GDPR self-assessment for private practice
Twelve questions to check how your practice handles client data, with plain-English fixes for the gaps.
1.Are you registered with the ICO and paying the data protection fee?
2.Do you have a written privacy notice you give clients before or at the first session?
3.Do you know your lawful basis for holding client data, and the special-category condition for health data?
4.Are your session notes stored encrypted, or locked away if on paper?
5.Are your notes and client contact details kept in separate places, or separable?
6.Do you have a stated retention period, and do you actually delete records when it passes?
7.Do you know what you would do in the first 72 hours after a data breach?
8.Could you answer a subject access request within one month, including knowing what you could withhold?
9.Do you have a plan for your client records if you suddenly could not practise?
10.Is your email and messaging with clients reasonably secure, and do clients know the risks of the channels they choose?
11.For each third-party tool you use (calendar, notes, video, billing), do you know where it stores data, and do you have a data processing agreement with it?
12.Do you avoid taking identifiable client data outside the UK or EEA without safeguards?
Where you stand
As a private practitioner, you are the data controller for your client records. Tools such as Bloom are processors acting on your instructions. You decide what to collect, how long to keep it and who can access it.
Consent can be withdrawn while your insurer expects clinical records to be retained. Contract or legitimate interests, paired with the Article 9 health and social care condition, can provide the basis for therapy records. Explain your basis in the privacy notice.
The good news is that the ICO’s expectations of a solo practice are proportionate. Registration costs £52 a year (2026), a privacy notice fits on one page, and a retention habit is a diary reminder. The gaps that matter most, encryption and a breach plan, cost time rather than money.
Question 11 tends to produce the longest list. Every tool that touches client data, the calendar, the notes app, the video platform, the invoicing spreadsheet, is a processor you are responsible for. Consolidating that patchwork into fewer systems shrinks the list of data processing agreements you need to keep track of, which is a data protection argument as much as a convenience one.
Completing this checklist does not establish compliance and is not legal advice. Use the linked sources, ICO guidance and your professional body’s resources to check requirements.
Frequently asked questions
Bloom keeps notes, documents, payments and your diary under one data processing agreement. You remain the data controller.