Confidentiality is the legal default in UK therapy: what you tell a therapist stays private unless a specific exception applies. Those exceptions are narrow: preventing serious harm, safeguarding duties, court orders and lawful data requests. Your records also carry extra legal protection because they count as special category data under UK GDPR, and subject access requests can be limited where disclosure would cause serious harm.
TL;DR:
- Confidentiality is strict in UK therapy, but it can be breached only to prevent serious harm, safeguard at-risk individuals, comply with court orders, or in rare public interest cases.
- Therapy notes are protected as special category data under UK GDPR, requiring both lawful consent or legitimate interest and a specific legal condition before processing or sharing.
- A therapist must document any decision to disclose information, ensuring disclosures are minimum, necessary, and proportionate, especially during safeguarding, legal, or emergency situations.
- Clients have the right to access their records, but disclosures can be limited if they are likely to cause serious harm, often requiring expert consultation before withholding information.
- Reputable providers publish clear confidentiality policies, explain limits upfront, and make it easy to raise concerns or switch therapists if confidentiality boundaries feel unclear.
Table of Contents
- What UK law and professional rules require
- When a therapist can break confidentiality
- Records, subject access requests and the serious harm test
- Practical duties for therapists and services
- How police and the CPS request therapy notes
- Client rights and how to challenge or complain
- What a reputable UK online provider should do
- A note on trust and transparency
- Getting started with confidential therapy at MySafeTherapy
- Official guidance and professional codes referenced
- Sources
- FAQ
What UK law and professional rules require
Confidentiality in therapy rests on two foundations: the common law duty of confidence and statutory data protection law. The common law duty means information shared in a professional relationship should not be disclosed without consent, and professional bodies build on this directly. HCPC guidance on confidentiality confirms that registrants are bound by this duty, with exceptions only where disclosure is required by law or necessary to prevent serious harm.
Therapy notes are not ordinary personal data. Because they reveal health information, ICO guidance on special category data classifies them under Article 9 of UK GDPR and the Data Protection Act 2018, which means they need stricter safeguards than standard personal data.
Processing this information lawfully requires two separate justifications:
- A lawful basis under Article 6, such as consent or a legitimate interest in providing care.
- A specific condition under Article 9 or Schedule 1 of the Data Protection Act 2018, such as the provision of health treatment or an explicit consent condition.
Both must be satisfied before a therapist can lawfully hold or share your notes. This dual requirement is why a therapist cannot simply decide, on instinct, to pass on what you have said: the law demands a documented basis first.
When a therapist can break confidentiality
Confidentiality can be overridden in a small number of situations, and reputable practitioners treat each one as a considered decision, not a reflex.
- Serious risk to life or serious harm. Government and NHS guidance on information sharing confirms that information can be shared without consent to prevent serious harm, including suicide risk, provided the disclosure is necessary, proportionate and limited to the minimum required.
- Safeguarding children or adults at risk. Statutory safeguarding duties can require a therapist to alert a local safeguarding lead, regardless of what the client wishes.
- Court orders and legal compulsion. A court order removes the therapist's discretion: the material must be produced, though therapists can still argue for redaction of anything not directly relevant.
- Public interest disclosures. Rare cases, such as preventing a serious crime, can justify disclosure even without a court order.
In every one of these situations, the working principle is the same: share the minimum necessary information, act promptly, and write down the reasoning afterwards.
Pro Tip: If a therapist raises a safety concern with you directly, ask exactly what will be shared, with whom, and why: you are entitled to that explanation before or immediately after disclosure.
Records, subject access requests and the serious harm test
A "record" is broader than most clients expect. BACP guidance on confidentiality and record keeping treats session notes, texts, emails, appointment logs, recordings, client artwork and even supervision notes as part of the client record, all subject to the same confidentiality and data protection rules.
You have a right to see your own records through a subject access request. That right is not absolute:
- Requests must usually be answered within statutory timescales, and your identity will be verified first.
- ICO guidance on the right of access to health information allows a therapist to withhold material where disclosure would be likely to cause serious physical or mental harm, the "serious harm test".
- Where that test is being considered, a therapist who is not a health professional should consult one before deciding.
- Services are expected to apply data minimisation, keep retention periods proportionate, and redact third-party information before releasing records.
Practical duties for therapists and services
Good practice starts before the first session. BACP's Ethical Framework expects therapists to explain the foreseeable limits of confidentiality during contracting, not after a problem arises, and to record that this conversation happened.
- Contracting should cover what is confidential, what is not, and how a privacy notice explains data handling.
- Records need secure storage, and any data breach carries reporting obligations to the ICO, generally within 72 hours of discovery.
- Supervision is a legitimate, bounded part of practice: case details are usually anonymised, and clients should be told this is standard rather than a breach of trust.
- Every decision to share, or to withhold, information should be documented with its reasoning.
Pro Tip: Read the privacy notice before your first session, not after a concern arises: it should tell you exactly who might see your information and under what circumstances.
How police and the CPS request therapy notes
Investigators sometimes ask for a client's therapy notes, particularly in cases heading to court. CPS pre-trial therapy guidance for therapists is clear that such requests must be specific and proportionate, not an open invitation to review an entire file.
- Therapists must identify a lawful basis under Article 6 and an appropriate Article 9 condition before releasing anything.
- Notes can often be redacted, and the client should be involved in the process where it is safe to do so.
- Crucially, pre-trial therapy is allowed to continue during an investigation, and the client must be told how their information may be processed.
Client rights and how to challenge or complain
If you want to see your file, object to how it is used, or feel a boundary has been crossed, there is a clear order of steps to follow.
- Submit a subject access request in writing; the therapist or service can limit disclosure only where the serious harm test genuinely applies.
- Exercise your right to object to certain processing, understanding the therapist may refuse where there is an overriding lawful reason.
- Raise the issue directly with the therapist, their employer or the platform first, since most concerns are resolved at this stage.
- Escalate to the relevant professional body, such as BACP or HCPC, if the response is unsatisfactory.
- Contact the ICO if you believe your data protection rights specifically have been breached.
Expect an acknowledgement of a complaint within a reasonable period and a substantive response setting out what was found and what will change.
What a reputable UK online provider should do
A reputable UK online therapy provider works with accredited therapists and publishes clear information about how client data is handled, including in delivery formats such as video, chat and avatar-based sessions. Any digital tool that supplements therapy, including AI journaling or mood tracking, should have its data use explained in plain language. Clients should always be told the limits of confidentiality during contracting, and given a straightforward way to switch therapist or raise a complaint if something feels wrong. You can read more about how confidentiality is handled in UK online therapy.
A note on trust and transparency
Confidentiality only works when its limits are explained clearly, not discovered under pressure. Transparent contracting at the outset, covered in MySafeTherapy's guide to the confidential therapy process, prevents surprise later. Ask questions early, and keep a written note of what you were told.
— MySafeTherapy
Getting started with confidential therapy at MySafeTherapy
MySafeTherapy connects you with UK-accredited therapists across video, chat and avatar-based formats, each bound by the same confidentiality obligations covered above. This applies equally to formats such as chat therapy and avatar-based sessions, where the underlying legal protections are identical to a traditional consulting room. Whatever the delivery format, confidentiality follows the same rules; that principle also applies to independent practitioners working outside a platform, such as hypnotherapy providers.
Before booking anywhere, check three things: the provider's privacy notice, the therapist's professional registration, and a clear complaint route.
- Session prices range from £50 to £180 or more depending on the practitioner tier, set out in full on the pricing page.
- A range of formats and specialisms, from individual therapy to workplace support, are listed on the main services overview.
- Switching therapist or raising a concern is designed to be straightforward rather than a lengthy process.
If you want therapy that explains its confidentiality rules upfront rather than leaving you to ask, book a session through MySafeTherapy's pricing page to see current options and get matched with an accredited therapist.
Official guidance and professional codes referenced
- ICO: special category data and right of access for health information
- HCPC confidentiality guidance and BACP ethical framework
- CPS pre-trial therapy guidance and NHS guidance on sharing patient information
This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.
Sources
- ICO: Special category data guidance
- HCPC: Guidance on confidentiality
- ICO: Right of access (SAR) for health information
- Gov
- CPS: Pre‑trial therapy — accompanying note for therapists
FAQ
When can a therapist break confidentiality in the UK?
A therapist can break confidentiality when there is a serious risk to life or serious harm, when safeguarding duties apply to a child or adult at risk, or when a court order legally compels disclosure. Government guidance on information sharing requires any such disclosure to be necessary, proportionate and limited to the minimum information needed.
What are the legal requirements for patient confidentiality in the UK?
Therapists must follow the common law duty of confidence alongside UK GDPR and the Data Protection Act 2018, since therapy notes count as special category data. This means a lawful basis and a specific Article 9 or Schedule 1 condition are both required before information can be processed or shared.
At what point can a therapist break confidentiality?
The threshold is reached when the risk of serious harm, a safeguarding concern, or a legal requirement outweighs the duty to keep information private. Even then, HCPC guidance expects disclosure to be limited to what is strictly necessary and documented afterwards.
What are therapists legally required to report in the UK?
Therapists must act on statutory safeguarding duties involving children or adults at risk, and must respond to lawful court orders or specific, proportionate requests from investigators, such as those covered by CPS pre-trial therapy guidance. Outside these situations, information generally stays confidential unless the client consents to it being shared.