What a UK dental practice website costs, and the GDC rules most of them breach

A UK dental practice website costs roughly £1,500 to £5,000 to build outright, or £99 to £299 a month on a subscription. But the price is the easy part. A practice website is a regulated advertisement holding patient data, and most of the ones we look at breach GDC advertising guidance somewhere on the treatments page without anyone noticing.

This is what to look for, what it should cost, and the questions to ask whoever builds it.

Your website is an advertisement, and the GDC regulates it

This is the part that separates a dental website from a plumber's. Everything you publish about your practice sits under the General Dental Council's guidance on advertising, and a web designer who has never read it will cheerfully write you something that breaches it.

The word "specialist" is restricted. You may only use specialist titles if you are on the relevant GDC specialist list. A general dentist with a genuine interest in aligners cannot be an "orthodontist" or "specialise in" clear aligners on the website, however much of it they do. The accurate phrasings are "with a special interest in", "practice limited to", or "experienced in".

That single word appears on an enormous number of practice sites, usually written by a marketer optimising for the search term "implant specialist near me" without knowing it is a standards issue.

Your GDC registration number belongs in your advertising. It is a requirement, not a trust badge, and it is routinely missing.

And it is not the only thing. For every dental professional named on the site, the guidance expects their professional qualification and the country it was obtained in, alongside the GDC number. The site itself is also expected to carry the GDC's address and contact details, details of your complaints procedure, and the date it was last updated.

Go and look at your own site now. Most practice websites we open are missing at least three of those five, and every one of them is a ten minute fix.

Clinical claims have to be objective and substantiated. No unjustified expectations about results. "The best implants in Cambridge" is an Advertising Standards complaint waiting to be made by a competitor who is having a slow week.

The site has to stay current. Personnel and services shown must actually reflect the practice. A dentist who left in 2024 and is still smiling on your team page is a live compliance problem, not a housekeeping one.

None of this is exotic. It is simply not something a general web designer knows, and the liability for getting it wrong sits with the registrant, not the agency.

What it should cost

Route	Typical UK cost
One-off build, freelancer	£1,500 to £3,000
One-off build, agency	£3,000 to £8,000
Pay monthly, general provider	£32 to £99 a month
Pay monthly, with compliance work included	£150 to £300 a month
Hosting and maintenance on top of a one-off build	£30 to £100 a month

Build and subscription figures are drawn from published UK cost guides accessed in July 2026 (getyouonline.co.uk, zentus.agency, edthedev.co.uk) and from the live prices of twelve UK pay monthly providers we surveyed in the same month. They are bands, not quotes, and any provider can sit outside them.

The £32 a month end of that market is real and the sites are often fine. What you are not buying at that price is anyone who has read the paragraph above.

The pages that actually pay for the site

A practice website earns its money on a very small number of pages, and most of the budget gets spent elsewhere.

The high-ticket treatment pages. Implants, orthodontics and cosmetic work. One implant patient is worth more than the entire annual cost of the website. These pages need clear pricing or finance information, honest expectation-setting, and before and after imagery you have proper consent for.

The new patient enquiry flow. Not a contact form at the bottom of a contact page. A short form, visible on a phone, on the pages people actually land on.

The practice page. Team, registration numbers, opening hours, how to find you, and whether you are taking NHS patients. Boring, and the most-visited page after the homepage.

The part almost nobody asks about

Your website takes personal data. A new patient enquiry form collects a name, a phone number and, very often, a description of a problem in the patient's own words because the field said "how can we help?".

That last one is health data, which is a special category under UK GDPR with a higher bar than ordinary personal data.

Which makes your website provider a processor acting on your behalf, and UK GDPR Article 28 expects that relationship to be governed by a written contract. In practice that is a Data Processing Agreement.

We checked twelve UK pay monthly website providers in July 2026 for what they publish. Three mentioned a Data Processing Agreement anywhere on their public site.

That is not an accusation. Some of the other nine will send you one on request. But if you are the registered practice, you are the controller, and the questions land on your desk.

The Tuesday morning question

Suppose your site is compromised. Not a dramatic hack, just an unpatched component, which is how it usually goes.

If personal data was accessible, you may have a notifiable breach, and UK GDPR gives you 72 hours from becoming aware to assess it and, where there is risk to people, tell the Information Commissioner's Office. Not 72 working hours. Three days including the weekend.

So: who do you call?

If the honest answer is a support inbox at a provider who has never mentioned data protection, has no DPA, and cannot tell you which country your patient data sits in, then you will be the one answering the ICO, and your indemnity insurer will ask why you did not check.

Ten questions to ask any provider

Send these to whoever you are considering, including us.

1. Have you read the GDC guidance on advertising, and will you flag copy that breaches it?
2. Will you sign a Data Processing Agreement, and can I see it before I commit?
3. Where is the site hosted and in which country is the data held?
4. Who patches the software this site runs on, and how often?
5. What happens if the site is compromised, and what does that cost me?
6. What is the minimum term and what notice do I give to leave?
7. If I leave, what do I pay? A number, not a process.
8. Who owns the design, the code and the content when it ends?
9. How many content changes are included and what is the turnaround?
10. What is your company registration number?

A competent supplier answers all ten in about ten minutes. The ones who will not have told you something useful.

When a cheaper provider is the right answer

We would rather say this than have you find it out later.

If your practice is fully booked, not taking new patients, and the website exists so people can find your address and phone number, do not spend £200 a month on it. Get a clean, fast site built once, keep the GDC issues out of the copy, and put the money into the practice. A £32 a month provider will serve you perfectly well.

The compliance work matters when you are actively marketing high-ticket treatments, when you hold patient enquiries in a form, and when somebody, an insurer, an NHS contract, a corporate acquirer, is eventually going to ask you to evidence how you handle data.

That is a narrower group than every dentist in Britain, and we would rather be honest about which one you are in.

What we do

The Practice plan is £199 a month plus a £795 build, twelve months then rolling, and it includes a signed Data Processing Agreement, a written data protection and website security statement, a compliant cookie and consent configuration, supplier security questionnaires answered on request, and an annual written review. Security patching is in the monthly fee and is never billed separately.

It is prepared by a certified security auditor, which in this market is unusual, and in your position is the entire point.