Client notes, confidentiality and disclosure for counsellors

Notes about a client's mental health are health data. You must hold them under data protection law. Some laws can also require you to disclose information even when your client expects confidentiality. Most of these rules apply across the UK. Some apply in England and Wales only, and a planned duty will apply in England only.

Hold client notes lawfully

You need a lawful basis under Article 6 of the UK GDPR to keep notes. For most counsellors this is the contract with the client. You also need a separate condition under Article 9, because the notes are health data.

The usual condition is health care or treatment, which needs a safeguard of professional secrecy. You meet it through the duty of confidence you owe your clients, whether or not you are on a statutory register.

Set how long you keep notes

Set your own retention period, record it in your privacy notice and delete notes when it ends. Check your register's guidance before you decide. Many practitioners start from the NHS periods below.

Respond to client requests and complaints

A client can ask for a copy of the personal data you hold about them, including your notes. This is a subject access request. For the full process, see Handle subject access requests.

You have one month to respond. The month starts once you have the information you need to confirm who is asking. The clock also stops while you wait for information you reasonably need to find the data. Your search for notes only needs to be reasonable and proportionate.

You can withhold health data in narrow cases, for example where disclosure is likely to cause serious harm to the client. If you are not a health professional as the Data Protection Act 2018 defines the term, you must first get an opinion from the appropriate health professional that the serious harm test is met. A counsellor or psychotherapist who is not on a statutory health register usually falls in that group. Take advice before you withhold anything.

You must also make it easy for clients to complain about how you handle their data. Acknowledge each complaint within 30 days and respond without undue delay. Write the process down and tell clients how to use it.

Pay the data protection fee

You pay the data protection fee to the Information Commission. It took over from the Information Commissioner on 30 September 2026. Client notes are not covered by the exemption for staff administration, marketing and accounts. If you keep client details on a computer, phone or booking system, you must pay.

A sole practitioner within the tier 1 limits pays the tier 1 fee. For the registration steps, see Register with the ICO and pay the data protection fee.

Keep online sessions secure

Sessions by video or phone carry the same duties as sessions in person. Check where your video, notes and booking suppliers store client data before you use them.

If a supplier is outside the UK, sending it client data is a restricted transfer. You need a route for each transfer. Any one of these routes is enough:

• UK adequacy regulations
• appropriate safeguards, such as the International Data Transfer Agreement or the Addendum
• an Article 49 exception

Appropriate safeguards also need a transfer risk assessment. If no route is available, the transfer must not go ahead.

If a client's notes or contact details are lost or sent to the wrong person, see Responding to data breaches.

Know when the law overrides confidentiality

You owe your clients a duty of confidence. You can disclose client information with the client's consent, under a court order, or where protecting someone from serious harm justifies it. Record your reasoning each time.

If you are unsure, ask your register's ethics helpline or take legal advice before you disclose. The laws below can require disclosure whatever your client expects.

Terrorism information

Failing to disclose some terrorism information without a reasonable excuse is a criminal offence. Counsellors have no exemption.

Police access to your records

In England and Wales, police cannot take your counselling records with an ordinary search warrant. They must apply to a judge.

Notifying female genital mutilation

Whether a notification duty applies to you depends on whether you are on a statutory register. An HCPC-registered psychologist or arts therapist is covered. A counsellor or psychotherapist on a voluntary register only is not.

If you are covered, the duty arises when either of these happens:

• a girl under 18 tells you she has had FGM
• you see physical signs of FGM on a girl under 18 and have no reason to believe the signs came from a surgical operation that was necessary for her physical or mental health, or connected with labour or birth

The duty does not apply if you have reason to believe another person in your regulated profession has already notified the same case.

Reporting child sex offences

A duty to report suspected child sex offences is not yet in force. It covers regulated activity relating to children and some other listed activities, mostly local council and court roles. For a counsellor it usually turns on regulated activity relating to children. The DBS guide for self-employed counsellors shows which client groups count.

When the duty starts, you will be able to delay notifying by up to 7 days, but only if you reasonably believe either that:

• notifying would risk a child's life or safety
• someone else will notify within that period

One of those beliefs is enough. You cannot delay for any other reason.

Where to go next

Notes and disclosure are one part of setting up a practice. Follow the whole path in Start a counselling or psychotherapy practice.

Read Counsellor and psychotherapist registration rules to check which titles and registers apply to you. For a yearly review of retention, requests and complaints, use the data protection annual compliance checklist.