Research Practitioner Man Turning Graph Blue Hero

Executive Coaches Aren't as GDPR-Exempt as They Think

In December 2024 the British Psychological Society ran a webinar reminding psychologists and executive coaches that data protection rules don't clock off at the clinic door, and this includes practices like yours.

Whole-practice growth for wellness practices. Rooted in Wiltshire, UK, working worldwide.

Coaches who keep leadership assessments and session notes in a spreadsheet marked "miscellaneous" are sitting on the same kind of sensitive data a clinic would lock away, whatever they call their practice.

Original ResearchA branch write-up of a BPS training session arguing that data protection obligations apply just as fully to executive coaches and business psychologists as they do to clinicians
Sourcehttps://www.bps.org.uk/news/data-protection-psychologists-and-executive-coaches-private-practice
OverviewThe piece summarises a December 2024 BPS webinar aimed at psychologists and coaches, explaining how UK data protection law reaches their client records too.
Year2024
PublisherIndustry body, British Psychological Society (BPS)
Relevance to WellbeingCoaching and therapy practices that assumed data protection was someone else's problem are exactly the audience this webinar was aimed at.
Our VerdictToo early to tell It's a fair warning from a credible professional body, but it rests on one webinar recap with no survey, sample, or figures behind it.
Our Summary
  • Comes from the British Psychological Society, so the underlying legal point isn't exactly fringe thinking.
  • Names a genuine and common blind spot, coaches who assume GDPR is a clinical matter and not theirs.
  • No named study, no sample size, no methodology beyond one branch chair's account of a webinar.
  • The claim about what "many coaches assume" is asserted, not measured.
Our Geo ViewUK-specific: this refers to UK GDPR and Data Protection Act obligations. Equivalent rules exist elsewhere but the detail differs by country.
Abstract of wellbeing niches and revenue flow
Recognise how this might impact your practice

Why this might matter to you

  • Coaching: this matters because coaches often store leadership assessments and personal notes without ever calling it "client data", which is exactly the assumption BPS is poking at.
  • Therapy: this matters because therapists already know GDPR applies to them, but this webinar is a nudge that no exemption appears just because the work happens outside the NHS.
  • Training: this matters because trainers holding fitness assessments and health questionnaires are still handling personal data, webinar or no webinar.
  • Alternative Healing: this matters because healers taking intake forms about someone's health history are managing sensitive data whether or not they'd call themselves clinical.
  • Clinical: this matters because clinical practices are used to this kind of scrutiny already, so it's less a wake-up call and more confirmation they were right to bother.
  • Retreat/Centre: this matters because centres collecting medical or dietary details at booking are gathering exactly the kind of data this webinar says nobody gets to treat casually.

Where this came from

The write-up comes from a BPS branch co-chair, recapping a December 2024 training session on how data protection law extends into executive coaching and business psychology, not just clinical settings.

British Psychological Society, published December 2024. It's a first-hand recap of a webinar rather than a formal report or study.

Credibility flags: no methodology described, no sample size (this isn't a study), publisher is a recognised professional body rather than a research outlet.

How we scored this

A relevance score out of 100, built from three things: how well it fits the six practice types, how recent it is, and how solid the methodology behind it is.

70%
Practice fit, 100How new, 100How solid, 0

Marked down heavily on how solid the method is, since the central point is asserted rather than tested, but kept high on practice fit and recency given it lands squarely on coaching and therapy work from within the last year.

Faces of satisfied clients
It's worth considering changes to your marketing practices

What this means for your marketing

  • Add a line to your intake form saying plainly how client notes are stored and for how long.
  • Brief your team that "we're coaches, not clinicians" is not a data protection defence.
  • Put a plain-English privacy notice on your booking page before a client goes looking for one.
  • Mention securely stored notes yourself during discovery calls, clients notice when you say it first.
  • Check who else has access to your CRM before someone else asks you to.

Who this is most useful for

Practice typeRelevanceRecommended action
CoachingHighAudit what you store about clients and tighten access.
TherapyMediumConfirm existing GDPR practice actually covers coaching-style notes too.
TrainingMediumCheck any health or fitness intake forms are stored properly.
Alternative HealingLowTreat health-related intake forms as sensitive data by default.
ClinicalLowUse this as a reminder to keep documentation current, nothing more.
Retreat/CentreMediumReview booking forms for medical or dietary disclosures.

Best before

Best before: worth revisiting when UK GDPR guidance next updates, or sooner if BPS publishes a fuller report. Tracked for you by Sunlight Creations.

What next?

Anyone who has ever kept coaching notes in a personal email folder because "it's not like it's medical" will recognise exactly the gap this webinar is pointing at.

Talk to us about Whole-practice Marketing

Therapy Space

Something Brought You All The Way Down Here.

A good sign. We have an ecosystem, a visual river and a story garden that have been waiting for a practice like yours. Come and find out what we mean - the coffee's hot and the discovery call goes properly both ways.

Find your Sunlight  ▶
≡