Why carrying out a regular data audit is important for your psychology or coaching business
Whether you are a psychologist, coach or run a consultancy, personal information is likely to form an important part of your day-to-day business activities.
From client records and assessment reports to enquiry forms, email correspondence and financial records, personal data can be held across a variety of systems, devices and documents. Over time, it is easy to lose track of exactly what information you hold, where it is stored and whether it is still needed.
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, organisations and individuals processing personal data have responsibilities for ensuring that information is handled appropriately and securely.
One useful way to review your current arrangements is to carry out a data audit, sometimes referred to as an information audit or data-mapping exercise.
A data audit helps you build a clearer picture of the personal information you collect, use and store, identify potential gaps in your processes and establish whether any changes are needed.
What should a data audit cover?
A data audit involves reviewing the personal information held across your business, including both electronic and paper records.
For example, this might include:
- Client and patient records, assessment reports and coaching notes.
- Email accounts, contact lists and enquiry forms.
- Spreadsheets, databases and financial records.
- Practice management and client management software.
- Cloud storage, shared folders and external hard drives.
- Information held on laptops, smartphones and other devices.
- Records relating to employees, associates and subcontractors.
As you work through your information, consider the following:
- What information do you hold? Identify the types of personal data you collect and store, including any special category data, such as information about health.
- Why do you hold it? Establish the purpose for collecting and processing the information and identify the appropriate lawful basis.
- Where is it stored? Record the systems, platforms, devices and physical locations where information is held.
- Who has access to it? Consider who within your business, and which external organisations or service providers, can access the information.
- How long do you retain it? Check whether you have appropriate retention periods and procedures for securely deleting or disposing of information when it is no longer needed.
- How is it protected? Review the security measures you have in place, including access controls, passwords, backups and secure information sharing.
How to get started with your data audit
You don't need to make this an overly complicated exercise. Starting with a simple spreadsheet can help you organise your findings and identify areas that need attention.
I would suggest the following steps:
1. Create a data audit spreadsheet
Set up a spreadsheet to record the information you hold, where it is stored, why you process it, who has access to it and how long it is retained.
You may find it helpful to use the ICO's own documentation templates as a starting point.
2. Review your information and systems
Work through your records, databases, folders and systems, including any third-party platforms you use to manage your business.
Don't forget information stored outside your main business systems, such as email accounts, mobile devices and paper files.
3. Identify any gaps or areas for improvement
As you work through the audit, consider whether information is being collected unnecessarily, retained for too long, stored insecurely or accessed by people who no longer need it.
Make a note of any areas where your current arrangements could be improved.
4. Create an action plan
Use your findings to prioritise any changes that need to be made. This might include reviewing retention periods, updating access permissions, improving security arrangements or revisiting your privacy information and internal procedures.
5. Review your audit regularly
A data audit shouldn't be a one-off exercise. Your business, systems and working practices will change over time, so it is important to revisit your records periodically and whenever there are significant changes to the way you process personal information.
A final consideration
For psychologists and coaches, data protection deserves particular attention because client work can involve sensitive personal information, including health information, assessment findings and other special category data.
It is important to remember that completing a data audit does not, by itself, make a business compliant with data protection legislation. It is one part of a wider approach to understanding, managing and protecting the personal information you process.
If you are unsure about your data protection responsibilities or how to interpret the requirements, the Information Commissioner's Office (ICO) provides guidance and resources to help organisations understand their obligations.
You can find further information here:
ICO – Documentation and records of processing activities
Please note: ExecutiveVA provides virtual business, operational and project support and does not provide legal or specialist data protection advice. If you need advice about your specific obligations, you should consult an appropriately qualified data protection professional.
