This is general information, not legal advice. Requirements and supervisory authority guidance differ between EU and EEA countries, so check your national law and your professional body’s guidance as well.

Why a therapist needs a DPA at all

In GDPR terms, you are the controller: you decide why and how your clients’ data is processed. A software provider that stores or handles that data for you is a processor. Article 28 says a controller may only use processors that give “sufficient guarantees” of appropriate technical and organisational measures, and that the relationship must be governed by a contract with specific minimum content.

For a therapy practice the stakes are higher than for most small businesses. Session notes, appointment histories and even the fact that someone is your client are health data — a special category under Article 9. If your software provider has a breach, it is still your clients who are affected, and you are the one who has to answer their questions and, in many cases, notify the supervisory authority.

The DPA is often a separate document, an annex to the terms of service, or a page you accept online. The format does not matter; the content does. If you cannot find a DPA for a tool that holds client data, that is the first red flag. For the wider picture, see our practical guide to GDPR for therapists.

Which of your tools need one

Make a quick list of every service that touches client information. Typical candidates in a private practice:

Practice management or record-keeping software

Client records, session notes, documents and invoices — usually the most sensitive data you hold.

Booking and reminder tools

Names, contact details and appointment times. Combined with your profession, that alone reveals that someone is in therapy.

Cloud storage and email

If you send reports, intake forms or invoices as attachments, your email and storage providers process them.

Video, messaging and AI tools

Anything that records, transcribes or summarises sessions processes the most sensitive data of all.

AI tools deserve special care; we cover them separately in Can therapists use ChatGPT?

The checklist: what the DPA should say

Article 28(3) lists what a processor contract must cover. Use the table below as a reading guide. You do not need to understand every legal phrase — you need to find each point and check that it is not watered down.

Clause	What to look for
Subject matter, duration, nature and purpose	A clear description of what data is processed (including health data), about whom, and for how long.
Documented instructions only	The provider processes your clients’ data only on your instructions — not for its own purposes such as marketing or training models.
Confidentiality	Staff with access are bound by confidentiality. Ideally, access is limited to what is strictly necessary.
Security measures (Art. 32)	Concrete measures such as encryption at rest and in transit, access control, backups and testing — not just “industry standard”.
Sub-processors	A list of sub-processors, your right to be informed of changes in advance, and a way to object.
Help with data subject rights	The provider helps you answer access, correction and erasure requests (Arts. 15–17) — for example through an export.
Breach notification	The provider tells you “without undue delay”, so you can meet your own 72-hour deadline under Art. 33.
Deletion or return at the end	When you leave, you can export your data and the provider deletes it within a stated period.
Audits and information	You can request the information needed to demonstrate compliance, such as certifications or audit reports.
International transfers	Where data leaves the EU/EEA, the legal transfer mechanism is named (for example adequacy or standard contractual clauses).

Red flags worth a second look

A DPA can tick every Article 28 box on paper and still leave you exposed. These clauses are worth reading twice:

The provider may use “aggregated”, “anonymised” or “de-identified” data for its own purposes, without saying how anonymisation is done.

Client content may be used to improve the service or train AI models, or this is on by default and you have to opt out.

Sub-processors can change without notice, or the list is “available on request” only.

Breach notification is promised within a fixed period that leaves you little or no time to meet your own 72 hours.

There is no clear export route, or deletion after termination has no time limit.

The DPA only exists for higher-priced plans, while lower plans still store client data.

None of these automatically make a tool unusable, but each one is a question you should be able to answer before you put client data in.

Encryption changes what a processor can see

The DPA describes promises. Architecture decides what is actually possible. If a provider can read your session notes in plain text, the DPA is the main thing standing between those notes and misuse, a careless employee or a compromised account. If the data is end-to-end encrypted with a key only you hold, the provider stores data it cannot read, which considerably narrows what could go wrong on its side.

In PRAXINGO, client data is end-to-end encrypted with a key derived from your own encryption password, so PRAXINGO cannot read it. You keep a recovery key in case you forget the password. Encryption does not replace a DPA — you still need the contract — but it is a strong answer to the Article 32 question “what measures protect this data?”. You can read how it works on our security page.

How to review a DPA in under an hour

Download the DPA and the current sub-processor list, and save them with the date. Terms change; you want the version you agreed to.
Go through the checklist table above and highlight where each clause is covered. Note anything missing.
Search the text for “anonymised”, “aggregate”, “improve” and “train” to find secondary uses of your data.
Check where the data is stored and which transfer mechanism applies if it leaves the EU/EEA.
Find the export and deletion procedure, and try the export once with test data.
Email the provider any open questions and keep the answers with the DPA.
Record the tool in your records of processing activities (Article 30) with a link to the DPA.

What to keep on file

The GDPR expects you to be able to demonstrate compliance (the accountability principle in Article 5(2)). For each processor, a short folder is enough:

The signed or accepted DPA, with the date and version.

The sub-processor list at the time you signed, and any change notices since.

A short note on what data the tool holds and why — this feeds your Article 30 record.

Your notes on security measures, such as encryption and two-factor login.

The export and deletion procedure, so you can leave cleanly.

Review the folder once a year, and whenever a provider announces new sub-processors. Keep in mind that how long you keep the client records themselves is a separate question — see how long therapists should keep client records in Europe. If a review shows that a tool no longer fits, our guide to switching practice software without losing data walks you through the move.

Fewer tools, fewer contracts

Every additional tool is another DPA to read, another sub-processor list to watch and another place a breach can happen. Many therapists end up with a booking app, a signature tool, an invoicing tool and a notes app — four processors for one practice. Bringing appointments, documents, notes and invoicing into one system reduces that to one contract to review. See the features and pricing pages for what PRAXINGO covers.

Frequently asked questions

Do I need a DPA if I am a sole practitioner?

Yes. Article 28 applies regardless of the size of your practice. As soon as a provider processes client data on your behalf, you need a processor contract.

Is accepting the DPA online enough, or does it need a signature?

The GDPR allows the contract to be in writing, including electronic form. An online acceptance is common; keep a copy of the version you accepted and the date.

Can I negotiate a DPA with a large software provider?

Usually not. Your real choice is between accepting it and choosing another provider — which is why reading it before you start matters.

Does end-to-end encryption mean I do not need a DPA?

No. The provider still stores and handles data for you, so you still need the contract. Encryption reduces what the provider can see and strengthens your security measures.

One system, one contract to review

End-to-end encrypted notes, documents, appointments and invoicing in one place.

Start free trial

14-day free trial · no credit card required

Data processing agreement checklist for therapy software