Patient data protection in Spain: LOPDGDD 3/2018 and GDPR compliance for dental imaging centers

A dental clinic operating in Spain handles special category data every single day: patient names, dates of birth, diagnoses, CBCT scans, and radiographs. That data is protected by one of the strictest regulatory frameworks in the world. A single mishandled breach can cost up to EUR 20 million or 4% of the controller''s global annual turnover.

This article explains what Spain''s Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD) requires, how it interlocks with the EU General Data Protection Regulation (Regulation EU 2016/679, GDPR) and Law 41/2002 on Patient Autonomy, and how CBCTHub delivers each technical safeguard so your imaging center does not have to reinvent the wheel.

LOPDGDD 3/2018 in plain English

The LOPDGDD is the Spanish law that develops and complements the European GDPR. It entered into force on December 7, 2018 and applies to any processing of personal data carried out on Spanish territory, including health data. Health data is special category data under Article 9 of GDPR, which means processing is prohibited by default and only allowed with a specific legal basis (explicit consent, healthcare provision, vital interest, etc.).

Regulatory framework that applies to a dental clinic

• GDPR (Regulation EU 2016/679): the European base, defining universal principles and rights.
• LOPDGDD 3/2018: the Spanish development, adding digital rights and clarifying the sanctioning regime.
• Law 41/2002: regulates clinical records, informed consent, and minimum retention periods (five years from discharge).
• Royal Decree 1720/2007: partially repealed but still a reference for clinical record security measures.
• Code of Ethics of the Spanish Dental Association: reinforces professional secrecy.

What the law specifically requires about patient data

Informed consent and legal basis

Before processing health data, the controller must identify a legal basis under Article 6 GDPR and an exception under Article 9.2. For a CBCT scan, two are usually combined: the patient''s explicit consent (Article 9.2.a) and healthcare provision (Article 9.2.h). Consent must be free, specific, informed, and unambiguous, and must be withdrawable as easily as it was given.

Data subject rights: access, rectification, erasure, objection, portability

The patient may request at any moment a copy of their data, its correction, its erasure (right to be forgotten), object to specific processing, or demand portability in a structured format. The clinic must respond within a maximum of one month, extendable to three for complex cases.

Technical and organizational security (GDPR Article 32)

Controllers and processors must implement appropriate technical and organizational measures: encryption and pseudonymization, ability to guarantee confidentiality, integrity, availability and resilience, ability to restore access after an incident, and regular verification procedures. For health data, the Spanish DPA (AEPD) recommends high level.

Breach notification within 72 hours

Any security violation affecting personal data must be reported to the Spanish Data Protection Agency within 72 hours of becoming aware of it. If the risk to patients'' rights is high, affected individuals must also be notified without undue delay.

International transfers

Moving data outside the European Economic Area is only legal under an adequacy decision (for example, the US under the Data Privacy Framework), Standard Contractual Clauses, or Binding Corporate Rules. If your cloud provider hosts servers outside the EU, you must document the safeguard in place.

Data Protection Officer (DPO)

Article 37 of GDPR requires a DPO when the core activity involves large-scale processing of special category data. The AEPD interprets that any healthcare center processing data of several thousand patients is required to appoint one. The appointment must be communicated to the AEPD through its electronic portal.

Records of processing activities

Every clinic must keep a written or electronic record of processing activities (ROPA). It is the first document the AEPD requests during an inspection.

Retention periods

Law 41/2002 sets a minimum of five years from the discharge of the care process, but several Spanish regions extend this to fifteen years for diagnostic imaging. After the period expires, data must be deleted or irreversibly anonymized.

Penalties for non-compliance

• Minor infractions: up to EUR 40,000 (LOPDGDD art. 74).
• Serious infractions: up to EUR 300,000 (art. 73) or 2% of global annual turnover.
• Very serious infractions: up to EUR 20 million or 4% of global annual turnover (GDPR art. 83.5).
• Publication in the Spanish Official Gazette (BOE) for very serious infractions.

Concrete risks for a dental imaging center

The USB drive left at reception, the CD handed to the wrong patient, the email with the scan attached unencrypted, the backup exposed on a passwordless NAS. These are all real-world scenarios the AEPD has sanctioned. In 2023, a Spanish clinic was fined EUR 70,000 for sending clinical results unencrypted to a wrong email address.

How CBCTHub helps you comply with LOPDGDD and GDPR

Encryption in transit and at rest

All connections to CBCTHub use HTTPS with TLS 1.3. DICOM storage runs on Cloudflare R2 with AES-256 encryption at rest. Passwords are stored with bcrypt and session tokens are signed JWTs.

Access control with PIN and unique links

Each exam generates a unique URL with an opaque identifier and an optional 4-to-6-digit PIN. No one can access a study by guessing the URL. The clinic''s public page requires a mandatory PIN to reveal the exam.

Audit log of every access

Every viewer open is recorded with timestamp, IP, and exam_id. The controller can export the log from the clinic panel at /dashboard/settings to respond to an AEPD inspection or demonstrate due diligence in a complaint.

Integrated informed consent

CBCTHub ships legal templates adapted by country and language. It generates the document, emails it to the patient, captures the electronic signature with public verification, and archives it linked to the exam. Meets the requirements of GDPR Article 7 and Law 41/2002.

Automatic link expiration

The clinic configures the expiry of every shared link: 24 hours, 7 days, 90 days, or custom. By default, links expire and the external recipient loses access. This control supports the data minimization principle of GDPR Article 5.

Right to be forgotten and secure deletion

The endpoint DELETE /api/v1/exams/{id} removes the exam and all associated DICOM files from R2 irreversibly. Complies with the right to erasure under GDPR Article 17 and Law 41/2002.

Data portability (GDPR Article 20)

The endpoint /api/account/export-data lets the clinic or patient download all their data in structured JSON. Satisfies portability without manual intervention.

Data Processing Agreement (DPA)

CBCTHub signs a DPA with every EEA clinic under the European Commission''s Standard Contractual Clauses. The template is available for download at /privacidad and meets the requirements of GDPR Article 28.

Server location

Data for European clinics is hosted in EEA regions (Frankfurt, Madrid) when the plan allows. Auxiliary US transfers (Resend, Stripe) are covered by the Data Privacy Framework.

Multi-tenant RLS on Supabase

Each clinic only accesses its own data via Supabase Row Level Security. Not even the CBCTHub team can see patient data without express authorization: staff access is logged and notified.

LOPDGDD compliance checklist for your center

• Appoint a Data Protection Officer and notify the AEPD.
• Maintain an up-to-date Record of Processing Activities.
• Sign a DPA with CBCTHub and every processor.
• Use a current informed-consent template reviewed by a lawyer.
• Document a procedure for handling data subject rights.
• Have an incident-response plan with the 72-hour clock.
• Apply retention policies per Law 41/2002 and regional rules.
• Train staff annually on data protection.
• Schedule a biennial security audit.

FAQ

Can I send CBCT scans by Gmail or WhatsApp?

Not directly. Gmail and WhatsApp do not meet GDPR Article 32 requirements for health data because they do not guarantee verifiable end-to-end encryption or proper access control. The correct approach is to send a secure link generated by CBCTHub.

How long must I retain the CBCT scan?

Minimum five years from discharge per Law 41/2002, up to fifteen in some autonomous regions. For implant imaging, many clinics keep records throughout the lifetime of the implant.

What happens if I lose a CD with patient data?

You have 72 hours to notify the AEPD and, if the risk is high, inform affected patients. Failure to notify is a very serious infraction with a fine of up to EUR 20 million.

Do I need to sign anything with CBCTHub?

Yes. GDPR Article 28 requires a Data Processing Agreement. CBCTHub provides one as a downloadable template at /privacidad.

Official resources

• Spanish Data Protection Agency (AEPD)
• LOPDGDD 3/2018 (BOE)
• EU Regulation 2016/679 (GDPR)
• Law 41/2002 on Patient Autonomy

Download the CBCTHub DPA template | Our solution for imaging centers | Plans and pricing

This article is informational and does not constitute legal advice. Consult with a lawyer specialized in data protection for your specific case.