Compliance
GDPR & DPA for UK & EU Therapy Practices
GDPR roles, Data Processing Agreements, and clinic duties for UK and European psychology practices using cloud practice management software.
Updated June 12, 2026 · 7 min read
UK and European Economic Area therapy practices face GDPR — and UK GDPR post-Brexit for British clinics. Your practice is the data controller; PsycSuit acts as a processor when you store client records in our cloud. This guide explains what that split means in plain language.
Controller vs processor
Your practice (controller)
You decide why and how client data is collected — privacy notices, lawful basis for treatment, retention schedules, and responding to subject access requests.
PsycSuit (processor)
We store and run the software on your instructions — encryption, access controls, backups, subprocessors listed in the DPA.
Data Processing Agreement (DPA)
- Signed at practice activation — not optional for production PHI
- Lists subprocessors (hosting, email, video, etc.)
- Defines breach notification timelines and assistance duties
- Documents cross-border transfer mechanisms where applicable
Read the DPA overview and full Trust center.
What your clinic must still do
- Publish a privacy notice clients receive before or at intake
- Document lawful basis (often contract + health care for treatment records)
- Honor access, correction, and erasure requests within legal limits
- Train staff on GDPR-aware handling — no PHI in personal email
- Report breaches to supervisory authority when required
Technical safeguards to verify in software
- Clinic tenant isolation — your data not mixed with other practices
- Role-based access and audit logging
- Encryption in transit (TLS)
- Individual staff accounts — no shared logins
- Data export before contract end
Cross-border clients and hosting
If you treat clients in multiple countries or your team works remotely abroad, confirm transfer rules with your data protection advisor. Processor location and subprocessor regions are disclosed in your agreement — not hidden in generic terms.
FAQ
- Do UK therapists need a DPA with software vendors?
- Yes — when the vendor processes client personal data on your behalf under UK GDPR / GDPR, a Data Processing Agreement is required.
Try PsycSuit in your practice
Scheduling, clinical notes, PHQ-9 & GAD-7, billing, client portal, and telehealth in one Practice OS. Free trial after approval — no card required to apply.