Your therapy contract and your GDPR notice have to tell the same story

In March 2024 the British Psychoanalytic Council quietly reminded its members that a client contract and a GDPR privacy notice are supposed to match, which is the kind of thing you assume until you check. This applies to any practice, like yours, that hands clients paperwork and also collects their data.

Page updated: 13 Aug 2026

Whole-practice growth for wellness practices. Rooted in Wiltshire, UK, working worldwide.

Practices that draft their contracts and their privacy notices at different times, by different people, or from different templates, often end up with two documents that quietly disagree with each other.

Original Research	Guidance stating that therapists' written contracts and their UK GDPR notices must be consistent with one another
Source	https://www.bpc.org.uk/download/11146/Confidentiality-and-UK-GDPR-Guidance-March-2024.pdf
Overview	The British Psychoanalytic Council published this guidance for its registrants on how confidentiality obligations sit alongside UK data protection law.
Year	2024
Publisher	Industry body, British Psychoanalytic Council (BPC)
Relevance to Wellbeing	Directly relevant to any therapy or counselling practice that issues both a client agreement and a data protection notice, which is most of them.
Our Verdict	Too early to tell This comes straight from the regulator's own guidance document, so there's no reading between the lines required.
Our Summary	It's a specific, checkable instruction rather than a vague principle, so practices know exactly what to look for. It comes from the professional body itself, not a third party summarising it. It only tells you the problem exists, not how to fix a mismatch once you've found one. It's written for BPC registrants specifically, so other therapy bodies may phrase their expectations slightly differently.
Our Geo View	Applies to UK-based practices operating under UK GDPR; practices elsewhere should check their own data protection regime.

Abstract of wellbeing niches and revenue flow

Recognise how this might impact your practice

Why this might matter to you

Coaching: this matters because coaches who use client agreements alongside a privacy policy are just as exposed if the two don't line up.
Therapy: this matters because it's the exact scenario the guidance describes, and therapists are the ones being told to check.
Training: this matters because trainers who collect health or personal data as part of a programme need their paperwork to hold together too.
Alternative Healing: this matters because practitioners handling sensitive client information are held to the same GDPR standard, regardless of modality.
Clinical: this matters because clinical settings often layer consent forms, contracts and privacy notices on top of each other, multiplying the chances of a mismatch.
Retreat/Centre: this matters because centres often draft one set of paperwork for the whole business, which is precisely how inconsistencies creep in unnoticed.

Where this came from

A professional body telling its therapists to make sure their contracts and their privacy notices actually agree with each other.

British Psychoanalytic Council, guidance document published March 2024, sourced directly from the primary document.

Credibility flags: this is regulatory guidance rather than a study, so there's no sample size to report; methodology is not applicable; publisher is the recognised UK professional body for psychoanalytic and psychodynamic psychotherapists.

How we scored this

A relevance score out of 100, built from three things: how well it fits the six practice types, how recent it is, and how solid the methodology behind it is.

91%

Practice fit, 100How new, 70How solid, 100

Rated highly for practice fit since it addresses therapists directly, fairly recent given its 2024 publication, and given full marks on method confidence because it's a primary, first-party regulatory document rather than something filtered through a third party.

It's worth considering changes to your marketing practices

What this means for your marketing

Pull out your current client contract and your privacy notice and read them side by side, today, not next month.
Say the word "GDPR" on your website's privacy page in plain English, not legal boilerplate copied from somewhere else.
Brief anyone who sends out client paperwork on your behalf so they're using the current versions, not last year's.
Put a review date on both documents so this doesn't become a problem you find by accident.
Mention in client-facing materials that your paperwork has been checked for consistency, since it quietly signals competence.

Who this is most useful for

Practice type	Relevance	Recommended action
Coaching	Medium	Check any written agreement against your privacy notice.
Therapy	High	Review contract and GDPR notice together this month.
Training	Medium	Audit paperwork used for course enrolments and data collection.
Alternative Healing	Medium	Confirm consent forms and privacy notices are consistent.
Clinical	High	Cross-check consent, contract and privacy documents as a set.
Retreat/Centre	Medium	Standardise paperwork across all practitioners under one roof.

Best before

Best before: revisit this whenever BPC updates its guidance, or at minimum annually alongside your own paperwork review.

Consider This The Footnote That Changes Things.

You stayed to the end and here we both are. We have a visual river, a story garden and a listening wind that belong to a practice exactly like yours - and a discovery call where they all make beautiful sense over coffee. Biscuit?

Find your Sunlight ▶