Privacy notice template for UK therapists

Every therapist who keeps client records needs a privacy notice. Here is what UK GDPR requires it to say, the lawful basis for therapy records, the 2026 changes most templates miss, and a template you can adapt.

By the NoteSono team · Last reviewed 19 October 2026 · 9 sources checked

The short answer

A privacy notice tells clients who you are, what personal information you hold, why and on what legal basis, who you share it with, how long you keep it, and what their rights are. UK GDPR requires you to give it when you collect their information, usually with your contract.

For therapy records the usual legal bases are contract for the information itself and health or social care for health information, not consent. Since 19 June 2026 the notice must also tell clients they can complain to you about how you handle their data. A free template is below.

What a privacy notice must include

Article 13 of UK GDPR lists what you must tell people when you collect their information. For a therapist that means:

Item	In practice
Who you are	Your name, practice, contact details, ICO registration number
What you collect and why	Contact details, session notes, health information, payments
Your legal basis	Contract, and health or social care for health information (see below)
Who receives it	Supervisor (anonymised), software providers, accountant, clinical executor
Transfers abroad	Whether any provider processes data outside the UK, and the safeguard
How long you keep it	Your retention period, or how you decide it
Their rights	Access, correction, erasure, restriction, objection, portability, withdrawing consent
Complaints	How to complain to you, and their right to complain to the ICO

It must be "concise, transparent, intelligible and easily accessible", in plain language.

The lawful basis for therapy records

You need two things: a lawful basis under Article 6 for any personal data, and a condition under Article 9 for health information.

Article 6: usually contract

Keeping notes and contact details is necessary to provide the therapy the client has agreed to, so Article 6(1)(b), contract, fits. Financial records you must keep for tax fall under legal obligation, Article 6(1)(c).

Article 9: health or social care, not consent

Article 9(2)(h), together with paragraph 2 of Schedule 1 to the Data Protection Act 2018, covers processing necessary for providing health care or treatment. It applies when the processing is done by a health professional or by someone who owes a duty of confidentiality under law. Section 11 of the Act says so expressly, and the ICO accepts that the common law duty of confidence can meet it. A counsellor or psychotherapist owes clients that duty.

Why not consent?

Explicit consent can be withdrawn at any time, but you need to keep records for professional and legal reasons. And the ICO warns that consent is hard to rely on where you are in a position of power over the person, as a therapist is. Keep consent for optional things, such as recording sessions for training.

The ICO also notes that where this condition applies, the client does not have an automatic right to have their records erased.

What changed in 2026

Many privacy notice templates online predate the Data (Use and Access) Act 2025. Check yours for these:

Complaints to you. Since 19 June 2026 clients have a legal right to complain to you about how you handle their data. You must make it easy to complain, for example by email and by post or phone, acknowledge complaints within 30 days, look into them and tell the client the outcome. Your privacy notice should say how.
The regulator. The Information Commissioner was replaced by the Information Commission on 30 September 2026. It still uses the ICO name and website, so "the ICO" remains clear for clients.
Fees. ICO data protection fees rose in February 2025. See our ICO registration guide.

The ICO's own privacy notice guidance currently carries a note that it is under review because of these changes, so check it again before you finalise your notice.

Listing your software and AI tools

Every service that stores or processes client information for you is a processor, and clients should know about them in general terms. That includes your notes software, email, cloud storage, video platform, payment provider and any AI note-taking tool.

Name the type of service, and ideally the provider.
Say if any provider processes data outside the UK, and the safeguard, such as UK adequacy regulations or the international data transfer agreement.
Make sure you have a data processing agreement with each one. Reputable providers publish one.
If you use AI to help write notes, say so plainly, and say whether sessions are recorded.

Free privacy notice template

Adapt this to your practice. Replace everything in highlighted brackets, and remove anything that does not apply to you.

Privacy notice for a therapy practice

Privacy notice

[Practice name] · [therapist name]

Last updated: [date]

Who I am

I am [name], a [counsellor / psychotherapist] in private practice. I am the "controller" of the personal information you give me, which means I decide how it is used and I am responsible for keeping it safe.

Address: [practice address]

Email: [email] Phone: [phone]

ICO registration number: [number]

What information I hold

- Your name, contact details, date of birth, GP details and emergency contact.

- Notes of our sessions, assessments and any questionnaires you complete.

- Information about your health and wellbeing, and anything else you choose to share in sessions.

- Records of appointments, invoices and payments.

- Emails, texts and other messages between us.

Why I hold it, and the legal basis

- To provide therapy to you. The legal basis is that it is necessary for our contract (UK GDPR Article 6(1)(b)).

- Information about your health is "special category" information. I process it because it is necessary to provide health care or treatment (UK GDPR Article 9(2)(h) and Data Protection Act 2018, Schedule 1, paragraph 2), and I owe you a duty of confidentiality.

- To keep financial records and meet legal duties, such as tax records (Article 6(1)(c)).

- [Only if you do this: To record sessions for my training, with your explicit consent, which you can withdraw at any time.]

Who I share it with

- My clinical supervisor. I discuss my work in supervision without using your name or details that would identify you.

- Companies that provide services to my practice and process information on my behalf under contract: [e.g. NoteSono for notes and records, [email provider], [payment provider], [accountant]]. [If any process data outside the UK: say where and the safeguard used.]

- My clinical executor: a qualified colleague who would contact you if I died or became seriously unwell. They would only see your contact details and what they need to support you.

- I will only share information without your consent where the law requires or allows it, for example if I believe you or someone else is at serious risk of harm, or a court orders it. Wherever possible I would talk to you first.

How long I keep it

I keep your records for [6] years after our work together ends, then destroy them securely. [Explain any longer period, e.g. for clients under 18.]

How I keep it safe

[e.g. My records are kept in password-protected software with two-factor sign-in. Paper records are kept in a locked cabinet. I do not keep notes on shared devices.]

Your rights

You have the right to:

- ask for a copy of the information I hold about you

- ask me to correct information that is wrong

- ask me to delete information, or restrict how I use it, in some circumstances. Because I hold health records for the purpose of providing care, I may need to keep some information even if you ask me to delete it.

- object to some uses of your information

- withdraw consent where I rely on it

To use any of these rights, contact me using the details above. There is usually no charge.

Complaints

If you are unhappy with how I have handled your information, please tell me at [email or address]. You can do this in writing, by email or by telephone. I will acknowledge your complaint within 30 days and tell you what I have done about it.

You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

Give it to clients with your contract, and put it on your website. The ICO's privacy notice generator for health and social care is a useful cross-check.

Common questions

Do therapists need a privacy notice?

Yes. UK GDPR requires anyone who collects personal information to tell people how it will be used. For a therapist, that means giving clients a privacy notice when you first take their details.

What is the lawful basis for therapy notes?

Usually contract (UK GDPR Article 6(1)(b)) for the records, and Article 9(2)(h) with Data Protection Act 2018 Schedule 1 paragraph 2, health or social care, for health information. Consent is usually not the right basis for core records.

Should therapists rely on consent under GDPR?

Not for core records. Consent can be withdrawn at any time, and the power imbalance in therapy makes it hard to show it was freely given. Use it for optional processing such as recording sessions.

What changed for privacy notices in 2026?

Since 19 June 2026, clients have a right to complain to you about your handling of their data, and your privacy notice should explain how. You must acknowledge such complaints within 30 days.

Is a privacy notice the same as a contract?

No. The contract sets out the terms of therapy; the privacy notice explains how you handle personal information. Keep them consistent and give them together.

Sources

Checked on 19 October 2026. Rules and prices change, so check the source before you rely on a figure.

This guide and template are general information, not legal advice. The ICO is updating its guidance after the Data (Use and Access) Act 2025; check its latest guidance before relying on this template.

More practice guides

TemplateClinical will template for UK therapistsWhat a clinical will is, who your executors should be, and a template you can copy.TemplateTherapy cancellation policy templateNotice periods, late-cancellation fees and card-on-file wording that holds up.TemplateTherapy contract template for private practiceEvery clause a UK counselling contract needs, with a template you can adapt.Data protectionSubject access requests for therapy notesWhat to do when a client asks for their notes: deadlines, exemptions and a reply letter.

All practice guides