GDPR for therapists: a practical guide for private practice

Why therapy data is treated differently

Most of what you record about clients is “data concerning health”, one of the special categories in Article 9 of the GDPR. That covers more than diagnoses and session notes. An appointment history with a psychotherapist, an invoice that says “individual therapy session” or an intake form about sleep and mood all reveal something about a person's health. Processing special-category data is prohibited unless one of the exceptions in Article 9(2) applies, and it comes with a higher expectation of security.

As the practitioner who decides why and how this data is processed, you are the controller. That is true even if you work alone from a rented room. The software, email provider and SMS service you use are processors working on your behalf. Understanding this split is the key to almost everything else in this guide.

Your lawful basis: it is usually not consent

Many therapists assume that a signed consent form is their GDPR basis for keeping notes. In most cases it is not. You typically need two things: a lawful basis under Article 6, such as performing the therapy agreement with the client or a legal obligation to keep records, and an exception under Article 9(2) for the health data itself. For health care provided by a professional bound by secrecy, Article 9(2)(h) is commonly relied on, but how it applies depends on national law and on whether your profession is regulated in your country.

Why does this matter? Consent can be withdrawn at any time. If your notes rested only on consent, a client could ask you to delete records that you are legally or professionally required to keep. Consent still has its place, for example for optional things such as sending a feedback request or sharing information with a GP, but it should be specific, separate and as easy to withdraw as to give. If you are unsure which basis applies to your profession, ask your professional body.

The documents every practice should have

GDPR compliance in a small practice comes down to a short set of documents. None of them needs to be long; all of them need to be accurate.

The exemption from Article 30 records for organisations under 250 employees does not help much here: it does not apply when you process special-category data on a regular basis, which every therapist does. For processor agreements, our data processing agreement checklist lists what to look for.

The GDPR articles that matter most in practice

Security: what “appropriate” looks like for a solo practice

Article 32 does not prescribe a list of tools; it asks for measures that fit the risk. For therapy notes the risk is high, so the bar is high too. In practice that means encrypting devices and data, limiting who can access what, and making sure a single lost laptop or compromised account does not expose your whole caseload. Common weak spots are session notes in a generic note app synced to a personal cloud, client names in a shared family calendar, and intake forms arriving as plain email attachments.

End-to-end encryption is one of the strongest measures available. In PRAXINGO, client data is encrypted with a key derived from your own encryption password before it leaves your device, so PRAXINGO cannot read it. A recovery key protects you if you forget the password. Appointments synced to Google Calendar appear anonymised, without the client's name. You can read more on the security page.

When something goes wrong: the 72-hour rule

A data breach is not only a hacker. A stolen phone with unlocked email, an invoice sent to the wrong client or a session note shared by mistake can all count. Prepare a short procedure now, so you are not inventing one under stress:

1. Contain it: change passwords, revoke access, ask a wrong recipient to delete the message.
2. Assess the risk to the clients involved: what data, how many people, how sensitive, and was it encrypted?
3. If there is a risk to clients, notify your supervisory authority within 72 hours of becoming aware (Article 33).
4. If the risk is high, inform the affected clients without undue delay (Article 34).
5. Document every breach, including the ones you decided not to report, with your reasoning.

Encryption matters here too. If lost data was properly encrypted and the key was not compromised, the risk to clients is often much lower, which can change whether you need to notify them.

Client rights and how long you keep records

Clients have the right to access their data, to have it corrected and, in some situations, to have it erased. In therapy, erasure is often limited by a legal duty to keep records for a set period, which national law defines. That period varies widely between countries and professions; our article on therapy record retention in Europe explains how to set yours. Being able to export a client's notes as a PDF makes access requests far less painful.

Common GDPR mistakes in private practice

That last point is increasingly common, so we wrote a separate guide: can therapists use ChatGPT under the GDPR? PRAXINGO also includes ready-made templates for a therapy agreement and GDPR consent that clients can sign digitally, with an audit log of who accepted what; see all features.

Frequently asked questions