The therapist's guide to UK GDPR: consent, SARs and erasure

UK GDPR applies to every therapist who holds client data — including paper notes, emails and session recordings — whether you work alone or in a group practice. The core obligations are: identify a lawful basis for each type of processing, keep records of what you hold and why, respond to subject access requests within one month, and be ready to explain your retention and erasure decisions. Getting this right is less about ticking boxes and more about being able to show your reasoning if the ICO ever asks.

Why UK GDPR matters for solo therapists

The ICO's remit covers any data controller, including a sole-trader therapist working from a home office. Health data — mental health notes, session recordings, outcome scores — is classified as special category data under Article 9, which attracts stricter rules than ordinary personal data. You need both a lawful basis under Article 6 and a separate condition under Article 9 to process it lawfully.

The ICO maintains a self-assessment toolkit and publishes sector-specific guidance. Because the rules are interpreted and updated over time, always confirm current requirements directly with the ICO or your professional body rather than relying on any single summary, including this one.

Choosing the right lawful basis

For most private-practice therapists, the relevant Article 6 bases are contract (processing is necessary to deliver the service the client has engaged you for) and, in some circumstances, legitimate interests. Consent under Article 6 is often misunderstood: it requires a freely given, specific, informed and unambiguous opt-in, and clients must be able to withdraw it without detriment. Because a client who withdraws consent could argue they can no longer receive therapy, many practitioners find contract or legitimate interests a more stable basis for core session notes.

For special category health data under Article 9, the most commonly used conditions in a therapy context are explicit consent (Article 9(2)(a)) and health or social care (Article 9(2)(h)), which covers processing by a health professional for the provision of care. Your professional body — BACP, UKCP, HCPC, BABCP, NCS — may have guidance on which condition fits your practice model. Document your chosen basis and your reasoning; that record is what protects you.

Privacy notices and transparency

Every client should receive a privacy notice before or at the point of data collection. A good privacy notice covers: who you are and how to contact you; what data you collect and why; your lawful basis for each category; how long you retain records; who you share data with (supervisors, GPs, insurers, and under what circumstances); and how clients can exercise their rights.

Keep the language plain. A client who is already anxious does not need a 3,000-word legal document. Review your notice whenever your practice changes — new software, a new supervisor arrangement, or adding outcome measures all potentially affect what you need to disclose.

Subject access requests (SARs)

A client or former client can ask to see all personal data you hold about them. You generally have one calendar month to respond, though extensions are possible in limited circumstances, and you must provide the data free of charge in most cases.

In practice, this means being able to locate and compile session notes, correspondence, outcome scores, invoices and any other records promptly. Third-party information — details about someone else mentioned in a session — should be redacted before disclosure. If a SAR raises safeguarding concerns (for instance, you believe disclosure could cause serious harm), exemptions exist, but applying them requires careful judgement; seek advice from your professional body or a solicitor before withholding anything.

The best preparation for a SAR is good record-keeping from the start: know what you hold, where it lives, and how to export it.

The right to erasure

Clients can request that you delete their data. This right is not absolute — it does not override professional or legal obligations to retain records. Most professional bodies recommend a minimum retention period for therapy records (often seven years post-ending for adults, or until a young person's 25th birthday), and your insurer may have its own requirements. These recommendations can provide a legitimate reason to retain records even after an erasure request.

When you decline an erasure request, tell the client why, in plain language, within one month. Document the request, your decision and your reasoning. If the client disagrees, they can complain to the ICO.

Data processors and third-party tools

Every piece of software you use to process client data — note-taking apps, email providers, video platforms, outcome-measure tools — makes that provider a data processor on your behalf. UK GDPR requires a written data processing agreement (DPA) with each processor. Check that any tool stores data within the UK or EU (or has appropriate transfer safeguards), is ICO-registered where required, and can demonstrate how it protects client data.

This matters when choosing clinical software. Look for explicit statements about data residency, whether client data trains AI models, and how audio or transcripts are handled. Sorca's trust page explains, for example, that session audio is transcribed in the browser and never stored, and that client data never trains AI models — the kind of specifics worth asking any vendor about.

Honest limitation

This guide covers the main principles, but UK GDPR is not static. The ICO updates its guidance, enforcement priorities shift, and your professional body's standards may be more stringent than the legal minimum. Nothing here substitutes for reading the ICO's current sector guidance, checking your professional body's data protection resources, and — for anything complex (a contested SAR, a data breach, a complaint) — taking proper legal advice.

Where Sorca fits

Sorca is built for UK private-practice therapists and is ICO-registered, with EU (Frankfurt) data residency and a consent model that covers each data category separately. The immutable audit trail and one-click data export are designed to make SAR responses and erasure decisions straightforward to document. The AI clinical scribe processes transcripts in memory and discards them after drafting, so no session audio or transcript is retained on Sorca's servers. The free trial runs for three days with no card required.