UK GDPR and data security for school counselling records
School counselling records are among the most sensitive data a school holds: they describe the mental health, family circumstances and sometimes the safeguarding history of children. UK GDPR and the Data Protection Act 2018 set clear expectations for how that data is handled. This guide summarises the main points for counsellors and the people who support them.
It is general information, not legal advice. Your school's data protection officer (DPO) is the right person to confirm how these rules apply to your service.
Who is the controller?
The controller decides why and how personal data is processed and carries primary responsibility for compliance. In most schools, the school (or the academy trust, or the local authority for some maintained schools) is the controller of counselling records. If you are an independent counsellor contracted by the school, your contract should make clear whether you are acting as a processor for the school, or as a separate controller for your own clinical records. This matters for who handles subject access requests, breaches and retention.
Lawful basis and special category data
Every processing activity needs a lawful basis under Article 6 of UK GDPR. For state schools, counselling records are usually processed under public task; independent schools may rely on legitimate interests. Relying on consent as the lawful basis is usually a poor fit, because consent can be withdrawn at any time and schools often need to keep records for safeguarding reasons.
Counselling notes almost always contain special category data — in particular data concerning health. Processing this requires an additional condition under Article 9, together with the relevant condition in Schedule 1 of the Data Protection Act 2018. Conditions commonly relied on in schools include those relating to health or social care purposes and to safeguarding of children and of individuals at risk. Some Schedule 1 conditions also require an "appropriate policy document". Your DPO should document which conditions apply.
Do you need a DPIA?
A Data Protection Impact Assessment (DPIA) is required where processing is likely to result in a high risk to individuals. The ICO's guidance lists large-scale processing of special category data and processing involving vulnerable individuals, such as children, as factors indicating high risk. Introducing a new counselling record system, or moving records to a new platform, is a good point to complete or update a DPIA.
A useful DPIA for a counselling service covers:
- what data is collected and why,
- where it is stored and who can access it,
- how long it is kept (see our guide on retention),
- the risks (loss, theft, inappropriate access, over-sharing) and the measures that reduce them.
Security: a practical checklist
UK GDPR requires "appropriate technical and organisational measures" to keep data secure. For counselling records, that typically means:
Devices and storage - Store records on school-managed devices, not personal laptops or phones. - Use full-disk encryption on devices, plus encryption of the records themselves where possible. - Lock screens automatically and use strong, unique passwords or passphrases.
Access - Limit access to the counsellor(s) who need it. Counselling notes should not sit in shared drives open to wider staff. - Keep safeguarding referrals in the school's child-protection system, and your counselling notes separately.
Sharing and communication - Do not email identifiable counselling information over unsecured channels or to personal accounts. - Anonymise material you take to clinical supervision.
Backups and continuity - Keep encrypted backups so that a lost or failed device does not mean lost records. - Test that backups can actually be restored.
Paper - Keep paper notes in a locked cabinet in a room that can be secured, and shred them securely when the retention period ends.
If something goes wrong
A personal data breach includes losing a device, sending notes to the wrong person, or unauthorised access. Tell your DPO immediately. Where a breach is likely to result in a risk to people's rights and freedoms, the school must report it to the ICO within 72 hours of becoming aware of it, and in high-risk cases must also tell the individuals affected.
Cloud versus local storage
Cloud systems can be secure, but they add suppliers, data transfers and access points that the DPIA must assess. Local-first storage — where records stay encrypted on a single managed computer — keeps the attack surface small, but makes backups and device management essential. Neither approach is automatically compliant; what matters is that the risks are assessed and managed.
How CounselNote helps
CounselNote stores all pupil and session data locally, encrypted with AES-GCM under a passphrase only you know. Nothing is sent to a CounselNote server. Encrypted backup and restore are built in, and the School Assurance edition includes DPIA and retention-policy templates you can adapt with your DPO. Read the guide or try it free for 30 days.
Official sources
- Information Commissioner's Office, Lawful basis for processing
- Information Commissioner's Office, Special category data
- Information Commissioner's Office, Data protection impact assessments
- Information Commissioner's Office, Personal data breaches
- Data Protection Act 2018, Schedule 1
- Department for Education, Data protection in schools
This guide is general information for school counsellors and pastoral staff in the UK. It is not legal advice. Always follow your school's safeguarding, data protection and records policies, and take advice from your DSL, DPO or supervisor on individual cases.