GDPR for Therapists Using AI Notes: What's Legal, What's Not (2026)

GDPR compliance is one of the most common concerns UK therapists raise about using AI tools for clinical notes. The concern is legitimate — you're handling sensitive personal data — but the reality is less complicated than many therapists fear. This guide covers what you actually need to do, in plain English.

Does GDPR apply to a sole trader therapist?

Yes. If you process personal data about clients — including clinical notes, contact details, and session information — you are a data controller under UK GDPR. This applies whether you're a sole trader, a small practice, or a large organisation.

The good news: the requirements for small private practices are proportionate. You don't need a dedicated data protection officer or an elaborate compliance programme. You do need to get a few basics right.

ICO registration

Most therapists in private practice need to pay the data protection fee to the Information Commissioner's Office (ICO). Since 17 February 2025 it has been £52 a year for most sole practitioners and small practices (tier 1), or £47 by direct debit. You can pay at ico.org.uk. Once registered, you receive a registration number to display on your privacy notice and correspondence — ICO Reg: ZC045529 is NoteSono's, for example.

There are some exemptions, but if you're processing clinical records, it's safest to register. The ICO can fine controllers who should pay and don't, so it isn't worth the risk for £52 a year.

Lawful basis for processing client data

Under UK GDPR you need a lawful basis for processing personal data. For therapists, the most relevant bases are:

• Contract — processing necessary to fulfil your therapeutic contract with the client
• Legal obligation: processing required by law (for example tax records, or safeguarding duties where the law requires them)
• Legitimate interests: only where genuinely needed, and stated in your privacy notice

For clinical notes, contract is usually the primary basis — you need accurate records to deliver the therapeutic service you've contracted to provide. Your privacy notice should state this clearly.

Special category data

Health data — which includes mental health data and clinical notes — is "special category" data under UK GDPR. This means it has additional protections. You need not only a lawful basis but also a separate condition for processing special category data.

For therapists, the relevant condition is usually Article 9(2)(h) with health or social care purposes (Schedule 1, paragraph 2 of the Data Protection Act 2018): processing is necessary for the provision of health care or treatment. This applies straightforwardly to therapeutic records.

Privacy notice requirements

You must provide clients with a privacy notice explaining:

• What data you collect and why
• Your lawful basis for processing
• How long you retain data, or how you decide
• Whether you share data with any third parties (including AI tools), and any transfer outside the UK
• Client rights (access, rectification and, where they apply, erasure and portability)
• Your ICO registration number
• How clients can complain to you about data protection (required since 19 June 2026)
• How to complain to the ICO

This can be a simple document, not a lengthy legal text. A one-page privacy notice in plain English is sufficient for most private practices.

Using AI tools for clinical notes: where BACP stands

BACP hasn't published specific guidance on AI clinical notes (it has surveyed members). Its Ethical Framework still applies: be open with clients about the tools you use, keep accurate records you've reviewed, and protect confidentiality. In practice, clients should understand:

• That you use an AI tool to assist with note writing
• That your summary (not the session itself) is processed by the AI
• That you use reference codes rather than their name
• Where data is stored and processed, and by whom
• That they can ask you to write their notes by hand instead

NoteSono includes a client consent template that you can add to your existing therapeutic contract or use as a standalone document. The key points to cover are above.

What data does NoteSono actually process?

Understanding what actually happens with data in an AI notes tool helps clarify the GDPR position:

• Audio recordings: your voice summary is transcribed by our transcription provider. We don't keep your recording.
• Transcript text: your summary is sent to our AI writing provider for formatting. It should contain no client names or identifying details, only clinical content.
• Formatted notes: stored in NoteSono's database, hosted in the EU.

Our transcription and AI writing providers are in the United States, outside the UK and EU, used under data processing terms that exclude training on your data. Each is named in our privacy policy. Because this is a transfer of data outside the UK, mention it in your privacy notice.

The key point: no session is recorded. The AI processes only your post-session clinical summary, so what goes into it is up to you. We ask you to use reference codes rather than names, and NoteSono never needs a client's name.

Data retention

There is no statutory retention period for private counselling records. BACP says private practitioners may keep notes for a minimum of three years after therapy ends. There's no single legal figure: set a period you can justify, check what your insurer expects, and state it in your privacy notice. Our retention guide covers the detail.

NoteSono lets you export your notes and client list as a ZIP file at any time. If you close your account, you should export your records before doing so, as they will be deleted.

Client rights under UK GDPR

Clients have several rights you need to be prepared to respond to:

• Subject Access Request (SAR) — clients can request a copy of all data you hold about them. You must respond within one month, extendable by two months for complex requests. Clinical notes are covered.
• Right to rectification — clients can ask you to correct inaccurate data
• Right to erasure — clients can ask you to delete their data. This right is not absolute, and where you rely on the health-care condition for clinical records it often won't apply, so you can usually keep records for your stated retention period
• Right to data portability: in some cases, clients can ask for their data in a machine-readable format

The practical checklist

For most therapists in private practice using AI-assisted note taking, GDPR compliance comes down to:

1. Pay the ICO data protection fee (£52 a year, or £47 by direct debit)
2. Have a clear privacy notice on your website and in your contract
3. Add an AI consent clause to your therapeutic contract (NoteSono provides a template)
4. Use a tool that's open about where data is stored and processed, and that signs a DPA
5. Know how to respond to a Subject Access Request
6. Have a data retention and deletion process

GDPR compliance for AI-assisted clinical notes is not a barrier to using the technology — it's a matter of being transparent with clients and choosing tools that handle data responsibly.

If you want to see how NoteSono handles GDPR compliance in practice, create a free account. The AI consent template is included.