GDPR and Data Privacy for Therapy Room Rentals: What UK Practitioners Need to Know

Data protection is a legal obligation for every therapy practitioner in the UK, and renting a room introduces specific complications that home-based practitioners do not face. Who is responsible for data security in a shared building? Can you store client notes on-site? What happens if the landlord operates CCTV in communal areas? This guide answers the most common GDPR questions for therapy room renters and provides a practical compliance framework.

Your Lawful Basis for Processing Data

Under UK GDPR, you must have a lawful basis for processing any personal data. For therapy practitioners, the relevant bases are:

• Contract: Processing necessary to deliver the agreed therapeutic service
• Legal obligation: Where record-keeping is required by law or professional regulation
• Consent: For uses beyond direct therapy, such as research or marketing
• Vital interests: In emergencies where life is at risk

Most therapeutic record-keeping falls under contract or legal obligation. The Information Commissioner’s Office (ICO) provides detailed guidance on identifying lawful bases.

Special Category Data

Therapy records are classified as special category data because they concern health, mental health, and sex life. This means you must meet additional conditions under Article 9 of UK GDPR. For healthcare practitioners, the relevant condition is typically that processing is necessary for healthcare purposes.

Physical Data Security in a Rented Room

When you rent a therapy room, you remain responsible for the security of any data you bring into or generate within that space.

Paper Records

If you keep paper notes, they must be stored in a locked container that you control. Leaving notes in the room, even in a locked drawer to which the landlord also has a key, creates an unacceptable risk. Best practice is to transport notes in a locked case and remove them after every session.

Electronic Devices

Laptops, tablets, and phones must be password protected and, ideally, encrypted. If you connect to the room’s WiFi, confirm with the landlord whether the network is secured and whether traffic is monitored. Avoid accessing client records over unsecured networks.

Whiteboards and Flip Charts

Never write client names or identifiable information on whiteboards or flip charts in a shared room. If you use these tools during sessions, erase them completely before leaving.

CCTV and Recording Devices

Many buildings have CCTV in communal areas such as entrances and corridors. Under GDPR, footage that identifies individuals is personal data. The landlord is the data controller for communal CCTV and must have a lawful basis, clear signage, and a privacy notice. You should be able to tell clients who operates the CCTV and how to contact them.

Covert recording inside a therapy room is illegal under the Investigatory Powers Act 2016 and UK GDPR. If you discover recording devices in the therapy room itself, this is a serious breach that must be addressed immediately.

Landlord Access and Confidentiality

Most rental agreements allow landlords access for maintenance and emergencies. This creates a risk if client materials are left in the room. The safest approach is to remove all notes and devices at the end of each session. If you must store items on-site, use a locked container to which only you hold the key or combination.

Data Breach Response

If a breach occurs, for example if your laptop is stolen from the room or notes are left behind and read, you must assess the risk to the individuals involved. If the breach is likely to result in a risk to their rights and freedoms, you must notify the ICO within seventy-two hours and inform affected clients without undue delay.

Your Privacy Notice

Your privacy notice should explicitly mention:

• That sessions take place in a rented room within a shared building
• Whether the building has CCTV in communal areas
• How and where records are stored and secured
• How long records are retained
• Clients’ rights under UK GDPR

Practical Compliance Checklist

1. Take all notes and devices with you after every session
2. Use encrypted storage for electronic records
3. Lock your bag or case whenever it is unattended
4. Confirm whether the building has CCTV and understand who operates it
5. Include the rental location in your privacy notice
6. Ask the landlord about their data protection policies
7. Verify that your professional indemnity insurance includes data breach cover

Conclusion

GDPR compliance in a rented therapy room is straightforward with good habits and clear policies. Minimise what you store on-site, secure what you do store, be transparent with clients about the building environment, and know your responsibilities in the event of a breach.

Published: May 2026 | Last Updated: May 2026

Regulatory References

• Information Commissioner’s Office (ICO) – GDPR for Small Businesses
• BACP – Data Protection and Confidentiality Guidance
• UKCP – GDPR Compliance for Psychotherapists
• GOV.UK – Data Protection Act 2018