GDPR for private clinics and therapists in the UK

Do you need to pay the ICO fee?

Almost certainly. Any organisation that handles personal information, including a sole trader, must pay the data protection fee unless an exemption applies, and the exemptions are narrow: staff administration, marketing your own business, keeping accounts, and processing done entirely on paper. The ICO's guidance for the health sector says counsellors and therapists who hold personal information electronically must pay, and so must physios, chiropractors, aesthetics clinics and private clinics that keep client or medical records. Client notes in a practice system, a diary on your phone or emails with clients are enough.

Amounts are from the ICO's fee guide, checked October 2026. Paying by direct debit takes £5 off. Most practices are tier 1. If you work as an associate in someone else's clinic, the question is whether you control the records: if you keep your own client list and decide how notes are kept, you are likely to need your own fee.

The regulator became the Information Commission on 30 September 2026 but still calls itself the ICO, and the fee works as before.

Your lawful basis for client health data

UK GDPR asks for two things when you handle health information, which it treats as special category data:

• An Article 6 lawful basis. For a private practice this is usually contract, because you are providing paid treatment the client asked for, or legitimate interests.
• An Article 9 condition. Most practices rely on the health or social care condition. It applies when the processing is done by, or under the responsibility of, a health professional, or by someone who owes a duty of confidentiality. HCPC, GOsC and GCC registrants fit the first part. Counsellors, nutritionists and others without statutory regulation fit the second, because the duty of confidentiality applies to them.

You do not need GDPR consent to keep clinical notes. Consent to treatment is a clinical matter, and asking for GDPR consent to keep notes you need anyway creates a choice the client does not really have. Where consent does matter is marketing: newsletters, offers and testimonials need a clear yes.

Writing a privacy policy for therapists: UK checklist

Your privacy notice should be short, in plain English, and easy to find on your website and your intake form.

It needs to cover:

• Who you are and how to contact you about data
• What you collect: contact details, health history, session notes, payment details
• Why, and your lawful basis for each purpose
• Who you share it with, such as your practice software, your supervisor (anonymised), a GP with consent, or an insurer for insured clients
• Whether any of it leaves the UK, for example through a software provider's servers
• How long you keep notes and other records
• Clients' rights, including access and correction, and how to complain to you and to the ICO
• Website specifics: what your enquiry form collects and which cookies or analytics you use

The ICO has a free privacy notice generator with a health and social care option, updated in 2026 for the new law. It is a solid start for a small practice. Read the result and correct anything that does not match what you do, because a notice that describes someone else's practice is worse than a short accurate one.

Contact forms, cookies and analytics on your website

Enquiry forms

• Ask only for what you need to reply: name, contact details and a short reason for getting in touch. A first enquiry rarely needs full health history.
• Know where submissions go. If the form builder stores entries or emails them to you, it is a processor and needs a data processing agreement. Avoid forwarding them to a personal inbox.
• Link to your privacy notice next to the submit button, and never pre-tick a box for marketing.
• Use HTTPS across the site, which most hosts now include as standard.

Cookies and analytics

Since February 2026, the Data (Use and Access) Act allows some analytics cookies without consent. The ICO's guidance on the exceptions sets the conditions: the sole purpose is statistics to improve your site, the output is aggregated, you tell visitors clearly and give them an easy way to object, and any third-party provider only uses the data for you. If your analytics provider uses the data for its own purposes, you still need consent. Advertising cookies and pixels, such as the Meta pixel or Google Ads remarketing, always need consent. On a health website, think carefully about what a pixel on a condition page or booking page reveals about a visitor before you add one.

Our checklist for improving your practice website covers the rest of what a good practice site needs.

Email and WhatsApp with clients

There is no rule against emailing or messaging clients. The test is whether it is secure enough for what you send, and whether you can find and keep what forms part of the record.

• Use a business email on your own domain, with two-factor authentication switched on, rather than a shared or personal account.
• Keep clinical detail out of quick messages. WhatsApp and text are fine for appointment times. Assessment findings, risk information and letters belong in your practice system or a secure portal.
• Think about your phone. WhatsApp is encrypted in transit, but messages sit on your handset and in its backups. A lost phone without a passcode is a possible breach.
• Agree the channel. Tell clients at the start what you use for what, and put it in your privacy notice.
• Double-check the recipient. An email to the wrong client is one of the most common breaches in small practices.

How long to keep client notes

UK GDPR says keep personal data no longer than you need it, but it does not set a number. That comes from your profession, your insurer and your own written policy, and it varies:

• Physiotherapy: the CSP's record-keeping guidance points to eight years after the last treatment for adults, longer for children (usually to their 25th birthday, or 26th if they were 17 when treatment ended), and different minimums in each UK nation.
• Counselling and psychotherapy: BACP sets no fixed period. Its guidance suggests a member might keep notes for at least three years after therapy ends, in line with its complaints window, and recommends a clinical will so notes are handled properly if you die or close.
• Other professions: osteopaths, chiropractors, dietitians and aesthetics practitioners should check their regulator, professional body and indemnity insurer, which may want records kept long enough to defend a claim.

Write the periods into a one-page retention schedule, apply it, and delete securely at the end. If you work as an associate, agree in writing who holds the records. The CSP notes that when a self-employed physio works under contract for a clinic, the clinic normally owns the records, but the physio must still be able to access them.

Access requests, software suppliers and breaches

Subject access requests

Clients can ask for a copy of their information, including notes. You have one month, extendable by two more if the request is complex, and it is free in most cases. Since 2025 the law says you need to make a reasonable and proportionate search, and the clock pauses while you wait for clarification you genuinely need. There is a narrow exemption for health information where disclosure would be likely to cause serious harm, so check the ICO's guidance before withholding anything.

Processors and data processing agreements

Your practice management software, email provider, form builder, cloud storage and any AI scribe handle data on your behalf, so each needs a contract covering what they do with it. Most reputable vendors include a data processing agreement in their terms: find it, read where data is stored, and keep a copy. Our comparisons of practice management software and AI medical scribes cover what to check.

Breaches and the 72-hour rule

If a breach is likely to put people at risk, you must report it to the ICO within 72 hours of becoming aware of it, and tell the clients affected without undue delay if the risk is high. Keep a log of every breach, including ones you decide not to report.