UK GDPR for Therapists and Counsellors: A Complete 2026 Guide

---

My team and I spend our working weeks on the other side of the questions in this guide. We build Therasee, which means therapists trust us with everything about their clients: contact details, bookings, intake forms, assessments, messages, invoices, video sessions, and clinical notes. So we have had to work through UK GDPR from the inside: deciding where client data is stored, which companies we trust to handle it on our behalf, and which AI services we would and would not let anywhere near clinical information.

Two things have stayed with us from that work. The law is far less frightening than it looks. And the questions that matter most are the ones therapists are rarely told to ask.

We should also own up to something. We wrote the first version of this guide in May 2026 and chose not to publish it. Too much was about to change at once: the new complaints rules were weeks away, the BACP was finalising its 2026 Ethical Framework, the regulator was preparing to become the Information Commission, and every professional body was working out its position on AI. A guide published then would have been out of date almost as soon as it went live.

Even now, I would rather be honest with you. The core of UK GDPR is stable, and most of what follows will hold for years. The guidance around AI is not. Regulators, professional bodies and the tools themselves are all moving quickly, and I expect that to continue. So we will keep this guide updated as things change, and the date at the top tells you when it was last revised.

My team and I have also spoken to a lot of counsellors, psychotherapists and psychologists who feel that UK GDPR is a fog they cannot see through. The acronyms pile up, the law has been quietly amended again, and the AI question seems to have arrived overnight. It is easy to come away thinking compliance is a full second job sitting on top of clinical practice.

It does not have to be. For most UK private practices, GDPR comes down to a handful of habits, written down once and revisited now and then. And if you already work to the BACP Ethical Framework, or another professional code, you are closer than you think. Confidentiality, consent, and care with records are the heart of good practice, and they are the heart of data protection law too. The law just uses different words.

This guide walks through those habits as they stand in 2026, in plain English: what changed under the Data (Use and Access) Act 2025, how it connects to your professional body's code, how to handle AI tools, and how to choose software you can justify if anyone ever asks.

This is a practical guide, not legal advice. You can follow what is coming next on the ICO's planned guidance page. For anything genuinely uncertain, the ICO's small organisations helpline is free and useful.

---

The words you'll meet, in plain English

GDPR has its own vocabulary, and most of the anxiety around it comes from the words rather than the rules. Here are the ones that appear in this guide, and what they actually mean for you.

Personal data. Any information about a living person who can be identified from it. A client's name, email, and appointment times all count.

Special category data. Personal data the law treats as especially sensitive, including anything about someone's health. Your session notes, assessment scores, and even the fact that someone is seeing a therapist all fall here. It is the reason therapists have a few extra steps compared with, say, a hairdresser.

Controller. The person who decides what information is collected and why. In private practice, that is you. You are responsible for your clients' information, even when it sits in someone else's software.

Processor. A company that handles information on your behalf and on your instructions, such as your practice management software, video platform, or email provider.

Sub-processor. A company your processor uses in turn. For example, your booking software might use a separate company to send text reminders.

Lawful basis. The legal reason you are allowed to hold and use someone's information. You need one for everything you do with client data, and you need to tell clients what it is.

Article 9 condition. An extra legal reason you need on top of your lawful basis, because health information is special category data. For most therapists this is the client's explicit consent.

Privacy notice. A plain-language document that tells clients what you collect, why, who sees it, how long you keep it, and what their rights are. It is the data protection version of the conversation you already have about confidentiality.

Data Processing Agreement (DPA). A written contract between you and each processor, setting out how they will look after your clients' information. Software companies usually publish one you accept when you sign up.

Subject Access Request (SAR). A client asking to see the information you hold about them. They do not have to use those words. "Can I see my notes?" counts.

Data breach. Any time client information is lost, seen by someone who should not see it, or changed or destroyed by mistake. A lost phone or an email to the wrong person both count.

Anonymised versus pseudonymised. Anonymised information cannot be traced back to a person, even by someone who knows them. Pseudonymised information has had the name removed but could still be recognised from the details. The law protects anonymised information much less strictly, which is why the difference matters.

The ICO. The UK's data protection regulator. Since 30 September 2026 it is formally called the Information Commission, but it still uses the ICO name. It is there to help small practices get this right, not only to enforce.

Where the law and your ethical framework meet

Whichever professional body you belong to, you already work to many of these principles. The law and your code of ethics often describe the same commitment in different words. The table below uses the BACP's 2026 Ethical Framework as the example, because it is the newest and spells these points out most explicitly. If you are with another body, you will find much of the same ground covered in your own code.

None of this asks you to become a lawyer. It asks you to write down what good practice already looks like.

What has actually changed in 2026

The Data (Use and Access) Act 2025, usually shortened to the DUAA, received Royal Assent in June 2025. It does not replace UK GDPR or the Data Protection Act 2018. It amends them.

The ICO summary is the canonical source. In plain terms, four things matter for a working UK therapist.

Subject Access Requests, when a client asks to see the information you hold about them, have been clarified. Since 5 February 2026 you only have to make a "reasonable and proportionate" search, which means a sensible effort rather than turning your practice upside down. You can also pause the one-month deadline while you confirm who is asking or what they want. Both were already good practice. They are now written into law.

Since 19 June 2026, clients have had a legal right to complain directly to you about how you have handled their information. Every practice, including a sole practitioner, needs an accessible way to receive complaints and a process for handling them. If you have not set this up yet, it is an afternoon's work, and there is a simple way to do it below.

The rules on "automated decision-making", meaning decisions about a person made by a computer with no human involved, have been relaxed for everyday information. They remain strict for health information. In plain terms: software can help you, but it cannot make significant decisions about your clients on its own.

On 30 September 2026 the regulator itself changed shape. The Information Commissioner's Office became the Information Commission, run by a board rather than a single commissioner. It still calls itself the ICO, its website has not moved, and your obligations have not changed. If your privacy notice names the "Information Commissioner's Office", update the wording next time you revise it, but there is no rush.

What has not changed: the core principles of UK GDPR, the requirement to pay the ICO data protection fee, the requirement to have a privacy notice, the 72-hour breach reporting rule, and the status of therapy notes as special category data. If you got those right in 2023, you have not suddenly fallen out of compliance.

Your professional body's rules have changed too

Data protection law applies to everyone equally, but your professional body's code is where it meets your day-to-day practice, and those codes are changing too.

The most significant change this year is the BACP's 2026 Ethical Framework, which became mandatory for BACP members at midday on 3 November 2026. You can read the full Framework as a PDF. Our plain-English guide to the BACP Ethical Framework 2026 walks through the whole framework, clause by clause.

It helps to be clear about what it is and what it is not. UK GDPR is the law, and it applies to anyone who holds client information, whatever their profession. The Ethical Framework is the BACP's code of conduct, and it applies to BACP members. It does not change the law, and meeting one does not on its own mean you meet the other. But the two now overlap more than ever. The 2026 Framework turns several data protection habits into professional obligations: a clear privacy notice, honesty about the limits of confidentiality, secure records, and a clinical will.

The biggest new area is technology. Before using any AI tool, digital tool or online platform, BACP members must assess its risks and be able to show that they:

• know how to use it
• understand how it handles and stores data
• have been open with clients about using it
• have clients' informed consent before putting their personal data into AI or digital tools
• have not handed their decisions over to AI

The Framework also asks members to be able to explain the reasoning behind their decisions. For the software you use, that means being able to say why you chose it. The table above shows where each of these lines up with the law.

If you belong to another body, the principles will feel familiar. The UK Council for Psychotherapy (UKCP), the National Counselling and Psychotherapy Society (NCPS), the British Association for Behavioural and Cognitive Psychotherapies (BABCP), the British Psychoanalytic Council (BPC), COSCA in Scotland, the Association of Christian Counsellors (ACC), the Health and Care Professions Council (HCPC) for practitioner psychologists, and the British Psychological Society (BPS) all expect confidentiality, informed consent, secure records and care for clients if you cannot continue, each in its own words. They are updating their guidance at different speeds, particularly on AI.

So it is worth keeping an eye on your own code as our field changes. A simple habit: each year, when you renew your membership or registration, spend ten minutes checking whether your code or its guidance has changed, and whether anything new has been said about AI or digital tools. Your supervisor is a good person to talk it through with. You do not need to track every body, only your own.

The three pieces of law

You will see three laws mentioned, and it helps to know how they fit together. UK GDPR sets out the main rules: the principles, the legal reasons for using information, and the rights your clients have. The Data Protection Act 2018 adds UK-specific detail, including extra rules for health information. The DUAA updates both. Think of it as one rulebook with two sets of amendments, rather than three things to learn.

HIPAA, the US healthcare privacy law, does not apply in the UK. The ICO enforces the framework, and its small organisations pages are the most useful reference for a sole practitioner.

Why therapy notes are not ordinary data

This is the section that sounds most technical, so let me start with the plain version. Because therapy notes are about someone's health, you need two legal reasons to keep them rather than one. That is genuinely all the "Article 6 and Article 9" language means.

For most information, such as a name and email address, you need one legal reason, called a lawful basis. The law lists six in Article 6. For a private therapist, the usual one is "contract": you need the information to provide the therapy you have agreed to provide.

Health information is different. The law classes it as "special category data", alongside things like religious beliefs and ethnicity, and asks for a second, extra reason from a list in Article 9. One reason is not enough.

For private therapy, two of those extra reasons matter.

Explicit consent (Article 9(2)(a)). The client clearly agrees, ideally in writing, to you keeping their health information for the purposes you have described, and knows they can change their mind. This is the cleanest fit for most counsellors, psychotherapists, and Cognitive Behavioural Therapy (CBT) therapists in private practice.

Health or social care (Article 9(2)(h)). This covers health care provided by a professional who is legally bound to keep things confidential. It fits psychologists registered with the Health and Care Professions Council (HCPC) well. It fits less neatly for therapists registered only with the BACP, UKCP, NCPS, or BABCP, because those registrations are voluntary rather than set by law, and lawyers genuinely disagree about whether they qualify.

So in practice, most counsellors and psychotherapists rely on explicit consent, and most HCPC-registered psychologists rely on health or social care. Either is fine if you set it up properly and say which one you use in your privacy notice.

You may read about a new "recognised legitimate interests" reason introduced by the DUAA. It does not apply to health information, so you can safely ignore it for therapy notes.

One distinction trips a lot of people up. Agreeing to therapy is not the same as agreeing to how their information is handled. You will already talk about consent to the therapy itself. Consent for data needs to be its own clear step: freely given, specific, and easy to withdraw. In practice that means a privacy notice plus a line on your intake form where the client agrees to it separately.

Can therapy notes be stored with a client's personal details?

Yes, if they are kept in a secure system built for clinical records. This is one of the questions we hear most often, and the worry usually comes from a sensible rule for loose records being applied to every kind of record.

The idea usually comes from training. Some widely shared training materials and agency policies, written mostly with paper notes in mind, say that session notes should be kept separately from a client's identifying details, often using a "split notes" system: notes filed under a code, and names, addresses and contact details kept somewhere else. None of this is intended to mislead. It is sound advice for records that can easily go astray: a paper file in a cabinet, a bag or a car, and also general-purpose digital files that were never designed to hold clinical records, such as Word documents, spreadsheets, a notes app, or files on a laptop, a USB stick or a shared drive. If one of those is lost, stolen or opened by the wrong person, nobody can tell whose notes they are. The confusion comes when that advice is taken as a rule for every kind of record, including systems built specifically for clinical records.

A purpose-built system works differently. In most practice management systems, each note sits inside the client's record, protected by encryption, a password and two-step sign-in, and only you and anyone you have authorised can open it. Because the note is already attached to the right person, there is no need to write the client's name or other identifying details into the note itself, and keeping them out of the note text is good practice anyway. What protects the client is the security around the whole record, not keeping the notes in a different place.

That is also what the law asks for. Article 32 of UK GDPR asks for security that fits the risk, and lists pseudonymisation (keeping identities apart from the information, usually with codes) as one measure to use "as appropriate", alongside encryption and controlled access. The ICO describes pseudonymisation as "a way of reducing risk and improving security", and says it is up to you whether to use it. Neither UK data protection law nor the BACP Ethical Framework says notes must be stored apart from a client's details. Two things are worth knowing:

• Separated notes are still personal data. If you hold the key that links them back to the client, the law treats them like any other record, and your client can still ask to see them.
• Notes need to stay linked to the right person. You must be able to find a client's records if they ask to see or correct them, if a safeguarding concern arises, or if your clinical executor needs to contact your clients.

So the practical rule is simple. Notes kept as loose files, on paper or in general-purpose documents and apps, are safer filed under a code, with contact details kept elsewhere. Notes in a secure, encrypted system built for clinical records can sit within the client's record, without the client's name written into each note. Whichever you choose, say in your privacy notice how and where you keep records.

If you are weighing up software, our FAQ on what to look for in GDPR-compliant practice management software, below, covers the questions to ask, and our comparison pages set the main UK platforms side by side.

Your privacy notice

If you only do one thing after reading this guide, make it your privacy notice. It is the single most important document a private therapist has, and for BACP members it is now an ethical requirement too. Think of it as the written version of the confidentiality conversation you already have in a first session.

Article 13 of UK GDPR sets out what it has to cover. Here is that list, translated:

1. Who you are and how to contact you
2. Your data protection officer, if you have one. Most sole practitioners do not need one, so you can usually leave this out
3. Why you hold their information, and the legal reason (for example, "to provide therapy, with your explicit consent")
4. Your "legitimate interests", only if you rely on that reason. Most therapists do not
5. Who else sees it: your supervisor, accountant, software providers
6. Whether it leaves the UK, for example if a software tool stores information abroad
7. How long you keep it
8. Their rights: to see it, correct it, ask for it to be deleted, and object to how it is used
9. Their right to withdraw consent, if consent is your legal reason
10. Their right to complain, to you first and to the ICO
11. Whether they have to give you the information, and what happens if they do not (for example, you cannot provide therapy without basic contact details)

In practice this is a one to two page document in plain English. It should live on your website, in your written intake pack, and be mentioned briefly at the start of the first session.

Be specific about the foreseeable limits to confidentiality, because that is now what the BACP Framework asks for. Clients should know about supervision (a form of disclosure), the circumstances in which you would break confidentiality for safeguarding, which software tools hold their data, whether you use any AI features with their information, how long you keep records, and who would contact them and access their records if you suddenly could not practise. That last point is your clinical will executor. We have written a separate guide to clinical wills if you have not set one up yet.

If your privacy notice has not been updated since 19 June 2026, check that it mentions the right to complain directly to you. Many do not.

If you use Therasee, you can go a step further. Its AI form assistant drafts the forms that go alongside your privacy notice, such as a data protection consent form, a consent-to-treatment form with a complaints procedure, or a confidentiality agreement, tailored to how you work. Clients complete and sign them online, and the signed copy is kept with their record. If you already have a form you are happy with, upload it and the assistant turns it into an online form, word for word. Like the rest of Therasee, it runs in the UK and never uses your data to train AI.

Retention periods

How long should you keep therapy notes for? There is no fixed legal period, and the 2026 BACP Framework does not set one either. It asks for records that are adequate, relevant, and stored securely.

The Limitation Act 1980 sets a general limit of six years for most civil claims in England and Wales. This is the period within which a former client could bring a claim. Your indemnity insurer expects you to be able to defend yourself, which means keeping enough records.

The BACP does not stipulate a fixed period, but its GDPR FAQ indicates six years after the work has concluded as the common interpretation. The UKCP takes a similar view. Several training bodies recommend seven years as a working convention, with the extra year as a buffer.

For most adult clients in private practice, the working convention is seven years from the end of therapy. Not a legal requirement, a defensible position.

For minors, hold records until the client reaches the age of majority (18 in England, Wales, and Northern Ireland) plus the same six to seven year buffer. In practice this often means holding records until the former client is 25 or 26. The reasoning is that the limitation clock for many claims involving minors does not start until they reach adulthood.

If you practise in Scotland, the rules are a little different. Most claims there must be brought within five years, or three for personal injury, and young people are presumed able to exercise their own data rights from the age of 12. Northern Ireland broadly follows the same time limits as England and Wales. Your professional body or insurer can confirm what applies to you.

For couples and family therapy, the records hold information about more than one person. Each person has their own rights, so if one partner later asks to see their records, you will need to black out (redact) what relates only to the other. Keeping each person's forms, consent, and correspondence separate from the start makes this far easier later.

Retention does not stop if you do. If you die or become unable to practise, your records still need to be held securely for the rest of their retention period, and someone needs authority to manage them. Your clinical will should say who.

When the retention period ends, you have two options. Securely delete the records (paper shredded, digital records permanently deleted, including backups). Or truly anonymise them, removing every detail that could identify the person, even to someone who knows them. Simply removing names is not enough; that is pseudonymisation, and the law still treats it as personal data. Whatever period you choose, write it into your privacy notice.

Subject Access Requests after the DUAA

A Subject Access Request, or SAR, is simply a client asking to see the information you hold about them. Most therapists receive very few, and when one comes it is usually a reasonable request handled in an afternoon. It can still feel unsettling the first time, so it helps to know the shape of it in advance.

The basics have not changed. A client can ask verbally or in writing, they do not need to use the words "Subject Access Request", and you have one month to respond.

Three DUAA clarifications have been in force since February 2026, all set out in the updated ICO right of access guidance:

Stop-the-clock is now statutory. If you need the client to verify identity or clarify what they are asking for, you can pause the one-month clock until that information arrives.

Searches only need to be reasonable and proportionate. You do not have to be exhaustive. Record what you searched and why.

You can extend by up to two further months for complex or numerous requests, provided you tell the client within the original month.

Four things specific to therapy.

If the records mention other people (a partner in couples therapy, a family member talked about in session, your supervisor), black out what relates to them before you share the records, unless they agree to it being shared.

If you work with children and young people, remember that a child's personal data belongs to the child, not the parent. A parent can make a request on a child's behalf, but where the young person is mature enough to understand their own rights, you should usually respond to them directly or with their agreement. Take advice from your supervisor or indemnity provider in borderline cases.

There is one situation many therapists worry about: what if seeing their notes could genuinely harm the client? The Data Protection Act 2018 does allow you to hold back health information if sharing it would be likely to cause serious harm to the client's, or someone else's, physical or mental health. It is sometimes called the "serious harm exemption" (Schedule 3 Part 2, if you need to look it up). It is a high bar and rarely used, so speak to your indemnity provider before relying on it. But it is reassuring to know it exists.

Handwritten notes count too, as long as they are kept in an organised way, such as a file per client. Writing by hand does not take notes outside the rules.

You cannot charge a fee in most cases.

Breach reporting and the 72-hour rule

First, a reassurance: breaches happen to careful, conscientious people. What matters is how you respond.

A data breach is any time client information is lost, seen by someone who should not see it, or changed or destroyed by mistake. That is broader than most people assume. Common examples: a lost or stolen laptop or phone, a misplaced USB stick, an email sent to the wrong person, a scam email that tricks you into giving away a password, a paper file left on a train, or your software provider having a breach of its own.

You need to report a breach to the ICO if it is likely to put the people affected at risk, for example of distress, embarrassment, or their information being misused. For a therapy practice, that test is almost always met. Even a client's name and appointment times reveal that they are in therapy.

You must tell the ICO as soon as you can, and within 72 hours of finding out. The clock starts when you become aware, not when the breach happened. The ICO's small-organisation guide to the first 72 hours is the practical reference. It would rather receive an early notification with incomplete information than a late one with the full picture. Report online through the ICO's website.

If the risk to the people affected is high, which with therapy client information it often is, you must also tell them directly, in plain language. Keep a written record of all breaches, even ones you decide not to report.

Two practical habits make breach response much easier. Write down a one-page breach response plan now, before you need it. And encrypt your devices and cloud storage. Encryption scrambles information so it is unreadable without your password or key. If an encrypted laptop is stolen and the password is safe, you may not need to tell clients at all, because nobody can read what is on it.

For most sole-practitioner breaches the ICO's primary aim is advice rather than enforcement. The single biggest risk is not the fine; it is the reputational and clinical harm of telling a client their information has been compromised.

The complaints requirement, in force since 19 June 2026

This is the most important new operational requirement the DUAA introduced for therapists, and the one most likely to have slipped past a busy practice.

Since 19 June 2026, every practice, including every sole practitioner, must have a process for handling complaints about how people's information has been handled. In practice this means clients come to you first, and only go to the ICO if they are unhappy with your response. That is a good thing: it gives you the chance to put things right directly. There are no exemptions for size. The ICO's guidance on handling data protection complaints sets out what that means.

You must make it easy to complain. For example, a short form people can fill in online, alongside another route such as email or post. You must also accept complaints however they arrive, including verbally.

You must acknowledge a complaint within 30 days. An automatic email acknowledgement is fine for online submissions. If you can investigate and respond fully within the 30 days, one reply can do both jobs.

You must look into it promptly, and keep the person updated. The ICO deliberately does not set a fixed deadline for the outcome. It expects you to respond as quickly as the situation reasonably allows.

You must tell the complainant the outcome. It is good practice to remind them at that point that they can take the complaint to the ICO if they are unhappy.

You should keep a record of complaints received, what you did, and the outcome. The ICO may ask to see it.

For a sole practitioner this really is an afternoon's work. Add a paragraph to your privacy notice, set up a complaints email address or short web form, write a one-page internal procedure for yourself, and start a simple log.

Data Processing Agreements with your software vendors

A Data Processing Agreement, or DPA (confusingly the same initials as the Data Protection Act), is a written contract between you and any company that handles client information for you. It sets out what they can and cannot do with it, and how they will keep it safe.

The law (Article 28 of UK GDPR) says you need one with every such company, however small your practice. If you use online booking, practice management software, or a cloud video platform, you need a DPA with each of them.

The good news is that you rarely have to draft anything. Reputable providers publish a DPA and you accept it when you sign up. Having worked through these from the provider's side, here are the parts actually worth reading:

Where is the data stored? Ideally the UK or the European Economic Area (EEA). Information stored in the US or elsewhere needs extra legal protections in place, which a good provider will explain.

Who are the sub-processors? Most vendors use other vendors, for video, payments, email, or support chat. They may also be handling your clients' data, and some will process it outside the UK. A good DPA names them.

What security measures are in place? Encryption, access controls, two-factor sign-in, backups.

What happens in a breach? The vendor should commit to telling you quickly, so you can meet your 72-hour ICO obligation.

What happens when you leave? Your data should be returned to you, or securely deleted, when the contract ends.

Signing the DPA is the minimum. The same part of the law also says you may only use a provider that gives "sufficient guarantees", which in plain English means you have good reason to trust them with your clients' information. That is a judgement you make about the company, not just the contract, and it is where the next part of this guide comes in.

Online sessions and recording

Online therapy is now an ordinary part of practice, and the same rules apply as in the room, with a couple of extras.

Your video platform is one of your processors, so it needs a Data Processing Agreement like any other tool. Look for encryption, a clear statement of where calls are processed, and no recording by default. Take sessions from a private space where you cannot be overheard, and it is kind to suggest the same to clients.

Recording a session is a much bigger step. A recording is a detailed record of someone's health, so only record with the client's clear, written agreement, for a stated purpose such as supervision during training. Decide in advance where it will be stored, who will see it and when it will be deleted, and say so in your privacy notice. If you would not be comfortable explaining all of that to the client, do not record.

AI tools and client data

AI is the fastest-moving area in this guide. The technical, regulatory, and professional body landscape has shifted more in the last two years than at any equivalent period since UK GDPR came into force in 2018. This section gives you the principles that will remain stable, the current state of UK guidance, and a practical framework. Treat the specifics as a snapshot taken in autumn 2026.

The mistake we see most often

The data protection mistake we see most often in 2026 is pasting identifiable client information into general-purpose AI tools: ChatGPT, Claude.ai, Gemini, any consumer chatbot.

If you have done this, you are far from alone, and it usually comes from a good place: wanting to write better notes or think a case through more clearly. But it is worth understanding why it is a problem.

When you paste a client's notes into a consumer AI tool, you are handing their health information to another company, usually based in the United States. Depending on the product and your settings, that company may keep it and use it to improve its AI. You have no Data Processing Agreement with them. You have no legal reason recorded for sharing it. Your client has not been told, so your privacy notice does not cover it. And the information has left the UK without the protections the law expects.

Without anyone intending it, that adds up to several breaches of data protection law in a few seconds. It is also hard to square with professional codes that ask you to protect confidentiality, and, since 3 November, with the BACP Framework's explicit expectation that you check an AI tool before using it.

Removing the client's name does not solve it. The law only treats information as anonymous if nobody could work out who it is about, including people who know the client. A prompt that reads "a 34-year-old female software engineer at a Bristol healthtech startup, recently divorced, presenting with anxiety…" could easily be recognised by a colleague or friend. Most of the time, taking names out only makes information pseudonymised, and the law still protects it fully.

There is also the confidentiality you already hold dear. Talking a case through with an AI chatbot is a disclosure your client has not agreed to, in the same way that discussing it with a stranger would be.

What the UK professional bodies have said

The British Association for Counselling and Psychotherapy (BACP) has gone furthest, by writing AI into its 2026 Ethical Framework: assess the risk of any AI tool before using it, and never outsource your decision-making to it. Earlier in the year it issued a public call for clearer AI regulation in mental health, drawing on its 2025 Mindometer survey of nearly 3,000 therapists. 28% reported clients receiving unhelpful advice from AI tools, and among therapists working with under-18s, 19% reported harmful AI advice.

The UK Council for Psychotherapy (UKCP) has taken a cautious line, noting that the evidence base for AI in therapy is still thin. The British Psychological Society (BPS) published guidance on AI in psychology in February 2026. The National Counselling and Psychotherapy Society (NCPS) published the UK's first Relational Safeguards for AI Mental Health Tools. A group of UK counselling and psychotherapy organisations, the AI Expert Reference Group, has also published a Shared AI Charter for Counselling and Psychotherapy.

The direction of travel is consistent. AI may have a supporting role in administrative tasks. The relational core of therapy is and remains human. Any AI tool that touches client data needs the same care, transparency, and consent as any other form of disclosure.

Wellbeing apps versus medical devices

The Medicines and Healthcare products Regulatory Agency (MHRA) regulates medicines and medical devices in the UK. In January 2026 it published guidance for people using digital mental health apps, distinguishing "wellbeing" tools from those that count as medical devices. The distinction only matters for tools that claim to diagnose, monitor, treat, or prevent a mental health condition.

A general-purpose chatbot like ChatGPT is not a medical device. Therasee, or any other practice management platform, is not a medical device. Your video conferencing tool is not a medical device. But an AI app that markets itself as treating depression, or a chatbot positioned as therapy in its own right, may fall under medical device rules. If a client tells you they are using one, it is reasonable to ask whether it is registered as a medical device, and to share what you find.

Built-in AI features are a different proposition

AI features built into clinical software, such as dictation or form drafting inside a practice management platform, are meaningfully different from a consumer chatbot.

When we added speech-to-text and an AI form assistant to Therasee, the first question we asked was whether client data would be used to train anyone's model. The answer had to be no, and we chose enterprise services on that basis. That is the bar I would set for any tool, ours included. A well-built feature should sit under the vendor's Data Processing Agreement, keep data in the UK or EEA, commit in writing that client data is not used for training, and use an enterprise service rather than a consumer one.

It does not make built-in AI automatically compliant. Your privacy notice still needs to cover it, and your professional code will expect you to have thought it through before using it (for BACP members, that is now explicit). But the structure of compliance is at least possible. With consumer AI, it is not.

If you are thinking of using an AI tool in a new way with client information, it is also worth knowing about a data protection impact assessment, or DPIA. This is a short, structured risk assessment the law expects for processing that is likely to be high risk, and using new technology with health information can fall into that category. For a sole practitioner using a well-established feature within their practice software, your tool record is usually enough. For anything newer or more experimental, the ICO's DPIA guidance and template will walk you through it.

A practical rule. If you are tempted to put client information into an AI tool, ask three questions. Is the tool built for clinical use? Is it covered by a DPA with my name on it? Is the data held somewhere I can defend if the ICO asks? If the answer to all three is yes, compliance is achievable. If any answer is no, do not put identifiable client data into it.

Choosing tools you can justify

This is the part of the guide I care about most, partly because we sit on the other side of it. Therapists ask us these questions about Therasee, and I think they should ask them of every vendor, including us.

Two rules now point in the same direction. UK GDPR says you may only use a provider that gives "sufficient guarantees" it will protect your clients' information. The ICO describes this as the provider having the expert knowledge, resources and reliability to do it properly, and makes it your job to check. And since 3 November 2026, the BACP Framework has asked you to assess the risk of any AI tool, digital tool or online platform before using it.

Neither asks for a legal report. In practice both come down to the same thing: being able to explain your choice if someone asks. That someone might be the ICO after a breach, your professional body after a complaint, or a client who wants to know where their information lives.

Keep a one-page record for each tool

For each tool that touches client data (practice management, video, email, AI, payments), write down:

• What you use it for, and what client information it holds
• Who provides it: company name, where it is registered, its ICO registration number
• Where the data is stored, and which sub-processors it names
• The DPA: whether you have one, and the date you accepted it
• Security basics: encryption, two-factor sign-in, backups, and whether it is independently penetration tested
• For AI features: whether client data is used to train models, and what you will not use the feature for (anything that replaces your clinical judgement)
• Your exit: how you would get your data out if the tool failed or closed
• Dates: when you reviewed it, and when you will look again (once a year, or when the tool changes)

Half a page per tool is plenty. Keep it with your other practice records. It covers your legal duty to check your providers and your professional body's expectations in one document, and it takes less time to write than this section takes to read.

Your record of processing

There is one more record most therapists do not know they need. Small organisations are usually exempt from keeping a formal record of how they use personal data, but the exemption does not apply when you regularly handle health information. For a therapist, that means almost always.

It sounds bigger than it is. A simple table covering each thing you do with client information (providing therapy, appointments, payments, enquiries), what information it involves, why, your legal reason, who else sees it, where it is kept and for how long, is enough for most practices. Your tool record sheets give you most of the answers already. Our free template includes a ready-made version.

A word on vibe coding

Something has changed in how software gets made. AI coding tools now let almost anyone build a working app in a weekend by describing what they want, a practice that has become known as vibe coding. New therapy tools are appearing faster than ever as a result.

I want to be careful and fair here, because we use AI coding tools every day to build Therasee, as do most software teams now. How the code gets written is not the issue. What matters is whether the engineering basics sit underneath it: people who understand security reviewing what gets shipped, tested access controls, reliable backups, independent penetration testing, and a company that will still be around next year.

Those basics are exactly what is easy to skip when an app can be built in days. In May 2026, security researchers at Red Access reported finding around 5,000 publicly accessible apps built with AI coding tools that exposed potentially sensitive information, reportedly including medical records and patient conversations. Polished screens tell you nothing about what is underneath.

So with any new or unfamiliar tool, ask:

• Who is the company, and how long has it been trading?
• Is it registered with the ICO?
• When was it last independently penetration tested?
• Can it give you a DPA and a list of sub-processors?
• Who do you contact if something goes wrong, and how quickly will they respond?
• If you are moving from another system, how will your existing client records be brought across? Is AI used to read or match them, and if so, which provider, and where is that processed?

A vendor that can answer these clearly is in good shape, however its code was written. A vendor that cannot is a risk to your clients, however good it looks.

Common GDPR mistakes therapists make

Using personal email for clinical content. Fine for non-clinical contact. For anything clinical, use an encrypted email service or a client portal.

Storing client information on an unencrypted laptop or phone. Encryption materially reduces breach exposure.

Posting case details in Facebook or WhatsApp groups. We see this regularly in large UK therapist groups: a detailed client scenario, name removed, shared with thousands of members to ask for advice. It always comes from wanting to do right by the client, but it carries the same problem as pasting notes into an AI tool. If someone who knows the client could recognise them from the details, you have shared their health information without a legal reason to. A "private" group of several thousand strangers is not confidential in any sense your client would recognise, and posts can be screenshotted and shared on. In a public group it goes further: since September 2024, Meta has used public posts from adult UK users to train its AI. Supervision is the right place for these questions.

Reminders that include the appointment reason. "Reminder: your CBT session for OCD is tomorrow at 3pm" reveals health information on a phone screen anyone might see. "Reminder: your appointment is tomorrow at 3pm" is fine.

One shared record for a couple. Two people, two sets of rights. Keep their forms, consent, and messages separate wherever you can.

No written DPA with your software vendor. If you cannot find one on their website, ask. If they cannot produce one, find a different tool.

No complaints process. Required since 19 June 2026, and still missing from many practices' privacy notices.

Choosing tools on looks alone. No record of why you chose them, and no answer if the ICO or your professional body asks.

Treating the ICO fee as the whole of GDPR. Paying the £52 data protection fee is a legal requirement, but it is the beginning, not the end.

Pasting client information into ChatGPT. Easy to do with the best intentions, and covered in more detail above.

Where to go from here

UK data protection law in 2026 is more complex than it was a year ago, but it is also more clearly mapped. The DUAA has not torn anything up. It has added a few things (the complaints process, codified SAR rules) and clarified others. Professional bodies, led by the BACP's new Framework, are turning good data habits into professional obligations. What is changing faster than the law is the technology around it: AI features, and new tools that can be built in a weekend.

The honest version of practical compliance for a UK private practice in 2026 is this. Have a privacy notice that reflects your actual practice, including the limits to confidentiality and the right to complain to you. Have a clear Article 9 condition. Write down your retention policy. Have a written breach response plan and a simple complaints process. Keep a one-page record of why you chose each tool that touches client data. Be careful with AI. And put a clinical will in place, so your clients and their records are looked after if you cannot be there.

If some of this feels like a lot, that is completely understandable, especially alongside a full caseload. You do not need to do it all at once. Start with your privacy notice, then work through the rest one step at a time, and lean on your supervisor, your professional body and the ICO's helpline whenever you need to. Nobody expects you to become a data protection expert, only to take reasonable care of the people who trust you.

If you are choosing or reviewing software, our comparison pages set Therasee side by side with the other platforms UK therapists use most. And if you are a BACP member, our guide to the BACP Ethical Framework 2026 walks through everything the new framework asks of you.

If you are earlier in the journey, our guide to starting a private therapy practice in the UK covers ICO registration, insurance, and the rest of the setup.

Updates to this guide

We will log every meaningful change here, so you can see what has moved since you last read it.

• 3 November 2026: First published, reflecting the Data (Use and Access) Act 2025, the ICO's transition to the Information Commission on 30 September 2026, and the BACP Ethical Framework 2026, which became mandatory for BACP members on 3 November 2026.

---

Nick Evans is the co-founder of Therasee, the UK-built practice management platform for therapists, counsellors, psychotherapists, and psychologists. Therasee is registered with the ICO (ZB610705), stores all client data in the UK, and includes a Data Processing Agreement and a clinical will on every plan.