Data protection and record keeping for therapists in private practice

A plain-English starter checklist for UK counsellors, psychotherapists and other practitioners setting up on their own. It covers the basics you’ll usually need under UK GDPR, with links to the Information Commissioner’s Office (ICO) so you can check the detail for yourself.

Read this page aloud Uses your browser’s own voice. Nothing is sent to us.

Does this apply to you?

Almost certainly, yes. If you keep any information about clients, such as names, contact details, session notes, emails, texts, invoices or a diary, on paper or on a device, data protection law applies. When you work for yourself, you’re usually the controller: the person who decides why and how the information is used, and who is responsible for it.

If you see some clients through an agency, clinic or employee assistance programme, that organisation may be the controller for those records, or you may share the role. Your contract should say who is responsible for what. The ICO explains controllers and processors, and has a short check on whether data protection law applies to your business.

The ICO data protection fee

Most organisations that use personal information, including sole traders, must pay a yearly data protection fee to the ICO unless they’re exempt. Practitioners who keep client records on a computer or phone will usually need to pay. The ICO’s fee self-assessment takes about ten minutes and tells you whether you need to pay and which tier applies. We haven’t quoted the amounts here because they can change; the ICO’s data protection fee page has the current figures.

The ICO publishes a public register of fee payers, so check what will be shown before you register, and think about which address you give.

Your lawful basis for health information

Information about a client’s mental or physical health is special category data, which has extra protection. To use it, you need both a lawful basis (such as contract or legitimate interests) and a separate condition for special category data. Many health and care practitioners look at the condition for health or social care purposes, which applies when the work is done by, or under the responsibility of, someone with a duty of confidentiality.

Consent isn’t the only option, and often isn’t the best one, because people must be able to withdraw it at any time. Read the ICO’s guidance on lawful basis and on the conditions for special category data, decide which apply to you, and write your reasons down. If you’re unsure, ask your professional body or a data protection adviser.

Telling clients: your privacy notice

Clients have a right to know what you collect, why, who you might share it with, how long you keep it and what their rights are. A short privacy notice, given at or before the first session alongside your contract, covers this. The ICO has a free privacy notice generator, including a version for health and social care.

• Explain the limits of confidentiality in plain words, for example if you’re worried about someone’s safety, or if the law requires you to share.
• Say whether you talk about your work in supervision, and that you don’t share names or identifying details there.
• If you have a website with analytics or a contact form, it needs its own privacy information too.

What to write in your notes

Your notes are personal data, and clients can ask for a copy. That includes brief process notes if they’re about an identifiable client. Writing as though the client might read them one day is a good habit.

• Keep only what you need for the work and for safe practice.
• Be factual and respectful, and make it clear what is your opinion rather than fact.
• Record risk discussions and decisions, and any contact with other professionals, with the date.
• Consider keeping contact details separate from session notes, and using initials or a code in the notes themselves.
• Completed worksheets, such as those in our free toolkit, form part of the client record too.

Your professional body’s guidance on record keeping, and your insurer, can tell you what they expect.

Keeping records secure

UK GDPR asks for security that fits the risk, and therapy records are sensitive. Practical steps include:

• Turn on encryption and a screen lock on every laptop, tablet and phone you use for work.
• Use strong, unique passwords and two-step verification on email, cloud storage and practice software. Keep devices updated.
• Don’t keep client records on a shared family computer. Lock paper records away.
• Use a separate work email address and phone number where you can.
• Before you use practice software, cloud storage, video platforms or an online notes service, check where the data is stored and that the provider offers written data processing terms. You need a contract with any provider that handles client data for you.
• Be very careful with AI transcription or note-taking tools. Check how the data is used and stored, get your client’s informed agreement, and look at whether you need a data protection impact assessment first.

The National Cyber Security Centre’s guide for small organisations and the ICO’s guide to data security are good free starting points.

How long to keep records

The law doesn’t set one fixed period for therapy records. It says you shouldn’t keep personal data for longer than you need it, and that you should be able to explain why (the storage limitation principle). Check your professional body’s and insurer’s guidance, think about possible complaints or claims and about any clients who were under 18, then decide your period and write it in a short retention policy. When the time comes, delete or shred records securely, and keep a note that you did.

Requests and complaints

• Subject access requests. Clients can ask for a copy of the information you hold about them, by any means, including by text or in a session. You usually have one month to respond, which you can extend by up to two further months if a request is complex. See the ICO’s guide to the right of access.
• Health information. There are special rules for health information, including a limited exemption where disclosure would be likely to cause serious harm. The ICO’s page on health information explains them. Talk it through with your supervisor or professional body before you rely on it.
• Other rights. Clients can also ask you to correct inaccurate information, and in some cases to delete it.
• Data protection complaints. You must give people a way to make a data protection complaint to you, acknowledge it within 30 days and respond without undue delay. The ICO explains how to deal with data protection complaints. This sits alongside your professional body’s complaints process.
• Newsletters and marketing. If you’d like to send emails or texts about your services, you usually need clear consent first under the Privacy and Electronic Communications Regulations.

If something goes wrong

A personal data breach could be a lost phone, an email sent to the wrong person or a hacked account. If it happens:

1. Act straight away to contain it, for example by recalling the email, changing passwords or wiping a lost device remotely.
2. Work out what information was involved and how likely it is to harm anyone.
3. If it’s likely to put people at risk, report it to the ICO within 72 hours of becoming aware of it. The ICO has a report a breach page with a self-assessment.
4. If the risk to a client is high, tell them without undue delay, and think about how to do that kindly.
5. Keep a short record of every breach, including ones you didn’t need to report, and what you changed afterwards.

The ICO’s 72 hours: how to respond to a personal data breach walks you through it. Let your insurer know too, as your policy may require it.

Planning for the unexpected

If you were suddenly ill or died, someone would need to tell your clients and look after their records safely. Many professional bodies recommend a clinical will (sometimes called a professional will) naming a trusted colleague to do this. Check what your own body suggests, and make sure your privacy notice mentions it.

One-page checklist

1. Taken the ICO fee self-assessment, and paid the fee if you need to.
2. Written down your lawful basis and your condition for health information.
3. A privacy notice you give to every client, alongside your contract.
4. Encryption, screen locks, strong passwords and two-step verification on every work device and account.
5. Written data processing terms with each provider that holds client data.
6. A retention period, written down, and a way to delete records securely.
7. Know how you’ll handle a subject access request, a data protection complaint and a breach.
8. A clinical will, or a named colleague, in place.

If a client is at risk, follow your safeguarding procedures and professional guidance first; data protection law allows you to share information when it’s necessary to protect someone. Our guidance on enquiries from under-18s or people in crisis may also help.

Registered practitioners can list on Therapist Circle free, with no subscription or commission, if that’s ever useful. See free listing for therapists, and our guide to writing a clear, honest therapist profile.

Last reviewed 19 October 2026. General information only, written for UK practitioners. Not legal, regulatory or professional advice. Not affiliated with the NHS, the Information Commissioner’s Office, the Health and Care Professions Council or any professional body.

Free listing for therapists · Free therapist toolkit · Enquiries from under-18s or people in crisis · Free website badge