GDPR for Therapists: A Guide to Client Records and Data Protection

Client notes are some of the most sensitive personal data a small business handles anywhere in the UK, and a private therapy practice is a small business whether or not it feels like one. GDPR isn't optional paperwork you get to once the diary is full. It's the legal framework for how you collect, store, use and eventually delete everything a client tells you.

This guide covers GDPR for therapists working in private practice in the UK: whether you need to register with the ICO, what makes therapy notes "special category data," how long to keep records, how to store them securely, what client rights actually mean in practice, and what to do if something goes wrong. It expands on the data protection step in our guide to setting up a private therapy practice.

Important: This is a practical overview, not legal, tax, regulatory or professional advice. Data protection law applies to your specific circumstances, and this article can't account for every variation. Check current ICO guidance and your professional body's position, and get independent advice if you're unsure.

What GDPR for therapists actually covers

GDPR applies to everyone processing personal data in the UK, but a therapy practice has two features that raise the stakes: the records are unusually sensitive, and clients are trusting you with them at a vulnerable moment. The sections below work through the practical decisions this creates, from registration to retention to what happens if something goes wrong.

Do you need to register with the ICO?

Most UK organisations that process personal data as a "controller" (the term for whoever decides why and how data is used) need to pay the ICO's annual data protection fee. The exemptions are narrow and specific: they cover things like staff administration, advertising and marketing for your own business, and basic accounts and records, according to the ICO's own list of exemptions. Processing client contact details, session notes, assessments or referral information to actually deliver therapy isn't one of the listed exemptions, so most private practitioners need to register.

The fee has three tiers based on turnover and staff numbers, set out by the ICO:

A sole practitioner or small practice will almost always land in Tier 1. Registration itself doesn't change what you're required to do under GDPR; it's a separate legal requirement to pay a fee and appear on the public register. The ICO publishes a short online self-assessment if you want to check your own position rather than rely on a general guide like this one.

What makes therapy notes "special category data"

Under UK GDPR, certain categories of personal data get extra protection because of the harm that could follow if they were mishandled. Health data is one of them, and the ICO's guidance on special category data is clear that this includes anything revealing a person's physical or mental health. Session notes, assessments, risk information and referral letters all sit inside that definition.

To process special category data lawfully, you need two things at once, not one:

1. An ordinary lawful basis under Article 6. For a client who has asked you for therapy, this is usually contract (see the next section).
2. A separate condition for processing special category data under Article 9. The usual choices are the condition covering the provision of health or social care, or explicit consent.

In practice, this mostly changes how carefully you should document consent and how you talk to clients about what you record and why, more than it changes your day-to-day note-taking.

Choosing a lawful basis for client data

Before you collect any client data, you should be able to say, clearly, why you're allowed to hold it. Many therapists assume the answer is consent, but that usually isn't the best fit. You can't offer therapy without keeping some records, so agreeing to those records is a condition of the service. The ICO's guidance on when consent is appropriate says consent is unlikely to be the most appropriate basis in that situation, and that where someone has asked you for a service, the contract basis is likely to fit better, including for special category data.

For the Article 9 condition, the ICO's page on the conditions for processing special category data explains the health or social care condition. It applies where the processing is done by, or under the responsibility of, a health professional or someone who owes a duty of confidentiality, which can include a counsellor who owes clients a professional duty of confidentiality. Explicit consent remains possible, but the ICO says to take particular care when consent is a condition of the service, because you'd need to show it was still freely given.

None of this means you stop explaining things to clients. You still tell them, in plain terms and before therapy starts, what you'll keep, why and for how long. That's the right to be informed, and it applies whatever lawful basis you use. If you're not sure which basis fits your practice, the ICO's lawful basis guide and interactive tool are the place to check.

Some information sits under a different basis again. Basic accounting records (invoices, payment history) are usually processed under a separate lawful basis tied to your legal obligation to keep financial records. It's worth being clear in your own mind which lawful basis applies to which kind of data you hold, rather than treating "client agreed to therapy" as a blanket justification for everything in your systems. Consent is still the right basis for genuinely optional extras, such as adding a client to a newsletter.

How long should you keep client records?

This is the question therapists ask most often, and the honest answer is that there's no single fixed number in UK law. GDPR's storage limitation principle simply requires that you don't keep personal data for longer than you need it for the purpose you collected it. BACP has written that there's no simple answer to how long notes should be kept, but points out that because its own complaints procedure gives a client up to three years after therapy ends to raise a complaint, many practitioners use three years as a practical minimum.

A few things are worth building into your own policy:

• Write your retention period down, even if it's a minimum rather than a hard rule, and tell clients what it is before therapy starts.
• Check your professional body and insurer, since guidance varies. Some insurers suggest six years or more, because the Limitation Act 1980 generally allows six years to bring a claim for breach of contract, and some recommend longer retention where a client was under 18 during treatment, given the extra time they may have to raise a claim after reaching adulthood.
• Review, don't just accumulate. A retention period only works if you actually act on it, rather than keeping every record indefinitely because deleting anything feels risky.

If you're deciding on the structure for your practice's finances and record-keeping obligations more broadly, our guide to sole trader versus limited company for therapists covers the separate (and usually longer) retention rules that apply to business and tax records.

Storing records securely: notes, email, booking systems and cloud tools

GDPR doesn't mandate a specific piece of software, but it does require "appropriate technical and organisational measures" to keep personal data secure. In practice, for a small therapy practice, that usually means:

• Encrypted or password-protected storage for notes, whether that's a dedicated practice management tool or an encrypted folder, not a plain document on a shared family computer.
• A secure, professional email address, ideally one that supports encryption at rest, rather than routing sensitive client correspondence through a personal inbox shared with other accounts.
• Checking your booking and payment tools, since a contact form, calendar or payment system on your website is also processing personal data on your behalf, and you're responsible for it being handled appropriately.
• Access control, so that if you work with a VA, bookkeeper or colleague, they only see the client information they genuinely need.

Our guide to website maintenance for therapists covers the practical side of this, including backups and keeping the software behind your booking forms and contact pages up to date, which is itself part of keeping data secure.

Client rights: access, correction and erasure

Clients have a set of rights over their own data under UK GDPR, and it's worth knowing the shape of them even if requests are rare in a small practice:

• The right to access their own data (a "subject access request"), which you generally have one month to respond to.
• The right to correction if information you hold about them is inaccurate.
• The right to erasure, sometimes called the right to be forgotten. The ICO is explicit that this right is not absolute: it applies in specific circumstances, and you can refuse in others, for example where you have a genuine legal or professional reason to keep a record, such as being able to respond to a future complaint.

If a client asks about their records, treat it as a genuine request rather than an inconvenience, but you don't have to delete everything on demand. Explain, calmly and in writing, what you can and can't do and why.

A newer duty: handling complaints yourself

This is the part of GDPR for therapists that's changed most recently, so it's worth its own section rather than a line in a general checklist. Since 19 June 2026, the Data (Use and Access) Act 2025 has put a new statutory duty on every organisation that processes personal data, and the ICO has confirmed the new legal duty applies to all organisations handling personal data, regardless of size. In practice, you now need to:

• Give clients a way to complain to you directly about how you've handled their data, not just point them to the ICO. An email address is enough; you don't need a dedicated portal.
• Acknowledge a complaint quickly and respond within 30 days, explaining what you found and what you did about it.
• Tell clients they can complain to you, as well as to the ICO. The ICO's guidance is specific that this needs to happen at the point you collect their information, which for most therapists means it belongs in your privacy policy, not just somewhere you'd mention it if asked.

The ICO's own step-by-step guide for small organisations is worth reading in full if you don't already have a complaints process; it's short and written for exactly this size of business, not a large employer with a dedicated compliance team.

If your privacy policy still only mentions the right to complain to the ICO, that's now out of date. UpTopWeb has already added this clause to every customer's privacy policy as part of keeping them current, which is one of the things that separates a website that's actually maintained from one that was simply built once and left alone.

What to do if you have a data breach

A data breach isn't only a hack. Losing an unencrypted laptop, sending a client's notes to the wrong email address, or a booking system being compromised all count. The ICO's guidance on personal data breaches sets out the core rule: if a breach is likely to result in a risk to people's rights and freedoms, you must report it to the ICO within 72 hours of becoming aware of it, and tell the affected individuals without undue delay if the risk is high. Not every incident meets that bar, but you should still record it internally either way. If the incident is a hacked website, our guide to therapist website security covers what to ask your host and what to do first.

Having a rough plan before anything happens helps: know where your data lives, know who to contact, and don't wait to fully understand the incident before starting the 72-hour clock.

GDPR on your therapist website

Your website is also processing personal data the moment it has a contact form, a booking widget, an email newsletter sign-up or analytics running in the background. That means it needs a clear, accurate privacy policy explaining what you collect and why. Our guide to what a therapist website should include covers this alongside the other pages and trust signals a therapist site needs.

Cookie banners and cookie consent

If your website sets anything beyond strictly necessary cookies (analytics, embedded video, marketing pixels or a chat widget, for example), this isn't governed by UK GDPR alone. The Privacy and Electronic Communications Regulations (PECR) require you to get consent before those cookies are set, not just disclose them somewhere on the site. The ICO is specific that consent must be a genuine, unambiguous positive action (more than simply continuing to browse), that you cannot set non-essential cookies before that consent is given, and that people need a way to decline non-essential cookies that's genuinely as easy as accepting them.

The ICO published finalised guidance on cookies and similar technologies in April 2026, and has been actively auditing UK websites' cookie banners against exactly this point: a prominent "Accept" button next to a small, easy-to-miss link to "manage settings" isn't treated as a genuine choice. In practice, a compliant banner should:

• Explain in plain language what you use cookies for (for example, "to understand how visitors use this site" for analytics), not just that "this site uses cookies"
• Offer "Accept" and "Reject" as equally easy, equally visible choices on the first screen, not one button plus a buried settings link
• Not set analytics, marketing or embed cookies until the visitor has actively consented
• Link through to a fuller cookie policy for anyone who wants the detail, without making that the only way to actually decline

Strictly necessary cookies, the ones a site genuinely can't function without (remembering the visitor's cookie choice itself, or session security), don't need consent, but your cookie policy should still explain what they are.

Cookies are only one part of what makes a website itself GDPR compliant; see our GDPR compliant website checklist for therapists for the contact form, third-party embed and data storage checks that sit alongside this.

Common questions therapists ask about GDPR

These are the practical questions that come up most often once the basics are in place. Each answer is short, with a link to a fuller guide where we have one.

Do I need encrypted email?

Not in every case, but sensitive client information shouldn't travel by ordinary email without some protection. The ICO's encryption scenarios treat encrypted email as something to consider based on what you're sending, with encrypted attachments as an alternative. If you password-protect an attachment, send the password a different way, such as by text or phone, never in the same email. Day-to-day scheduling messages don't need the same treatment, which is one reason to keep clinical detail out of routine email altogether.

How should I send reports to a GP, referrer or solicitor?

Treat these as the highest-risk messages you send. Check the recipient's address every time (health information sent to the wrong person is a personal data breach), send only what the request actually needs, and use encryption or a password-protected file with the password sent separately. For paper copies, use a tracked, signed-for postal service so you can show where the documents went.

Is Zoom, Teams or Google Meet OK for sessions?

Usually yes, if you use a business account with the provider's data processing terms in place and set it up carefully. The account type matters more than the brand. Our online counselling guide compares the main platforms. If you ever record a session, for training or supervision for example, get the client's explicit agreement first and tell them why, where the recording will be kept and when it will be deleted.

Can I use a US-based provider?

Often, yes. Since 12 October 2023, the UK-US data bridge has allowed personal data to go to US organisations certified to the UK Extension of the EU-US Data Privacy Framework. Check that the provider is certified, or that its contract includes other approved safeguards, and say in your privacy notice that data may be stored outside the UK. Older guides that rely on the "Privacy Shield" are out of date: that scheme was struck down in 2020.

What about client details on my phone?

Treat your phone like your laptop: a strong passcode, encryption and remote wipe switched on, and no client information sitting in personal messaging apps or your camera roll. Our practice management software guide covers device security, and how to keep paper notes separate from anything that identifies the client by using a client code.

How long should I keep enquiries from people who don't become clients?

Only as long as you need to answer them and deal with any follow-up. Set a short period, such as a few months, write it in your privacy notice and delete on schedule. Your contact form should also ask people not to send clinical detail before you've spoken. Our GDPR compliant website checklist covers how to set the form up.

Can I talk about clients in supervision?

Yes, supervision is part of safe practice, but share only what you need and leave out names and identifying details wherever you can. Tell clients in your contract that you discuss your work in supervision, and on what terms. Our guide to clinical supervision for counsellors covers the wider arrangements.

Who owns the notes if I work for an agency, EAP or group practice?

It depends on who decides what records are kept and why. The ICO's guide to controllers and processors explains the terms: the controller decides the purposes and means of processing, and a processor only acts on its instructions. An agency that sets your record-keeping rules is likely to be a controller of those records, and as a professional working under your own obligations you may be a controller too. Get it agreed in writing before you start, including what happens to notes if you leave. Our guide to starting a group practice covers this from the practice owner's side.

What must my privacy notice include?

The ICO's right to be informed guidance sets out the list. For a solo practice, that means: who you are and how to contact you, what you collect and why, your lawful basis, who you share it with, any transfers outside the UK, how long you keep it, clients' rights, and their right to complain to you and to the ICO. Clients need this at the point you collect their information, so link it from your website forms and refer to it in your contract.

How do I know if I'm GDPR compliant?

There's no official certificate for a small practice. The practical test is whether you can answer the checklist below honestly, and the ICO's self-assessment tools for small organisations are a useful second check.

GDPR checklist for private practice

• Registered with the ICO and paying the correct fee tier (or confirmed you're genuinely exempt)
• Clear, written record of your lawful basis for processing client data
• A retention period decided, written down and told to clients
• Notes and client communication stored securely, not on shared personal accounts
• A process for responding to access, correction or erasure requests
• A way for clients to complain to you directly, acknowledged and answered within 30 days
• A basic breach response plan, even a simple one
• An accurate privacy policy that explains how to complain to you as well as to the ICO
• A cookie banner that makes rejecting non-essential cookies as easy as accepting them

Start with the basics, then build the rest

You don't need a compliance department to handle this well. Register if you need to, be honest with yourself about how long you're actually keeping records and why, store client data somewhere secure, and be ready to explain your approach if a client or the ICO ever asks. Most of GDPR, for a small therapy practice, comes down to being able to answer a simple question clearly: what do you hold, why, and for how long.

Frequently asked questions

---

A therapist website built with data protection in mind

UpTopWeb builds calm, professional websites for therapists with a proper privacy policy, secure forms and hosting handled for you, so this is one less thing to worry about.

Get my free website