Gdpr Confusion for Uk Therapists
You know where your keys are, your council tax reference, and the good scissors. Nobody's told you where your client notes really live.
You know where your keys are, your council tax reference, and the good scissors. Nobody's told you where your client notes really live.
sitting on old paperwork Your privacy policy hasn't been touched since a Tuesday in 2019. Somewhere between the couch and the candle, GDPR became a fog nobody explained properly, and you've been compliant-shaped ever since, in the vague way a scarecrow is bird-shaped. Sort the mechanics once, and the dread lifts before your next intake form does.
You published it in 2019. It sits there still, calm and confident, like a smoke alarm you've never tested.
It mentions cookies. It doesn't mention where you keep client notes now - a mixture of a Google Drive folder, an old laptop, and a Moleskine you keep meaning to shred.
A policy on a website is a statement. A document isn't the same as knowing where your client notes live.
Wellness marketing solutions: services that come into play here:
How bad is it: score your practice:
Having a document sat there feels like progress. Having an answer is the only thing that counts.
Your training covered transference, boundaries, and what to do if a client cries for the entire fifty minutes. Lawful basis never came up.
So the word arrives later, in a Google search at 11pm, beside a candle that's gone out and a couch that's seen things.
The confusion was never really about GDPR. It's about nobody explaining the paperwork in a room built for feelings, not filing cabinets.
You're not behind. Nobody simply told you, so how were you meant to know?
Nobody sat you down and said, here's what the couch has to do with the Data Protection Act.
You know the one. Subject line: "Quick question." Your stomach does something a stomach shouldn't do before 9am.
The client only wants to know what you hold on them. A reasonable question, asked in a reasonable tone, that still lands like a parking ticket.
Sort the system once, and that lurch vanishes like a wasp that's finally found the open window. The dread was costing you more attention than the paperwork ever would.
Paper feels honest. A notebook full of session notes, kept in the drawer with the spare fuses, feels like the sort of thing a sensible person does.
Safety and silence are different animals here, the way cash under a mattress stays hidden right up until the mattress gets stolen with the cash still in it.
A notebook doesn't lock. It doesn't back up. Feeling old-fashioned and being secure are two different arrangements entirely.
You'll only notice the gap between the two the day it goes missing.
Most small therapy practices in the UK spend under £250 a month on marketing. One person runs the whole show, with no written plan behind any of it.
Somewhere in that overlap sits you, at 8.40am, doing consent forms, a social post about self-compassion, and a safeguarding check, all before the kettle's finished.
That's not a character flaw. It's a workload nobody costed properly, and it explains why GDPR keeps sliding to the bottom of the list.
Solved before: practical guidance on this topic:
Five years of training never once mentioned you'd end up running your own compliance department.
Plenty of practices manage their own data protection with no drama at all.
It takes reading the updates and acting on them, the two working together like a kettle and a switch.
Check the ICO guidance the way you check the boiler pressure - occasionally, deliberately, before it becomes a crisis.
Running this yourself is entirely possible, provided you treat it as ongoing, not a box ticked once in a training week.
Nobody's sending you a reminder. That's the job now, alongside the couch and the candle.
Bringing in a data protection specialist isn't the soft option. It's simply the other option.
One route costs your evenings. The other costs your budget.
Neither one makes you lazy, whatever the voice in your head insists. Two ways to solve the same problem, and no medal for choosing the harder one.
Pick the one that leaves you with something left over for the clients sitting in front of you.
Most GDPR panic doesn't come from wrongdoing.
It comes from nobody, across five years of training, ever saying what to do with the intake form once the session ends.
You weren't shown a filing cabinet. You were shown a case study about attachment theory.
The root cause is silence, not misconduct, which is a far less dramatic thing to fix than it sounds.
Nobody told you what happens to the form after the client leaves the room.
Clients ask, more often than you'd think, what happens to their notes.
The instinct behind it matches the one that makes people check a locksmith's ID.
A calm, plain answer does more for trust than any framed qualification hanging behind your chair.
A clear answer builds more trust than another certificate, and it costs you nothing but thirty seconds of preparation.
Say it plainly, and watch the client sink properly into the cushion.
Fixing this doesn't look dramatic.
No ribbon-cutting, no certificate, no bonfire of old notebooks.
It looks like one folder, properly named, handed to a stranger and explained in under a minute.
Struggling to do it today names the whole problem in one go.
Small, unglamorous, and entirely fixable before lunch.
The instinct, understandably, is to buy a template pack and call the matter closed. Twelve pounds, a download link, job done.
Templates are good at wording. They're no good at telling you what you're allowed to keep, for how long, or why a client's address from 2021 still sits in your files.
Only a proper look at how your practice really runs answers that, and no downloadable document does the looking for you.
The confusion was never about phrasing. It was about the facts underneath it.
Sort your data protection properly and stop dreading the emails, the folders, and the small print you meant to fix in 2019. resolve it properly
Especially in a practice you've built yourself. There's a discovery call that holds that kind of honesty well - your impediments and ambitions, our ecosystem and story garden. twenty-five minutes. Good coffee.
≡