Client Record Management and GDPR: a CNIL Guide for French Private-Practice Therapists

A client record is more than a name in a calendar. In a French private practice it may include session notes, health information, correspondence, invoices, referrals and documents supplied by the person receiving care. That information has to be managed with a method that respects the GDPR and the professional rules applicable to the practitioner.

The useful question is not whether a software website displays a “GDPR compliant” badge. It is whether the practice can explain what it collects, why it collects it, who can access it, how long it keeps it and how it deletes it. This guide turns CNIL principles into a practical workflow for psychologists, psychotherapists, counsellors, social workers and other therapists working independently in France. It is general information, not legal advice; professional rules may differ by occupation.

1. Map every copy of client information

Start with an inventory before selecting or changing a tool. A single enquiry can generate several copies: a contact form, an email thread, a calendar entry, a client profile, a session note, an invoice, an accounting export and a cloud backup.

For every category, record:

the data: identity, contact details, administrative information, health information, clinical notes or payment details;
the source: the client, a referrer, an insurer or another professional;
the purpose: scheduling, care, invoicing, legal compliance or professional administration;
the people with access: practitioner, assistant, accountant or technical provider;
the storage location: practice software, email, computer, phone, cloud storage or paper;
the retention rule and deletion method.

CNIL treats health data as sensitive personal data. A clinical note therefore needs stronger safeguards than a basic marketing contact. Free-text fields are not harmless: they invite people to enter more information than the task requires. Structured forms and internal instructions reduce that exposure.

2. Define a purpose and collect only what is needed

The GDPR does not support collecting information “just in case”. For an initial enquiry, a name, a reply channel and information required to arrange an appointment may be enough. Asking for a detailed clinical history through a public form increases exposure before a therapeutic relationship has even begun.

Before adding a field, ask:

Is this information necessary for a specific task?
Has the person been told why it is requested?
Is there a less intrusive way to achieve the same result?

Keep administrative data separate from clinical notes wherever possible. A calendar needs a name and time slot; it does not need the content of a session. An invoicing tool should receive only the details needed for the invoice or receipt. A booking form should not become an accidental clinical record.

CNIL expects organisations to select an appropriate legal basis and provide clear information. Consent is not a universal phrase that replaces every other requirement. The correct approach depends on the purpose, the relationship with the client and professional obligations. A privacy notice should identify the controller, purposes, recipients, rights and contact method in language the client can understand.

3. Use a consistent record structure

A stable structure reduces mistakes and makes access requests easier to handle. Depending on the profession and service, it may contain:

a minimal administrative profile;
relevant information notices and consents;
an appointment timeline;
session notes prepared according to professional requirements;
documents or communications that genuinely support the work;
invoices and accounting evidence, kept according to their own retention logic.

Avoid files called “final”, “final-2” and “really-final”. Use a naming convention that does not reveal clinical details in a filename. Keep templates controlled so that notes remain attached to the correct person, and record material corrections rather than silently replacing history.

Good organisation does not mean putting everything in one database. It means knowing which record is authoritative, limiting duplicate copies and giving every export a reason, recipient and deletion date. A spreadsheet downloaded for a one-off task should not quietly become a second client database.

4. Secure access, devices and backups

Security should be proportionate to risk, but several controls are essential in a solo office or small team:

individual accounts, strong passwords and multi-factor authentication when available;
automatic screen locking on computers and phones;
timely operating-system, browser and software updates;
encryption for devices and backups;
permissions limited to what each person needs;
immediate removal of access when an assistant or supplier leaves;
backups that are separate from the main device and regularly tested;
no shared accounts and no uncontrolled downloads.

CNIL emphasises both technical and organisational measures. A provider can offer a secure product, but the practitioner still has to configure permissions, train users and check real-world use. A well-designed service cannot compensate for a shared password, an unlocked laptop or a client export sent to a personal inbox.

Create a short access matrix: who can view client profiles, who can edit notes, who can issue invoices and who can export data. Review it after every staffing or supplier change. For a solo practitioner, the matrix may be short, but writing it down makes future delegation safer.

5. Assess vendors before uploading clinical data

Practice-management software, online booking, messaging, hosting and accounting services may process information on behalf of the practice. The relationship and responsibilities need to be understood and documented. Ask each provider:

Where is data hosted, and to which countries can it be transferred?
What security measures are actually included and enabled?
Which subprocessors are involved?
How are incidents detected, communicated and handled?
Can data be exported in a usable format?
When are records and backups deleted after termination?
Are data used for another purpose, such as training a service?
Which internal provider staff can access data, and under what conditions?

CNIL expects controllers to choose processors that provide sufficient guarantees and to formalise the processor’s obligations. A marketing privacy page is not a substitute for the contractual and technical information needed to assess a service. Do not upload clinical notes to a product whose data uses, hosting and deletion terms remain unclear.

The lowest monthly price is not necessarily the lowest total cost. Count migration, manual duplicate entry, exports, support, security configuration and the time spent correcting mistakes. A simple tool with clear boundaries can be safer than a feature-heavy stack that scatters information across five accounts.

6. Plan retention, access and deletion

The GDPR requires controlled retention: information should not remain indefinitely accessible without a reason. The exact period depends on the profession, the document, applicable legal or professional rules, accounting requirements and possible disputes. Build a schedule by category, validate it when needed and set a review date rather than inventing one universal period for every record.

Deletion must cover reasonably identifiable copies: active records, exports, downloads, paper files and backups according to the provider’s process. Use confidential destruction for paper. For digital services, check what “delete” means and how long backup copies remain before they are overwritten.

Clients have rights, including access and rectification, subject to applicable rules and exceptions. A simple procedure should make it possible to locate the record, verify the requester’s identity, respond within the applicable time and retain evidence that the request was handled. Do not ask a client to send sensitive identity documents through an unsecured channel when a safer verification method is available.

7. Prepare for a privacy incident

An email sent to the wrong recipient, a stolen laptop, a compromised account or a public sharing link can be a personal-data breach. Decide in advance who acts and what gets documented.

An incident sheet should cover:

containment and preservation of evidence;
contact with the provider and practice owner;
risk assessment for affected people;
possible notifications to CNIL or other authorities;
the decision, timeline and corrective controls;
communication with clients when required.

CNIL sets out when a breach must be notified under the GDPR. An internal incident log helps demonstrate a structured response, including when assessment concludes that notification is not required. Test the plan with a harmless scenario: a lost phone or a mistakenly shared appointment list is enough to reveal gaps.

A monthly checklist for an independent practice

Once a month, review:

new fields added to forms;
active accounts and access rights;
exports and sharing links that are still open;
backup status and one restoration test;
available security updates;
pending rights requests;
incidents and near misses;
retention dates and vendor contracts.

The routine is easier when calendar, records and administrative tasks are organised in a small number of tools with clear permissions. It does not remove the practitioner’s responsibility, but it reduces scattered searches and unnecessary copies.

FAQ

No. It requires a defined purpose, appropriate security and a justified retention period. Professional and legal rules may specify additional requirements.

No. Assess the contract, hosting, subprocessors, access controls, exports, deletion process and the measures actually enabled in the account.

Can a therapist email a client record?

The answer depends on the context and available safeguards. Verify the recipient, minimise the content, use a method appropriate to the risk and document the decision. A public link or wrong address can expose sensitive data.

Does a solo practice need a record of processing activities?

The answer depends on the nature and regularity of processing and the categories of data. Because health information is sensitive and client records are usually processed regularly, documenting the practice’s processing activities is strongly advisable and may be required.

Is there a simple way to organise practice administration?

Free. No credit card. Forever. FYL.care helps psychologists, social workers, therapists and coaches manage their practice without adding another administrative subscription.