Subject access requests for therapy notes: a UK guide for therapists
When a client asks to see their notes, you have a legal deadline and some difficult judgements to make. Here is how the rules work in 2026, including recent changes and one point most guides miss.
By the NoteSono team · Last reviewed · 11 sources checked
The short answer
Yes, clients can see their therapy notes. Under UK GDPR, a client can ask for a copy of the personal information you hold about them, in writing or out loud. You must respond within one month, free of charge in almost all cases.
You can extend by two months if the request is complex, and since February 2026 you can pause the clock while you ask the client to clarify what they want. You can remove information about other people, and in limited cases withhold information likely to cause serious harm, but you cannot change or destroy notes after a request arrives.
Deadlines, fees and ID
| Rule | What it means for you |
|---|---|
| One month | Count from the day you receive the request to the same date next month. If that is a weekend or bank holiday, you have until the next working day. |
| Extension | Up to two further months if the request is complex. Tell the client, with reasons, within the first month. The ICO says needing a health professional's opinion can make a request complex. |
| Stop the clock | For requests received from 5 February 2026, if you genuinely need the client to clarify what they want, the clock pauses until they reply. You cannot ask as a matter of routine. |
| Fee | Free. You can only charge for manifestly unfounded or excessive requests, or for extra copies. |
| ID | Only ask if you reasonably doubt who is asking. The clock starts when you receive it. |
| Search | Since 2025 you need to make a reasonable and proportionate search, not find every scrap. You must be able to explain why a search would be unreasonable. |
What counts: session notes, process notes, emails
The request covers all personal information about the client that you hold electronically or in a structured paper filing system. That usually includes:
- assessment and session notes, in whatever format
- outcome measures and scores
- emails, texts and messages with the client
- invoices and payment records
- contracts, consent forms and referral letters
- notes you made about the client for supervision
Process notes are not exempt
UK law has no equivalent of the US "psychotherapy notes" rule. BACP's record-keeping guidance says that "even a practitioner's personal reflections about a client that are scribbled down on a scrap of paper could be regarded as a record", and that notes made for supervision about an identifiable client are records too. If they relate to an identifiable client, the client can ask for them, wherever you keep them.
Never edit after a request
Information about other people
Therapy notes are full of other people: partners, parents, children, colleagues. You do not have to disclose information that identifies someone else unless they consent or it is reasonable to disclose it without consent. Weigh up the type of information, any duty of confidence to that person, whether you could ask them, and whether they have refused.
Often the client already knows the information, because they told you. In that case disclosure is usually reasonable. Redact what the client would not already know, such as something a family member told you in confidence.
Withholding information that could cause serious harm
UK data protection law lets a controller withhold health information if disclosing it would be likely to cause serious harm to the physical or mental health of the client or someone else. How you can use this depends on whether the law treats you as a "health professional".
| You are | Health professional under the Data Protection Act 2018? |
|---|---|
| HCPC practitioner psychologist or arts therapist | Yes |
| Child psychotherapist | Yes, named in the Act |
| Counsellor or adult psychotherapist on a BACP, UKCP, NCPS or BPC register only | No |
For controllers who are not health professionals, the Act says you cannot withhold health information on serious-harm grounds on your own judgement. You need an opinion, from within the last six months, from the "appropriate health professional", usually the clinician responsible for the client's care, such as their GP or psychiatrist. The Act also says that without such an opinion, a non-health-professional should not disclose health information the client has not already seen or does not already know.
This area is unsettled
Letter templates
Adapt these to your situation. Replace everything in highlighted brackets.
The response must include the supporting information UK GDPR lists: why you hold the data, who you share it with, how long you keep it, the client's rights, and, since June 2026, their right to complain to you as well as to the ICO. The template covers these.
Writing notes you would be comfortable sharing
- Assume any note may one day be read by the client. Write factually and respectfully.
- Separate what the client said from your interpretation, and label interpretations as such.
- Keep notes in one place, so a search is quick and complete.
- Avoid recording third-party details you do not need.
- Have a retention period and stick to it. You cannot be asked for notes you have lawfully destroyed.
See our guide to how long to keep therapy notes.
Common questions
Can a client ask to see their therapy notes?
Yes. Under UK GDPR a client can ask for a copy of the personal information you hold about them, including session notes. You must respond within one month, usually free of charge.
Do process notes have to be disclosed?
If they relate to an identifiable client and are held electronically or in a structured filing system, they are personal data and are covered. UK law has no separate exemption for process notes.
How long do I have to respond to a subject access request?
One month from the day you receive it, extendable by two more months for complex requests if you tell the client within the first month. For requests from 5 February 2026, the clock pauses while you wait for a reasonably needed clarification.
Can I charge for a subject access request?
Almost never. You can charge a reasonable fee only for manifestly unfounded or excessive requests, or for additional copies.
Can I refuse to show a client something that might harm them?
Health information likely to cause serious harm can be withheld, but counsellors and psychotherapists who are not HCPC registered are not "health professionals" under the Data Protection Act 2018. They need an opinion from the appropriate health professional first. Take advice before withholding anything.
Sources
Checked on 19 October 2026. Rules and prices change, so check the source before you rely on a figure.
- ICO: What should we consider when responding to a request? — deadlines, stop the clock, ID, fees
- ICO: How do we recognise a subject access request?
- ICO: How do we find and retrieve the relevant information?
- ICO: Health information and the right of access
- Data Protection Act 2018, section 204: meaning of health professional
- Data Protection Act 2018, Schedule 3 Part 2: health data
- Data Protection Act 2018, Schedule 2 Part 3: third-party information
- Data (Use and Access) Act 2025, section 76 — time limits and stopping the clock
- Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026
- UK GDPR Article 15
- BACP Good Practice in Action 065: confidentiality and record keeping
This guide is general information, not legal advice. The rules on health information for practitioners who are not statutory health professionals are not settled. Take advice from your professional body or a data protection lawyer for any request that worries you.