A dental clinic handles clinical records, X-rays, card details and social security numbers. All of this constitutes special category data under the General Data Protection Regulation (GDPR), which automatically raises the bar for security requirements. A ransomware incident or a data breach does not merely disrupt the appointment schedule: it can trigger fines of up to 20 million euros or 4 % of global annual turnover under Article 83.5 of the GDPR. Yet most dental clinics in Spain continue to operate with security measures designed for a different era.
This guide gives precise answers on which measures are mandatory, which ones are recommended by INCIBE for the health sector, and how the Kit Digital programme allows you to finance them with no immediate outlay if your clinic qualifies.
Why dental clinics are a prime target for cybercrime
Dental records combine health, financial and identifying information in a single patient file. According to the State of Ransomware in Healthcare 2025 by Sophos, the healthcare sector was the most attacked by ransomware in Europe during 2024, with an average recovery time of 17 days and an average cost exceeding 1.6 million euros per incident (including ransom, restoration and lost revenue).
Dental clinics present a specific attack surface:
- Practice management software with access to records, scheduling and billing, often outdated or without active support.
- Digital radiology equipment (OPG, cone beam CT) that transmits DICOM images over the local network, frequently unencrypted.
- Payment terminals and payment gateways sharing the same network as clinical workstations.
- Uncontrolled remote access by dental software maintenance staff.
- Backups stored on the same local server disk, invisible to any encryption-based attack.
Mandatory regulatory framework for dental clinics in Spain
Before addressing technical solutions, it is important to understand current legal obligations. Non-compliance is not just a risk of sanctions: in the event of an incident, the absence of documented measures worsens the clinic's liability.
GDPR and Organic Law 3/2018 (LOPDGDD)
The processing of health data is governed by Article 9 of the GDPR, which requires an explicit legal basis (express consent or care relationship) and technical and organisational security measures proportionate to the risk. The AEPD, in its guide for the health sector published in 2023, establishes that clinics must carry out a Data Protection Impact Assessment (DPIA) when processing is systematic at large scale, and that they must maintain an up-to-date Record of Processing Activities (RPA) as a basic obligation.
NIS2 transposition Royal Decree-Law (EU Directive 2022/2555)
The NIS2 Directive, whose transposition in Spain is being completed through the draft Law on Cybersecurity Coordination and Governance (approved by the Council of Ministers in January 2025 and under parliamentary review in 2026), includes healthcare service providers within its scope. Clinics with more than 50 employees or 10 million euros in turnover are subject to specific incident management obligations and must notify INCIBE-CERT within 24 hours of significant incidents.
Code of Conduct of the General Council of Dentists
The General Council of Dentists of Spain has a Code of Conduct on Data Protection for its members. Its adoption is not mandatory, but it provides a compliance roadmap recognised by the sector and can be used to demonstrate due diligence to the supervisory authority.
Minimum required measures: what you must already have in place
The following table summarises the technical and organisational measures that INCIBE and the AEPD consider essential for a dental clinic processing health data, ranked by urgency:
| Measure | Level of requirement | Regulatory basis | Most common status in clinics |
|---|---|---|---|
| Encrypted and verified backups (3-2-1 rule) | Mandatory | GDPR Art. 32; AEPD healthcare security guide | Local backup only, never verified |
| Managed antivirus/EDR on all devices | Mandatory | GDPR Art. 32; INCIBE health sector guide 2024 | Consumer antivirus, no central management |
| Patches and updates for dental software and OS | Mandatory | GDPR Art. 32; NIS2 Art. 21 | Manual or ignored updates |
| Network segmentation (clinical / patients / administration) | Highly recommended | INCIBE; CGD Code of Conduct | Flat network shared by all devices |
| Multi-factor authentication (MFA) for remote access and email | Highly recommended | NIS2 Art. 21; INCIBE | Username and password only |
| Encryption of records at rest and in transit | Mandatory (special category data) | GDPR Art. 9 and 32 | No encryption or HTTPS only on web |
| Record of Processing Activities (RPA) | Mandatory | GDPR Art. 30; LOPDGDD Arts. 48-49 | Non-existent or outdated |
| Incident response protocol and AEPD notification procedure | Mandatory | GDPR Art. 33-34 | No documented protocol |
| Staff training on phishing and social engineering | Highly recommended | GDPR Art. 32; CGD Code of Conduct | No specific training |
| Role-based access control (who can see which record) | Mandatory | GDPR data minimisation principle; Art. 32 | All employees have full access |
Sector-specific attack vectors: the most frequent in 2025
INCIBE's Cybersecurity Report 2024 identified the main incident vectors in Spain's health sector. For dental clinics, the most relevant are:
Ransomware via dental practice management software
Dental management programmes (Gesden, Clinicsoft, Denwix, among others) frequently communicate with the vendor's servers for updates and remote support. If that connection is not controlled, any unpatched vulnerability in the software or the vendor's server becomes an entry point. In 2024, several incidents in Spain were traced back to the update client of the clinical software as the initial vector.
Email as entry vector (phishing and BEC)
Administrative staff at dental clinics receive quotes, invoices and requests from dental supply vendors. Business Email Compromise (BEC) attacks impersonate known suppliers to redirect payments or install malware via Word or PDF attachments with macros. It is the simplest and most widely used vector because it requires no technical vulnerabilities: it simply needs an employee to open the file.
Unpatched imaging devices
Digital radiology equipment uses embedded operating systems that rarely receive security updates. Many of these devices run on Windows 7 or Windows XP in imaging systems that the manufacturer has not migrated. As they are connected to the local network, they serve as a pivot for lateral movement towards the records server.
Available grants: Kit Digital for cybersecurity in dental clinics
The Kit Digital programme, funded by Next Generation EU and managed by Red.es, explicitly includes Cybersecurity as an eligible solution category. In 2025 and 2026, dental clinics operating as sole traders, micro-enterprises (fewer than 10 employees) or small businesses (10–49 employees) can access the following amounts:
- Segment I (10–49 employees): up to €6,000 for the cybersecurity solution.
- Segment II (3–9 employees): up to €2,000.
- Segment III (0–2 employees and sole traders): up to €2,000.
The cybersecurity solution eligible under Kit Digital must include, as a minimum: anti-malware, anti-spyware, spam email control, safe browsing, threat analysis and detection, and network monitoring. The standard justification period is 12 months from the date the agreement is signed with the Digitalising Agent.
For full details on how to apply for this grant and what the service includes, visit our cybersecurity for SMEs with Kit Digital grants page, where we outline the complete process from the initial diagnosis to justification with Red.es.
Eligibility requirements for the clinic
To access Kit Digital, the clinic must meet the following requirements at the time of application:
- Be up to date with Social Security and Tax Agency payments.
- Not have received de minimis aid exceeding €300,000 over the previous three fiscal years.
- Have a basic level of digital maturity according to the self-assessment test at acelera.pyme.es.
- Not be undergoing insolvency proceedings or have outstanding debts with the public administration.
Kit Consulting: funded prior diagnosis
Complementing Kit Digital, the Kit Consulting programme (also managed by Red.es) allows clinics to commission a technology diagnostic from an accredited consultant for up to €12,000 (10–49 employees), €18,000 (50–99) or €24,000 (100–249 employees). This diagnostic can include an assessment of the clinic's cybersecurity posture and the preparation of a GDPR health-sector compliance plan, enabling investment to proceed with a documented roadmap before any expenditure is committed.
What a cybersecurity project for a dental clinic should include
A well-scoped project for a dental clinic with between 5 and 20 employees comprises four distinct blocks:
1. Diagnosis and risk analysis
Inventory of all assets that process patient data (management software, imaging equipment, terminals, email), analysis of actual — not theoretical — risks, and classification by probability and impact. Without this step, any investment in tools may be misdirected.
2. Technical protection
Deployment of managed EDR (Endpoint Detection and Response), next-generation firewall configuration with outbound traffic inspection, network segmentation, MFA for email and remote access, and encryption of the patient record database. Technical protection is what directly meets the Kit Digital requirements.
3. Verified backup and recovery plan
Backups must follow the 3-2-1 rule: three copies, on two different media, one off-site (cloud or alternative location). And, most importantly, they must be tested periodically. A backup that has never been restored does not exist. The recovery plan must define the RTO (maximum acceptable recovery time) and RPO (maximum tolerable data loss) for the clinic.
4. Legal documentation and staff training
An up-to-date RPA, data processing agreements with processors (the management software provider, the cloud manager, the IT maintenance service), a procedure for notifying the AEPD of breaches within 72 hours, and staff training in phishing recognition. This last element is essential: the vast majority of data breaches in the healthcare sector involve a human factor as a contributing element, according to successive editions of Verizon's DBIR report.
At Summum Sistemas we manage cybersecurity projects with Kit Digital funding for clinics in the health sector, including full grant processing with Red.es and coordination with the DPO when the project requires GDPR health-sector compliance.
Frequently asked questions
Is a two-person dental clinic subject to the same GDPR obligations as a large clinic?
Yes, in terms of the substance of the obligations: the GDPR sets no minimum size threshold for security obligations when health data is processed. What does vary is the proportionality of the measures: a sole-practitioner clinic does not need a full-time CISO, but it does need encrypted backups, controlled access, signed agreements with its technology providers and a procedure for notifying the AEPD of breaches. The AEPD takes the size of the organisation into account when assessing sanctions, but it does not exempt organisations from basic compliance.
Does Kit Digital cover the cost of an external DPO or only technical tools?
The Kit Digital Cybersecurity category funds exclusively technical solutions (anti-malware, monitoring, web filtering, etc.), not legal consultancy services or the DPO role. To fund GDPR compliance consultancy and DPO appointment, the appropriate instrument is Kit Consulting, which covers advisory services from accredited consultants. If your clinic also requires an external DPO, you can discuss this with the Summum Consultoría team, which handles the legal and data protection side for the health sector.
How long does a cybersecurity implementation with Kit Digital take?
The process has two distinct phases. The grant application — from submission on acelera.pyme.es to signing the agreement with the Digitalising Agent — can take between four and eight weeks depending on the volume of applications in each call. Technical implementation in a typical clinic (5–15 devices) is normally completed within two to four weeks. The 12-month justification period that follows covers the active maintenance period of the solution, during which the Digitalising Agent must deliver the committed service.
What happens if the clinic suffers an attack before implementing the measures?
The obligation to notify the AEPD of a data breach affecting health data exists regardless of the clinic's cybersecurity maturity. The deadline is 72 hours from the moment the incident is known (GDPR Art. 33). If the breach may pose a high risk to patients' rights, they must also be notified directly (Art. 34). The absence of prior measures does not exempt the clinic from notifying; on the contrary, it is an aggravating factor in the AEPD's assessment of the infringement. The most urgent steps after detecting an incident are to contain it, document it and notify it: the order matters.