Resources

GDPR for Psychologists: What Clinical Data to Protect and How

If you're a practicing psychologist or psychotherapist, you work with some of the most sensitive data that exists: the content of your patients' therapy sessions. The General Data Protection Regulation (GDPR), together with the LOPDGDD (Spain's Organic Law 3/2018), classifies this data as special category data — meaning it carries a higher level of protection than ordinary personal data.

What clinical data counts as "special category data"?

Under GDPR, the following count as special category data:

  • Health data: diagnoses, clinical notes, session transcripts
  • Data about sexual life or sexual orientation of patients
  • Biometric data when used for identification purposes
  • Data about religious or philosophical beliefs that emerge in session

In practice, almost everything discussed in a therapy session can contain special category data.

One point that often causes confusion: the primary legal basis for processing health data in a clinical context is not patient consent, but rather Article 9.2(h) of the GDPR — processing necessary for the purposes of preventive medicine, medical diagnosis, or the management of healthcare systems, carried out by a professional bound by professional secrecy.

This matters because consent can be withdrawn at any time, which would create an absurd situation: the patient could demand that you stop maintaining their clinical record — something that directly conflicts with your legal obligations.

What you do need is to fulfil the duty to inform (Articles 13 and 14 of the GDPR): clearly telling the patient what data you collect, for what purpose, where it's stored, and what their rights are. This is separate from the therapeutic informed consent document (governed by Spain's Law 41/2002 on patient autonomy), which is a different document altogether.

The 5 key obligations for your practice

1. Duty to inform

You must provide the patient with a clear document explaining:

  • What data you collect and for what purpose
  • The legal basis for the processing (Art. 9.2(h) GDPR)
  • Where the data is stored
  • Retention periods
  • The patient's rights (access, rectification, erasure, portability)

2. Record of processing activities

You must maintain an internal record that documents:

  • What data you process and for what purpose
  • The legal basis
  • The security measures you apply
  • Retention periods

3. Technical security measures

Clinical data must be protected with:

  • Encryption at rest and in transit
  • Access control — only you should be able to access your patients' data
  • Regular backups
  • Storage within the EU — data must not leave the European Economic Area

4. Retention periods

Spain's Law 41/2002 establishes a minimum retention period for clinical records of 5 years from the last care episode. Many regional governments extend this to 15 years. Check the specific rules for your autonomous community. Once the retention period has passed, data must be securely deleted or anonymised.

5. Patient rights and breach notification

Your patients have the right to access all the data you hold about them, request its correction, and — with limitations — its erasure (the legal retention period takes precedence).

If you experience a security breach affecting patient data, you must notify the AEPD (Spanish Data Protection Authority) within a maximum of 72 hours, and notify affected patients if the risk is high.

How to simplify compliance

The complexity of GDPR and the LOPDGDD shouldn't fall on your shoulders alone. Tools designed for the clinical context can help:

  • Automatic encryption of notes and transcripts, at rest and in transit
  • Storage on European servers by default
  • Digital consent records with a verifiable acceptance log
  • Built-in access control — your data, yours alone

The key is to choose tools that are GDPR-compliant by design, rather than tools that make you configure security yourself.

Clara encrypts all data at rest and in transit, stores information on European servers, and never uses clinical content to train AI models. Try Clara free →