Are therapy notes special-category data in the EU?

Yes. Notes that reveal physical or mental health are special-category personal data under GDPR. That is a higher bar than ordinary personal data, so you need both a lawful basis under Article 6 and a separate Article 9 condition, plus stronger transparency and security.

Is consent enough for therapy records under GDPR?

Not always. Explicit consent can be one route, but health or social care and other Article 9 conditions may fit ongoing clinical records better. Clinical consent to treatment is not the same as a data-processing lawful basis. Separate treatment consent, recording consent, AI transparency, and the lawful-basis record.

Can an EU therapist use an AI notes tool under GDPR?

Yes if the tool is treated as a processor, covered by a data processing agreement, assessed for transfers and security, and used with human review before notes are signed. A data protection impact assessment is often appropriate when the processing is novel or higher risk for health data.

What if my vendor stores therapy data outside the EU?

Treat it as an international transfer question. Confirm storage locations, sub-processors, and the transfer mechanism such as an adequacy decision or standard contractual clauses. If the vendor cannot document this in writing, do not put client data in the tool.

Do clients have the right to delete therapy notes?

Erasure is not automatic for clinical records you still need for care, legal defense, or professional duties. Explain access, correction, and erasure limits in the privacy notice before someone asks, and document any lawful refusal.

Do UK GDPR rules still matter for EU clients?

If you are a UK controller seeing EU clients, UK GDPR and the Data Protection Act 2018 still govern your UK practice workflow. EU GDPR and local national rules can also matter for the client relationship, telehealth, and any EU-based processor. Map both sides instead of assuming one regime covers everything.

Do national rules override GDPR for therapists?

GDPR is the EU baseline. Member states and professional bodies still set practical rules on professional secrecy, retention, minors, public-system reporting, and which supervisory authority handles complaints. Check national guidance for those local layers.

What should a therapist ask a notes or AI vendor?

Ask for the DPA, sub-processors, data residency, transfer tools, encryption, retention and deletion, export rights, breach notice timing, whether client data trains public models, and how clinicians keep final sign-off.

GDPREU therapydata protectiontherapy notesAI documentation

EU Mental Health Data Protection: GDPR Notes, AI Tools, and Cross-Border Care

Dr. James Whitfield · UK & EU Practice Editor · June 22, 2026 · 9 min read

Outline

It is Tuesday morning in Lisbon. A client in Berlin joins by video. Your notes system is hosted in another country. An AI tool offers to draft the progress note. The session itself is clinical work. The data path is the compliance problem.

That is the everyday shape of this work: not a poster about privacy principles, but the decisions you make when therapy notes, measures, recordings, and AI drafts cross systems and borders.

This guide turns EU mental health data protection into a practice workflow for mental-health clinicians. It covers special-category health data, lawful basis, national-rule checks, cross-border scenarios, AI vendor assessment, and client rights. It is educational guidance for therapists, counseling psychologists, psychotherapists, clinical social workers, and group-practice leads, not legal advice. High-risk or unclear cases belong with your data protection officer, solicitor, supervisor, national supervisory authority, or professional body.

Free PDF: EU Therapy Data Protection Checklist

A printable EU/EEA GDPR checklist for therapy notes, national-rule checks, AI vendors, transfers, and client rights.

Article 6 lawful basis and Article 9 special-category worksheet
National-rule prompts: secrecy, retention, minors, telehealth, reporting
AI notes vendor and transfer/sub-processor checklist
DPIA triggers and client-rights workflow for access and erasure limits

Free. We'll email the PDF link right away. We may also send the occasional therapist toolkit. Unsubscribe any time.

Educational resource for licensed and registered mental-health clinicians practicing in the EU/EEA, or seeing EU clients by telehealth. GDPR, EDPB guidance, and national rules change over time. Verify current requirements against official sources before you rely on any workflow.

What EU mental health data protection covers

EU mental health data protection covers more than the formal progress note. If a record can identify a person and reveal mental or physical health, treat it as high-risk personal data:

Intake forms and referral letters
Progress notes and risk notes
Outcome measures and assessments
Session recordings, transcripts, and AI drafts
Between-session journaling or check-ins that describe symptoms
Emails, portal messages, and supervisor notes about care
Payment and scheduling records that sit next to clinical context

In GDPR terms these are personal data, and health-related clinical content is special-category data. That higher bar means purpose, minimization, accuracy, storage limits, security, and accountability are not optional polish. They are the minimum.

Article 5 of the GDPR is the baseline in plain language:

Purpose. Hold client data for clear care and practice reasons you can name.
Minimization. Write what another competent clinician needs, not a transcript of everything said.
Accuracy. Correct material errors when they matter for care or rights requests.
Storage limitation. Keep what clinical, legal, and professional duties require, then delete or anonymize.
Integrity and confidentiality. Control access, encrypt, and audit who can see the file.
Accountability. Be able to show your decisions: privacy notice, contracts, retention schedule, and vendor checks.

The European Commission and EDPB publish the official map for businesses and controllers. Therapy work sits inside those rules, not outside them.

Lawful basis plus Article 9 condition

Mental-health records usually need two stacked answers:

Article 6 lawful basis for processing personal data.
Article 9 condition for special-category health data.

Consent is only one route. For many therapy notes, a health or social care condition under Article 9 may fit better than forcing every processing activity onto explicit consent. Consent can still be right for optional features such as marketing, non-essential recordings, or research. When consent is the basis, the client must be able to refuse without losing essential care, and withdrawal must be workable.

Separate four conversations so they do not collapse into one signature:

Consent to treatment
Consent to record a session
Transparency about AI or human scribes
Lawful basis and Article 9 condition for the clinical record

For the full consent map, including recording and AI disclosure wording, see GDPR consent for therapy. UK private practices that need the UK-regime workflow should use GDPR for therapists in the UK. This page owns the EU/EEA baseline and the national-rule layer on top.

Why national rules still matter

GDPR is the floor, not the whole practice answer. Member states and professional bodies still shape day-to-day therapy work.

Local layer to check	Why it matters in clinic	Where to look
Professional secrecy / confidentiality	Who may see clinical content beyond the treating clinician	National professional body, health ministry, or secrecy statutes
Records retention	How long notes must be kept for care, claims, or professional duties	National health rules, insurer contracts, professional guidance
Minors and parental access	Who can request a child or adolescent record	National family/health law and local DPA guidance
Telehealth across borders	Whether remote care triggers local registration or extra notices	National telehealth or professional-practice rules
Insurance or public-system reporting	What must leave the practice for funding or public pathways	Insurer contracts, public mental-health program rules
Breach regulator	Which supervisory authority receives complaints or breach notices	EDPB members list of national authorities
Professional-body ethics	Record-keeping and confidentiality duties that sit beside GDPR	BPS/HCPC equivalents in your country, local psychotherapy bodies

Professional secrecy / confidentiality

Why it matters in clinic: Who may see clinical content beyond the treating clinician
Where to look: National professional body, health ministry, or secrecy statutes

Records retention

Why it matters in clinic: How long notes must be kept for care, claims, or professional duties
Where to look: National health rules, insurer contracts, professional guidance

Minors and parental access

Why it matters in clinic: Who can request a child or adolescent record
Where to look: National family/health law and local DPA guidance

Telehealth across borders

Why it matters in clinic: Whether remote care triggers local registration or extra notices
Where to look: National telehealth or professional-practice rules

Insurance or public-system reporting

Why it matters in clinic: What must leave the practice for funding or public pathways
Where to look: Insurer contracts, public mental-health program rules

Breach regulator

Why it matters in clinic: Which supervisory authority receives complaints or breach notices
Where to look: EDPB members list of national authorities

Professional-body ethics

Why it matters in clinic: Record-keeping and confidentiality duties that sit beside GDPR
Where to look: BPS/HCPC equivalents in your country, local psychotherapy bodies

Do not invent a one-table “law of every EU country” from a blog post. Use this matrix as a checklist of questions, then answer them from the national data-protection authority, health ministry, or professional body that governs your practice. Country-specific legal conclusions need a primary source or local counsel.

Good clinical documentation habits still reduce both clinical risk and data-protection risk: write for continuity and safety, leave out gossip, and keep private process reflections out of the shared clinical record when they do not belong there. UK clinicians comparing record-keeping styles can also use the UK therapy documentation guide.

Cross-border therapy scenarios

These four patterns show up constantly when EU mental health data protection meets real caseloads:

A practical chain for keeping therapy notes, recordings, AI drafts, transfers, and client-rights work tied to a reviewed clinical record.

1. EU therapist using a US or UK software vendor

You remain the controller for the clinical purpose. The vendor is usually a processor. Ask for a signed data processing agreement, sub-processor list, storage locations, and transfer tools such as an adequacy decision or standard contractual clauses. A US-style BAA does not replace an EU processor contract.

2. UK therapist seeing an EU client by telehealth

Your UK practice still needs a UK GDPR workflow for notes, privacy notice, and processors. The client relationship may also engage EU expectations about transparency, access rights, and where complaints go. Map both sides before you assume the UK-only checklist is enough.

3. EU group practice with supervisors or contractors in different countries

Access rights must follow role and need-to-know, not convenience. Document who can open which files, under which contract, and for which purpose. Cross-border supervision is still processing of special-category data.

4. Client moves country and asks for access, export, or deletion

Subject access and portability still apply. Deletion may not, if you still need the record for care, claims, or legal duty. Log the request, identity check, systems searched (including AI drafts), and any lawful withholding decision.

This is the short EU-facing version of the GDPR-compliant AI therapy notes question many clinicians search for. AI can draft notes. It does not replace your judgment, your signature, or your duties as controller.

Before session audio, a transcript, or clinical detail enters a tool, walk this assessment:

Data processing agreement. Signed processor terms that match GDPR requirements.
Sub-processors. Named, current, and covered by the same safeguards.
Data residency and transfers. Storage location documented; transfers supported by adequacy or SCCs where needed.
No public-model training on client content. Require a clear written no.
Retention and deletion. You can set retention, export a client file, and delete end to end.
Security controls. Encryption in transit and at rest, role-based access, audit logs, breach-notification timing.
Human review. Clinician edits and signs before the note is final. No auto-filing of unreviewed drafts.
DPIA. Complete a data protection impact assessment when the AI workflow is new, large-scale, or higher risk for health data.

For product-side documentation patterns, see AI SOAP notes for therapy practices. Platform security posture for encryption, access control, and audit logging is summarized on the security page. Product claims stay limited to published capabilities: human review before signing, no public-model training on session content, and encryption in transit and at rest.

If a vendor cannot answer the checklist in writing, do not put client data in the tool.

Client rights in a therapy record

Clients can exercise rights that sit next to clinical ethics:

Access. Search every system that might hold their data, including AI drafts and exports.
Rectification. Correct factual errors that matter.
Erasure. Limited when care, claims, or legal duties still require the record.
Restriction and objection. Pause certain processing when the request is valid.
Portability. Provide data in a usable format where the right applies.
Complaint. Point to your practice contact and the competent national supervisory authority.

Write the limits in the privacy notice before the first difficult request arrives. A calm process beats winging it under a one-month clock.

Download the EU therapy data-protection checklist

The downloadable checklist puts lawful basis and Article 9 prompts, national-rule questions, AI vendor checks, transfer and sub-processor fields, DPIA triggers, and a client-rights workflow on one printable sheet for supervision or practice setup.

How Emosapien fits this workflow

Emosapien is built for mental-health clinicians, not generic clinical scribing. The Scribe Agent drafts structured notes for clinician review; session content is not used to train public models; and security controls include encryption plus audit-oriented safeguards described on the product security pages. EU and UK practices still complete their own lawful-basis documentation, privacy notice, DPA review, national-rule checks, and DPIA where required. No software removes that controller work. If you want to test documentation support inside a review-first workflow, start a free trial.

US readers looking for HIPAA-framed product language should use the separate HIPAA compliant therapy notes page. That framework is not a substitute for GDPR work on European therapy records.

A short closing checklist

Special-category health data needs Article 6 and Article 9 thinking
Privacy notice matches the tools and borders you actually use
National layers (secrecy, retention, minors, telehealth, reporting) are checked locally
Every processor has a contract you can find
AI tools pass the DPA, residency, training, retention, and human-review tests
Access and erasure processes are written before the first request
Edge cases go to your DPO, national authority, or solicitor, not a blog post

That is the practical bar for EU mental health data protection in day-to-day clinical work: defensible habits, clear contracts, local checks where GDPR is only the floor, and notes you can stand behind if a client, supervisor, or regulator asks.

References

European Union. General Data Protection Regulation (Regulation (EU) 2016/679) (Articles 5, 6, 9, and Chapter III rights).
European Commission. Data protection rules for businesses and organizations.
European Data Protection Board. Guidelines 05/2020 on consent under Regulation 2016/679.
European Data Protection Board. Guidelines 07/2020 on the concepts of controller and processor.
European Data Protection Board. Members (national supervisory authorities).
European Data Protection Board. Data protection guide for small business.