GDPR Compliance Stats: Why "Feeling Compliant" Isn't Enough

Page updated: 14 Aug 2026

Whole-practice growth for wellness practices. Rooted in Wiltshire, UK, working worldwide.

Practices holding client health records, session notes or booking details are exactly the sort of business a stat like this is aimed at, whether or not the stat itself can hold its own weight.

Original Research	SurveyMonkey's launch of a new "Trust Centre", backed by a claim about ongoing GDPR headaches at UK businesses
Source	https://www.businesswire.com/news/home/20250521583392/en/surveymonkey-launches-trust-centre-to-bolster-business-confidence-fresh-uk-data-reveals-compliance-challenges-persist-under-gdpr
Overview	A press release announcing a new SurveyMonkey product, dressed up with a data-compliance figure that appears to have no named survey behind it.
Year	2025
Publisher	Brand, SurveyMonkey (distributed via Businesswire)
Relevance to Wellbeing	One industry claim suggests over half of UK businesses have had a data-related issue since GDPR arrived, which touches any practice storing client details, though the claim can't currently be verified against a named study.
Our Verdict	Too early to tell a nice-sounding number with nobody's name on it is not a number, it's a slogan.
Our Summary	It does point at something real: data compliance stays messy years after GDPR, and practices with health-adjacent records feel that more than most. No survey is named, no sample size is given, and no methodology appears anywhere on the page. The figure exists to sell a product, which is a fine thing to do, just not the same as independent research. The general worry, that "we think we're fine" and "we are fine" can be different, holds up regardless of where the number came from.
Our Geo View	Specific to UK and EU businesses operating under GDPR; practices elsewhere should check their own jurisdiction's data protection rules rather than assume this applies to them.

Abstract of wellbeing niches and revenue flow

Recognise how this might impact your practice

Why this might matter to you

Coaching: this matters because session notes and client goals count as personal data too, and "I keep it in a folder" isn't a policy.
Therapy: this matters because therapy notes are about as sensitive as data gets, so assuming you're compliant carries more weight than assuming most things.
Training: this matters because client health forms, injury histories and emergency contacts pile up fast, and nobody trains for the paperwork.
Alternative Healing: this matters because intake forms often ask deeply personal questions, and "we've always done it this way" is not a compliance strategy.
Clinical: this matters because clinical practices are the most exposed if a data claim like this turns out to be true, given the sensitivity of what they hold.
Retreat/Centre: this matters because centres collect data from dozens of people at once, which multiplies the mess if anything goes wrong.

Where this came from

SurveyMonkey put out a press release announcing a new compliance tool, and tucked inside it was a claim that over half of UK businesses have had data trouble since GDPR started, plus a smaller figure about fines.

Businesswire, 21 May 2025. This is a company press release, not an independently published study.

Credibility flags: no methodology disclosed, sample size not disclosed, publisher type is a brand promoting its own product.

How we scored this

A relevance score out of 100, built from three things: how well it fits the six practice types, how recent it is, and how solid the methodology behind it is.

31%

Practice fit, 25How new, 70How solid, 0

Marked down heavily on how solid the method is, since nothing about who was asked or how is given anywhere, held to a middling score on how current it is given the 2025 date, and marked down on practice fit since the claim speaks to general business, not specifically to wellbeing work.

It's worth considering changes to your marketing practices

What this means for your marketing

Do not quote the "52%" figure anywhere on your site or socials, it has no source and won't survive a fact-check.
Put a plain-English line on your intake forms explaining what you do with client data and why.
Brief your team on where client notes live and who can see them, before a client asks.
Say something reassuring about data handling on your booking page, before it becomes a question in someone's head.
Get an outside pair of eyes on your data practices rather than relying on your own sense that "we're probably fine".

Who this is most useful for

Practice type	Relevance	Recommended action
Coaching	Medium	Tidy up client note storage and say so on your site
Therapy	High	Get a proper data audit rather than assuming compliance
Training	Medium	Review what health and emergency data you actually need to keep
Alternative Healing	Medium	Add a short, honest data note to intake forms
Clinical	High	Treat data handling as clinical risk, not admin
Retreat/Centre	Medium	Check how group data is collected and stored across the whole event

Best before

Best before: revisit only if SurveyMonkey or another named body publishes an actual sourced GDPR compliance survey; until then this claim doesn't age so much as sit there unverified. Keep an eye on future Sunlight Creations research checks for a properly sourced replacement.

The Thoughtful Ones Always Make It To The Bottom.

Well done, thinker. We love thinkers and they love our careful ways - our listening wind, story garden and visual river are all waiting for you in a twenty-five-minute coffee conversation that helps you rekindle faith in growing your practice. Milk and sugar?

Find your Sunlight ▶

Feeling GDPR-Compliant and Actually Being GDPR-Compliant Are Not, It Turns Out, the Same Thing