Data Protection & Compliance: A Practical Checklist for Psychology and Coaching Businesses
Is your business handling personal information securely and responsibly?
Whether you run an independent psychology or coaching practice, manage a consultancy or work with associate practitioners, data protection is an important part of running your business.
From client records and assessment reports to employee details, marketing databases and business correspondence, organisations can hold a considerable amount of personal information. Understanding what you collect, why you need it, how it is stored and who can access it is essential to managing that information responsibly.
UK data protection requirements are not simply about having a Privacy Policy on your website. They also involve the day-to-day processes, systems and working practices used to collect, access, share, retain and dispose of personal information.
If you are unsure where to start, the following checklist highlights areas worth reviewing.
A practical data protection checklist
1. Understand your responsibilities
Familiarise yourself with the data protection requirements relevant to your business, including the UK GDPR and the Data Protection Act 2018, as amended.
The Information Commissioner's Office (ICO) provides guidance to help organisations understand their responsibilities.
Start with the ICO's Guide to Data Protection.
2. Understand what personal information you hold
Carry out a review of the personal information your business collects and stores.
Consider information held in:
- Client records, assessment reports and psychometric documentation.
- Employee, associate and contractor records.
- Emails, shared drives and document management systems.
- Laptops, mobile phones and other devices.
- Paper files, notebooks and printed documents.
- Practice management systems, cloud platforms and third-party applications.
Identify what information you hold, where it is stored, why you need it, who can access it and whether it is shared with other organisations.
3. Establish your lawful basis for processing
You need an appropriate lawful basis for processing personal information. The correct basis depends on what you are doing, why you are doing it and the circumstances involved.
Consent is only one of the available lawful bases and is not automatically the right choice for every activity.
Document the basis you rely on for each relevant purpose and ensure your privacy information explains how and why personal information is used.
The ICO explains the options in its Guide to Lawful Basis.
4. Take extra care with sensitive information
Psychology and coaching practices may handle special category data, such as information about a person's health. Some work may also involve criminal offence data.
These types of information have additional legal requirements. For special category data, you generally need both a lawful basis under Article 6 of the UK GDPR and an applicable condition under Article 9. Criminal offence data has its own requirements.
Review what information you collect, whether you genuinely need it, how it is protected and who is authorised to access it.
Seek specialist advice if you are unsure which legal conditions apply to your work.
5. Review your privacy information and policies
Check that your privacy notices accurately explain how personal information is collected and used, including the purposes, lawful bases, retention periods and relevant individual rights.
Depending on your business and the way you operate, you may also need internal data protection policies, records of processing activities, confidentiality procedures and other supporting documentation.
Remember to review your website Privacy Policy, client agreements, associate contracts, employee notices and relevant communications when your processes or purposes change.
Templates can be a useful starting point, but they should reflect your actual business activities and legal obligations.
6. Check your contracts and working relationships
If you work with associate psychologists, coaches, subcontractors, virtual assistants or other service providers, consider how personal information is shared and each party's responsibilities.
Establish whether each party acts as a data controller, joint controller or data processor for the particular activity. These roles depend on the actual arrangements, rather than simply the job title or contractual label.
Where a controller engages a processor, a contract containing the required data protection provisions is generally necessary. You should also consider appropriate due diligence, confidentiality, security arrangements and what happens when the working relationship ends.
Do not assume that a standard confidentiality clause alone covers every data protection obligation.
7. Review your security arrangements
Consider whether the technical and organisational measures you have in place are appropriate for the information you handle and the risks involved.
Areas to review include:
- Strong passwords and multi-factor authentication.
- Device security, encryption and software updates.
- Access permissions and the principle of least privilege.
- Secure storage, sharing and transfer of documents.
- Backups and recovery arrangements.
- Staff and associate awareness of phishing and other cyber risks.
- Procedures for removing access when someone leaves a project or organisation.
Security is not just about technology. Clear processes and appropriate working practices are equally important.
8. Set appropriate retention and disposal arrangements
Keeping information indefinitely is rarely a sensible default.
Establish how long different types of records need to be retained, taking account of their purpose, applicable legal and professional requirements, contractual obligations and any relevant circumstances.
Create a retention schedule where appropriate, review records periodically and securely delete or anonymise information when it is no longer needed.
Psychology practices and consultancies may have different retention requirements depending on the type of service, client group, professional obligations and contractual arrangements. Avoid applying one blanket retention period to every record.
The ICO provides guidance on storage limitation and data retention.
9. Check third-party software and international transfers
Consider the systems and suppliers your business uses, including practice management software, cloud storage, email platforms, video conferencing and online assessment tools.
Understand where personal information is stored, who can access it, the supplier's role, the relevant contractual safeguards and whether any international transfer requirements apply.
Using a software provider based outside the UK does not automatically mean that a restricted international transfer is taking place. The actual arrangements need to be assessed.
The ICO explains the relevant rules in its Guide to International Transfers.
10. Know how to respond to individual rights requests
Individuals have rights in relation to their personal information, including rights of access and, in certain circumstances, rectification, erasure, restriction and objection.
Make sure you can recognise a request, identify who is responsible for handling it, locate relevant information and respond within the applicable time limits.
For example, a subject access request will generally need to be answered within one month, subject to the rules and circumstances that may affect the deadline.
See the ICO's guidance on subject access requests.
11. Prepare for a personal data breach
A data breach might involve sending a report to the wrong recipient, losing a device, exposing records through incorrect access permissions or discovering that an account has been compromised.
Have a process for reporting, recording, assessing and responding to suspected incidents. Make sure the relevant people know what to do and who to contact.
Some personal data breaches must be reported to the ICO within 72 hours of becoming aware of them, where the legal reporting threshold is met. Affected individuals may also need to be informed in certain circumstances.
You should not wait until every detail is known before taking appropriate action.
The ICO provides practical guidance on personal data breaches.
12. Review training, accountability and ongoing compliance
Data protection is an ongoing responsibility rather than a one-off exercise.
Ensure that staff, associates and others who handle personal information understand the procedures relevant to their roles. Review arrangements when you introduce new software, change suppliers, expand your services or begin processing different types of information.
Depending on your circumstances, you may also need to assess whether you must pay the ICO's data protection fee, appoint a Data Protection Officer or undertake a Data Protection Impact Assessment.
These requirements depend on your organisation and activities, so check the relevant guidance rather than assuming they apply universally.
You can find out more about the ICO's data protection fee and registration requirements.
Turning your review into action
A checklist is a useful starting point, but identifying an issue is only the first step.
Once you have reviewed your arrangements, record any gaps, prioritise the risks and create an action plan. Assign responsibility for each action, agree realistic timescales and review progress.
You may find it helpful to work through the following questions:
- What needs to change?
- Who is responsible for making the change?
- Does the action require specialist legal, data protection or IT advice?
- What process, policy or documentation needs updating?
- How will you check that the change has been implemented effectively?
Keeping appropriate records of your decisions and actions can help you demonstrate how you approach your data protection responsibilities.
How ExecutiveVA can help
Putting processes in place, maintaining documentation and keeping operational tasks on track can take considerable time, particularly when you are also managing client work and running a business.
ExecutiveVA provides specialist project, operational and business support to psychology and coaching professionals and consultancies. Depending on your requirements, this may include administrative support with organising documentation, coordinating implementation tasks, maintaining process records and helping keep agreed actions moving.
I do not provide legal advice or undertake formal data protection compliance assessments. Where specialist interpretation of legislation or advice on your obligations is required, you should consult an appropriately qualified data protection professional or solicitor.
If you need practical support with the administrative and organisational work involved in implementing agreed processes, get in touch with ExecutiveVA to discuss your requirements.
A useful starting point is the Information Commissioner's Office (ICO), the UK's independent regulator for data protection and information rights.
Disclaimer: This article provides general information only and is not legal advice. Data protection requirements depend on your circumstances and may change. Always consult current official guidance and seek specialist advice where appropriate.
