the specialist knowledge, this is the kind of thing you can have done for you — mapped, documented, staff trained, and a named DPO on call if a patient complains or something goes wrong. In a dental clinic, your risk isn't a random audit — it's an incident you weren't set up for, and patients' trust is your whole business.

Eugene

I build websites and help Singapore businesses run them well. HeyAda is my Singapore web studio — design, SEO, and the practical side of running a business online, including the patient data your dental clinic collects. I write these guides in plain English, and I can be your clinic's outsourced DPO. Getting your clinic PDPA-ready? Say hi. …read more