Your dental records under GDPR: getting what a clinic abroad needs

The first thing a clinic abroad will ask for is an X-ray. Without one, nobody can say whether All-on-6 is realistic, how much bone you have, or whether some of your own teeth could be kept. Many people already have a recent panoramic X-ray at their dentist’s, taken during a routine check-up or before an extraction. This article explains how to get a copy, what European data protection law says about it, and how to send something a clinic can actually use.

Your right to a copy

Article 15 of the General Data Protection Regulation (GDPR) gives everyone in the EU and EEA the right to obtain a copy of the personal data an organisation holds about them. Dental records are personal data, and health data in particular. They include your X-rays, scans, charts, notes and treatment history. Your dentist is the “controller” of that data and has to respond to your request.

The first copy should be free

For years, some countries allowed doctors and dentists to charge patients for copies of their records. In October 2023 the Court of Justice of the European Union settled the question in case C-307/22, which began with a German patient who asked his dentist for a copy of his records because he suspected treatment errors. The dentist wanted payment, as German law then allowed. The Court ruled that the GDPR requires the first copy to be provided free of charge, and that national law cannot override that.

The Court made two further points that help patients. First, the dentist cannot refuse or delay because of the reason you want the records; you do not have to give one at all. Second, where the full document is needed to understand the data, for example the complete record of a treatment, you are entitled to that document, not just extracts. A dentist may charge a reasonable fee for further copies after the first.

How to ask

A short written request is best, by email or letter, so that there is a date on it. You might write:

Under Article 15 of the GDPR, please send me a copy of my dental records, including all X-rays and scans taken in the past five years. For any CBCT (3D) scan, please provide the original DICOM files. I would prefer to receive them electronically.

The GDPR expects a response without undue delay and normally within one month. That can be extended in some circumstances, so ask well before you want to send anything to a clinic.

What a clinic abroad can use

• Panoramic X-ray (OPG). The standard starting point. It shows both jaws, the remaining teeth and roughly how much bone there is. A clear digital image is fine; a photo of a printed X-ray taken with a phone at an angle often is not.
• CBCT scan. A 3D scan that shows the bone in three dimensions. It is what implant positions are planned on. Ask for the original DICOM files, the standard format for medical imaging, rather than screenshots. They are often large, so a download link or USB stick may be needed.
• Dates. Make sure each image has its date. A five-year-old X-ray may not reflect your mouth today.
• Relevant notes. If you have had gum treatment, failed implants or bone grafts, a summary from your dentist helps.

If you do not have a recent X-ray, a clinic may ask you to have one taken locally, or will take one at the start of your first visit. At Precious Dental, a CBCT scan is part of planning All-on-6, so the final plan is based on a scan taken at the clinic even if you sent an older X-ray first.

Sending health data safely

Once you have the files, think about how you send them. Health data deserves more care than ordinary email, and the clinic is outside the EU. Our article on sending health data to a clinic outside the EU explains what the law says and practical ways to share large files.

If your dentist refuses

Most dentists will simply send the copy. If yours refuses, asks for a fee for the first copy, or does not reply within the time limit, remind them of Article 15 and the 2023 judgment. If that fails, you can complain to the data protection authority in your country. Every EU country has one, and their websites explain how to complain.

In the UK

The UK has its own version of the GDPR, which gives a similar right of access, explained by the Information Commissioner’s Office. Judgments of the EU Court made after the UK left the EU are not binding in the UK, so ask the practice whether it charges for copies.

After treatment: records the other way

The same principle works in reverse. After All-on-6, you will want records from the clinic in Türkiye to give to your dentist at home: the implant passport, X-rays and scans, and details of the bridge. Turkish patient rights rules give you the right to examine your records and obtain a copy; see patient rights in Türkiye. Precious Dental gives patients an implant passport and copies of their X-rays and scans.

What to do with the files once you have them

Keep your own copy of everything, organised by date, on a computer or secure cloud storage as well as on the USB stick or paper you received. Name the files clearly, for example “2026-09 panoramic X-ray” or “2026-09 CBCT DICOM”. When you send them to a clinic, keep a note of what you sent and when. After treatment, add the clinic’s records to the same folder. Over the years this becomes your personal dental history, which is valuable whenever you change dentist or move country.

Records from more than one dentist

If you have seen several dentists, the X-rays may be spread between them. Each one is a separate controller, so send each a request. Older X-rays are useful for comparison: a dentist can see how bone levels have changed, which helps when planning implants.

A note on CBCT scans

CBCT scans involve a higher radiation dose than a panoramic X-ray, though still low compared with medical CT. If you had one recently, sending it can sometimes avoid repeating it, although the clinic may still need its own scan for planning with its software. Ask before you have a new scan taken locally just for the clinic.

Children and representatives

If you are helping an elderly parent, you may need their written authorisation to request records on their behalf. Dentists must be satisfied that the request comes from the patient or someone entitled to act for them.

Format and quality

If the practice offers prints, ask for digital files instead. Digital files keep their quality and can be enlarged without losing detail. A JPEG or PNG export of a panoramic X-ray is usually fine; for CBCT, only the original DICOM files allow a clinic to view the bone in three dimensions.

In short

• You have a right to a copy of your dental records under Article 15 GDPR.
• The first copy should be free, and you do not have to say why you want it.
• Ask for a panoramic X-ray and, for any CBCT scan, the original DICOM files.
• Ask early: the normal deadline is one month.

Ready to send an X-ray? Use our contact form, or read why we recommend Precious Dental.

Questions readers ask

Can my dentist charge me for a copy of my X-rays?

Not for the first copy. In case C-307/22, a dispute involving a German dentist, the EU Court of Justice held that the first copy of medical records must be free, even where national law allowed a charge. Further copies may cost a reasonable fee.

Do I have to say why I want my records?

No. The Court confirmed that the controller cannot make the request depend on your reasons, including if you want the records to get treatment elsewhere.

How long can my dentist take?

Under the GDPR the answer should normally come within one month, which can be extended in some circumstances. Asking early avoids delays to your plans.

Which format should I ask for?

For a panoramic X-ray, a good-quality digital image is usually enough. For a 3D CBCT scan, ask for the original DICOM files, which a clinic can load into its planning software.

I live in the UK. Does this apply?

The UK GDPR gives you a similar right of access. The EU court ruling is not binding in the UK, so ask the practice about any fee for copies.

Sources

1. EUR-Lex — Regulation (EU) 2016/679 (GDPR), Article 15
2. Inside Privacy (Covington) — CJEU holds that GDPR right of access overrules local laws (C-307/22)
3. ICO — Right of access (UK GDPR)
4. DICOM Standard — NEMA

Checked in October 2026. Where we give our own view as a clinic, we say so.