GDPR for Therapists: Privacy Policies & the 2026 Changes

A short, practical guide to GDPR for UK therapists, including the important data protection changes introduced in 2026.

If you work with clients, you hold personal and often sensitive information about them. That means data protection is something you need to get right, but working out exactly what GDPR requires of a small therapy practice isn't always straightforward.

Recent changes to UK data protection legislation have also introduced some new requirements and clarified others.

This 15-minute video presentation takes you through the main points in plain English, with a particular focus on what they mean in everyday therapy practice.

The presentation covers:

• ICO registration and your responsibilities as a Data Controller
• keeping electronic and paper client records secure
• what needs to be included in your Privacy Policy
• lawful bases for processing client information
• special category data, including health information
• the 2026 changes affecting therapists
• handling data protection complaints
• Subject Access Requests
• Legitimate Interests and when you may need an LIA
• direct marketing and email consent
• changes to cookie requirements
• subcontractors and Data Processing Agreements
• AI and client confidentiality
• data breaches and secure disposal of records

You'll also get a useful summary of the main data protection documents a therapy practice should have in place. And some tips about formatting your Cookie pop-up.

The presentation is designed for hypnotherapists, counsellors, psychotherapists and other therapists working in private practice in the UK.

Running time: approximately 15 minutes

Please note: this presentation is based on my own research, knowledge and experience and is intended as practical guidance for therapists. It does not constitute legal advice. If you have questions about your individual circumstances, you should consult the ICO or an appropriately qualified legal professional.