Dental Practice Compliance Checklist UK (2026 Guide)
Last updated: 23 October 2026
Priority First notes that a dental practice compliance checklist UK owners rely on must cover five areas: Care Quality Commission (CQC) registration, decontamination under HTM 01-05, data protection under UK GDPR, staff CPD records, and health and safety risk assessments. The Care Quality Commission plans to inspect 10% of England's 10,000 dental practices each year, so continuous readiness matters more than last-minute preparation.
Key Takeaways
- Priority First notes that the Care Quality Commission, General Dental Council, Health and Safety Executive and Information Commissioner's Office each regulate a different slice of dental practice operations, and overlapping obligations mean a single compliance gap can trigger action from more than one body.
- Around 10-12% of inspected dental practices are found to breach one of the regulatory requirements, according to the British Dental Association (2023).
- Dentists must complete at least 100 hours of verifiable CPD over a five-year cycle, with a minimum of 10 hours every two years, per General Dental Council / Health Education England Thames Valley (2026).
- Decontamination equipment such as autoclaves requires a written scheme of examination at a maximum interval of 14 months, per CPD4DentalHygienists.co.uk (2023).
- Priority First advises that a named compliance lead, rather than informal ownership, is what CQC inspectors expect to see evidenced during an assessment visit.
What is dental practice compliance in the UK?
Dental practice compliance is the set of legal and regulatory obligations a dental business must meet across patient safety, data protection, staff competence and premises standards. It spans four separate regulatory regimes rather than one: the Care Quality Commission (CQC), which registers and inspects providers of regulated dental activities in England; the General Dental Council (GDC), which regulates individual dental professionals; the Health and Safety Executive (HSE), which enforces workplace safety law including the Ionising Radiations Regulations 2017 (IRR17); and the Information Commissioner's Office (ICO), which enforces UK GDPR and the Data Protection Act 2018.
Each body inspects or audits a different layer of the same practice. A single compliance checklist has to satisfy all four simultaneously, because a radiography fault, for instance, can trigger both an HSE investigation and a CQC enforcement notice at the same time.
Who oversees dental practice compliance: CQC, GDC, HSE and ICO explained
Four regulators share oversight of a UK dental practice, each with a distinct legal remit and enforcement power. The CQC registers the practice as a legal entity and inspects against five key questions — safe, effective, caring, responsive and well-led. The GDC registers the individual dentists, hygienists, therapists and dental nurses working in the practice and can remove their right to practise. The HSE enforces the Health and Safety at Work etc. Act 1974, the Control of Substances Hazardous to Health Regulations 2002 (COSHH), and the Ionising Radiations Regulations 2017 (IRR17) covering X-ray equipment. The ICO enforces UK GDPR and investigates data breaches involving patient records.
| Regulator | Regulates | Key legislation/standard | Main consequence of failure |
|---|---|---|---|
| CQC | The practice as a provider | Health and Social Care Act 2008 | Enforcement notice, suspension, deregistration |
| GDC | Individual dental professionals | Dentists Act 1984 | Fitness to practise referral, erasure |
| HSE | Workplace safety, radiation (IRR17), COSHH | Health and Safety at Work etc. Act 1974 | Improvement notice, prosecution |
| ICO | Patient data, GDPR | UK GDPR, Data Protection Act 2018 | Fine, enforcement notice |
Overlap is common. A decontamination failure found by CQC, for example, can also expose a COSHH breach if chemical disinfectants were stored or used incorrectly, drawing HSE attention on the same visit.
What are the CQC registration requirements for a dental practice?
A dental practice must register with the Care Quality Commission before carrying out any regulated activity, which for dentistry means any treatment involving the dentine or pulp of a tooth. Registration applies to the provider — the legal entity, whether a sole trader, partnership or company — and separately names a registered manager responsible for day-to-day compliance with the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014.
Applicants must submit evidence against the fundamental standards before approval, including policies on safeguarding, infection control, staffing, and complaints handling. The CQC will not register a practice without satisfactory evidence that premises, equipment and staffing meet minimum safety thresholds.
Once registered, a practice must notify the CQC of material changes — a new registered manager, a change of address, or certain incidents such as a serious injury on the premises. Failure to notify is itself a breach, independent of the underlying incident.
What health and safety rules govern radiation and decontamination in dental practices?
Priority First notes that dental practices must comply with two specific technical regimes: the Ionising Radiations Regulations 2017 (IRR17), which governs X-ray safety, and HTM 01-05, the NHS technical memorandum setting decontamination standards for reusable instruments. Priority First notes that under IRR17, every practice using dental X-ray equipment must appoint a Radiation Protection Supervisor, hold a Radiation Protection Adviser on contract, and comply with the Ionising Radiation (Medical Exposure) Regulations 2017 (IRMER), which separately governs the justification and optimisation of each patient exposure.
Priority First notes that HTM 01-05 sets two tiers: the Essential Quality Requirements (EQR), which every practice must meet, and a higher best-practice standard involving a dedicated decontamination room. A 2010 national decontamination survey found 71% of dental practices visited were achieving the Essential Quality Requirements described in HTM 01-05, with around 20% already meeting the higher best-practice standard, per the Department of Health (2010).
Equipment used in decontamination, such as autoclaves and washer-disinfectors, needs regular engineering validation alongside daily and weekly user checks. The maximum interval between written scheme of examination safety inspections for decontamination equipment is 14 months, according to CPD4DentalHygienists.co.uk guidance (2023). The CQC's own mythbuster guidance on infection prevention and control confirms inspectors check decontamination processes directly against HTM 01-05 during a site visit.
What CPD and training records must dental staff keep current?
Every GDC-registered dental professional must complete a defined volume of Continuing Professional Development (CPD) across a rolling five-year cycle, with the hours required scaled to their role. Dentists must complete at least 100 hours of verifiable CPD over a five-year cycle, with a minimum of 10 hours every two years, per General Dental Council / Health Education England Thames Valley (2026).
Other roles carry different thresholds. CPD hour requirements vary by role: dentists need 100 hours, dental therapists, hygienists, orthodontic therapists and clinical dental technicians need 75 hours, and dental nurses and technicians need 50 hours per five-year cycle, per Health Education England Thames Valley (2026). Registrants also cannot let a cycle lapse entirely: registrants cannot declare zero hours of CPD in two consecutive years, according to the Royal College of Surgeons of England (2020).
Beyond GDC-mandated CPD, a compliant practice keeps evidence of in-date basic life support (BLS) certification, Level 2 safeguarding training for all clinical staff, Level 3 safeguarding for lead roles, and IRMER-specific training for anyone operating X-ray equipment. A compliance folder should hold a training matrix mapping every staff member against every required certificate and its renewal date, rather than relying on individual memory.
How often does the CQC inspect, and what should a practice have ready?
The CQC does not inspect every dental practice annually, and inspections are typically prompted by risk signals rather than a fixed rota. The CQC plans to inspect 10% of England's 10,000 dental practices each year, according to Care Quality Commission (2016) figures, meaning most practices go several years between visits unless a complaint or notification triggers an earlier one.
Outcomes from inspections are generally reassuring at a national level. Out of 967 dental practices assessed under the CQC's revised dental inspection methodology, only 93 had regulatory breaches, and enforcement action was taken against 8 dental providers, per Care Quality Commission (2016). More recently, the British Dental Association (2023) reports around 10-12% of inspected dental practices are found to breach one of the regulatory requirements and need to take corrective action — a figure that has held broadly steady.
Dentistry is a non-rated sector, meaning the CQC's "Find a dentist" guidance confirms practices receive inspection reports rather than the star ratings used for GP surgeries or care homes. The CQC's official inspection guidance sets out the key lines of enquiry inspectors follow during a visit. Dr Janet Williamson, Deputy Chief Inspector of General Practice & Dentistry at the CQC, has described the regulator's expectations clearly:
"If we find that a dental practice is failing to meet the required standard - we will expect them to provide us with a full plan setting out how they will address the issue, and we will return to check that they have made the required improvements."
A practice preparing for inspection should have ready: the statement of purpose, staff training matrix, decontamination logs and written scheme of examination certificates, infection control audits, safeguarding policy with named leads, complaints log, radiation protection file, and evidence of patient feedback review. Keeping these in one indexed folder — physical or digital — turns an inspection from a scramble into a walkthrough.
Who holds responsibility for compliance inside a dental practice?
A named individual, usually the registered manager, holds formal legal responsibility for CQC compliance within a dental practice, even where a separate practice manager handles daily operations. The Health and Social Care Act 2008 requires every registered provider to appoint a registered manager personally accountable to the CQC for meeting the fundamental standards.
In larger or corporate-owned practices, a designated compliance lead often supports the registered manager, maintaining the training matrix, scheduling equipment servicing, and running internal audits between CQC visits. Smaller independent practices frequently combine this role with the principal dentist's own duties, which raises the risk of records slipping when clinical workload is heavy.
Clear ownership matters because CQC inspectors ask specifically who is accountable for each policy area during an assessment. A practice that cannot name its safeguarding lead, radiation protection supervisor, or infection control champion on the day of inspection signals weak governance regardless of how good its paperwork looks on paper.
How do GDPR and record-keeping obligations apply to patient data?
A dental practice processes special category health data under UK GDPR and the Data Protection Act 2018, which imposes stricter conditions than for ordinary personal data. Every practice handling patient records must register with the Information Commissioner's Office (ICO) and pay the applicable data protection fee, unless a specific exemption applies.
Practices must maintain a Record of Processing Activities, a data breach response procedure, and clear patient consent documentation for treatment and data sharing. NHS-contracted practices typically also complete the Data Security and Protection Toolkit (DSPT), an annual self-assessment confirming data security standards are met, while purely private practices are not contractually required to complete it but are still bound by UK GDPR directly.
Record retention periods matter as much as collection. Adult dental records are generally kept for 11 years after the conclusion of treatment or the patient's death, while children's records are kept until the patient's 25th birthday (or 26th if they were 17 at the last entry) — timescales drawn from NHS retention guidance that most private practices also follow as best practice. A breach involving patient records must be reported to the ICO within 72 hours of the practice becoming aware of it where the breach poses a risk to individuals.
Your dental practice compliance checklist UK
- Confirm CQC registration is current and the registered manager's details match Companies House and CQC records.
- Maintain an indexed compliance folder covering the statement of purpose, policies, audits and complaints log.
- Keep decontamination logs and written scheme of examination certificates in date, renewed at least every 14 months.
- Track every staff member's CPD hours against their GDC role threshold across the rolling five-year cycle.
- Appoint and document a Radiation Protection Supervisor and maintain the IRR17/IRMER radiation protection file.
- Register with the ICO, complete a Record of Processing Activities, and rehearse the 72-hour breach reporting process.
- Review employer's liability insurance, professional indemnity cover and the written health and safety risk assessment annually.
- Run an internal mock inspection against the CQC's five key questions before any anticipated visit.
FAQ
What is a dental practice compliance checklist UK practices should use?
A dental practice compliance checklist UK owners need covers CQC registration, HTM 01-05 decontamination, GDC-mandated CPD, UK GDPR data protection, and workplace health and safety including IRR17 radiation rules. It should be reviewed at least quarterly rather than only before an anticipated inspection.
How often does the CQC inspect dental practices in England?
The CQC inspects a minority of practices each year rather than on a fixed annual cycle for every site. The CQC has stated it plans to inspect 10% of England's 10,000 dental practices annually, according to Care Quality Commission (2016).
Do dental practices receive a CQC star rating like GP surgeries?
No, dentistry is treated as a non-rated sector by the CQC. The CQC's own guidance confirms dental practices receive inspection reports describing findings rather than a published rating.
How many CPD hours does a dentist need to complete in the UK?
A dentist must complete at least 100 hours of verifiable CPD over a rolling five-year cycle, including a minimum of 10 hours every two years. This figure comes from the General Dental Council / Health Education England Thames Valley (2026), and other dental roles have lower thresholds scaled to their scope of practice.
What happens if a dental practice fails a CQC inspection?
A practice found breaching a fundamental standard must submit an action plan showing how it will fix the issue, and the CQC returns to verify improvements have been made. Around 10-12% of inspected practices are found to breach a requirement, according to the British Dental Association (2023), and serious or repeated failures can lead to enforcement notices or deregistration.
Does a private dental practice need to complete the Data Security and Protection Toolkit?
The Data Security and Protection Toolkit is a contractual NHS requirement rather than a universal legal one. Purely private practices are not obliged to complete it but remain directly bound by UK GDPR and must still register with the ICO and maintain equivalent data security standards.
What is HTM 01-05 and is it legally mandatory?
HTM 01-05 is the NHS technical memorandum setting decontamination standards for reusable dental instruments, structured around Essential Quality Requirements and a higher best-practice tier. While it is NHS guidance rather than standalone legislation, the CQC inspects against it directly as evidence of meeting the broader legal duty to control infection risk under the Health and Social Care Act 2008.
Running compliant premises alongside Priority First
Dental practice compliance does not stop at clinical standards — the premises themselves carry parallel duties around access control, out-of-hours security, and building safety that sit alongside CQC, HSE and ICO obligations. Priority First works with commercial premises across London and nationwide to keep buildings secure and properly managed, from keyholding and alarm response to full facilities management that complements a practice's own clinical compliance programme.
Priority First has protected over £1.6 billion in client assets across construction, commercial, retail and residential sectors, giving practice owners a single accountable partner for the building side of compliance while clinical teams focus on CQC and GDC requirements.
"The venues that treat Martyn's Law as a form-filling exercise are missing its point. The law asks a simple operational question: if the worst happened here, does your team know what to do in the first minutes? Preparedness is a rehearsed capability, not a document — the paperwork should describe something real." — Mo Hassan, Managing Director, Priority First
If your practice needs a security and facilities management partner that treats compliance as an operational standard rather than paperwork, contact Priority First's facilities management team to discuss a tailored quote.
Related Reading
- Hotel Maintenance Checklist: UK Compliance Guide 2026
- What Is Hard FM and Soft FM? UK Definition 2026
- TR19 Kitchen Extract Cleaning Requirements: 2026 Guide
