Research Practitioner Woman Dynamic Pose Chart Blue Hero

Your therapy consent form might not be doing the legal job you think it's doing

A therapist's blog post, year unknown, argues that ticking the "consent" box on your intake form may not actually give you a legal leg to stand on, since a client can't really refuse and still get therapy. This includes practices like yours if your paperwork has never been looked at twice.

Page updated: 14 Aug 2026

Whole-practice growth for wellness practices. Rooted in Wiltshire, UK, working worldwide.

Therapy practices leaning on consent as their GDPR lawful basis may find that basis wobbles under scrutiny, at least according to one unattributed claim making the rounds online.

Original Research	A private practice blog argues that consent doesn't hold up as a legal basis for therapy records, because a client can't genuinely decline consent and still be seen.
Source	https://sarahdrees.co.uk/gdpr-therapists-questions-answered/
Overview	The post walks through GDPR questions therapists commonly ask, written by a practising therapist rather than a regulator, lawyer, or research body.
Year	Not disclosed
Publisher	Brand, Sarah Drees
Relevance to Wellbeing	An industry claim suggests therapists relying on consent as their lawful basis for data may be on shaky ground, though the claim carries no named source, study, or legal citation behind it.
Our Verdict	Too early to tell it raises a fair point worth checking, but nobody's shown their working.
Our Summary	The underlying legal principle, that consent needs to be freely given to count, is a real feature of data protection law. There's no case law cited, no regulator quoted, and no named source anywhere on the page. It states a legal conclusion with some confidence for something that would normally need a solicitor's sign-off. Contractual necessity as an alternative lawful basis is a genuine and sensible option worth raising with your adviser.
Our Geo View	GDPR applies across the UK and EU; practices outside these jurisdictions operate under different data protection rules entirely.

Abstract of wellbeing niches and revenue flow

Recognise how this might impact your practice

Why this might matter to you

Coaching: this matters because most coaching intake forms borrow their data wording from somewhere else, and nobody checks if it still makes sense.
Therapy: this matters because therapy records are sensitive by definition, and getting the legal basis wrong is the sort of thing that surfaces at the worst possible moment.
Training: this matters because trainers holding client health or progress data often assume consent covers everything, when it might not.
Alternative Healing: this matters because healers collecting client health histories are handling the same sensitive data as clinicians, with often far less paperwork to show for it.
Clinical: this matters because clinical practices are the most exposed if a lawful basis turns out to be flimsy, given how much record-keeping the work demands.
Retreat/Centre: this matters because centres collecting health information from multiple practitioners need one basis that actually holds for everyone using it.

Where this came from

A therapist's own blog talking through GDPR basics, including a strong opinion on which legal basis therapists should actually be using.

Sarah Drees, sarahdrees.co.uk. Publish date not given.

Credibility flags: no methodology, no sample, no named legal source. This is one practitioner's opinion piece, not a study.

How we scored this

A relevance score out of 100, built from three things: how well it fits the six practice types, how recent it is, and how solid the methodology behind it is.

43%

Practice fit, 100How new, 10How solid, 0

Marked down hard on method confidence since nothing here is attributed to anyone or anything; practice fit is high because it speaks directly to therapists, but recency is treated as poor since no date is given at all.

It's worth considering changes to your marketing practices

What this means for your marketing

Pull out your intake form and check whether it uses the word "consent" for data handling, then flag it for review.
Ask your data protection adviser, in writing, which lawful basis you're actually using, don't take a blog's word for it.
Brief reception or admin staff that "the client signed it" isn't the same thing as "we're compliant".
Put a short, honest line on your website about how you handle client data, without overstating your legal certainty.
Hold off repeating this specific claim to clients until someone qualified has checked it against your own setup.

Who this is most useful for

Practice type	Relevance	Recommended action
Coaching	Low	Worth a glance if you hold any health-adjacent notes.
Therapy	High	Get your lawful basis checked properly, this is the exact scenario in question.
Training	Low	Only relevant if you record client health or injury data.
Alternative Healing	Medium	Review your client intake wording if you collect health histories.
Clinical	High	Prioritise a proper legal review, exposure is highest here.
Retreat/Centre	Medium	Confirm one consistent lawful basis across all practitioners on site.

Best before

Best before: revisit as soon as you've had your own data protection basis checked by a solicitor, this claim shouldn't be your last word on it. For anyone wanting help turning that housekeeping into decent marketing, see Sunlight Creations.

Well. Here We Are At The Bottom.

The best practitioners always find their way here. We have a story garden, a listening wind and a visual river waiting to make sense of themselves - they do, beautifully, in a twenty-five-minute conversation over a good coffee. How do you take it?

Find your Sunlight ▶