Policy for Data Protection and Record-Keeping
1. In order to adhere to the General Data Protection Regulation (GDPR) and BACP guidance, The counsellor will hold all information on the Client confidentially. It is only accessible to the Counsellor for the purpose of running the service. It is only in cases of serious risk of harm that there may be a requirement for information to be passed on without the explicit consent of the client, or where the courts require the Counsellor to provide information by law. The GDPR requires to inform the Client of the data it holds on them, and whether and how it is accessible to them.
2. The Client is asked to provide name and contact details during the initial assessment session on a written form. These are kept in a locked cabinet or on a secure cloud-based service , separate from the Counsellor’s notes of the sessions with the Client under 3 below. The Counsellor will only use these contact details to contact the Client in order to arrange, cancel or confirm appointments with the Client.
3. Notes are kept on the content of each Client/Counsellor session. These are confidential and are entered by the Counsellor onto the standard “client notes” form after each session. They are used to help the Counsellor remember what has been said and for the Counsellor’s professional supervision sessions. The notes are kept in a locked filing cabinet or secure cloud-based service and are only identifiable by the client’s unique reference number which is held by the counsellor. Notes will only be accessed by the Counsellor if there is a clinical or administrative need to do so.
4. The Client notes are the property of the counsellor but upon one week’s written notice, the Client has the right to access all notes kept on them and to receive a copy of such notes. At the Client’s request, the Counsellor will be available to assist the Client’s review of the notes, for example if some things have been written in shorthand.
5. Client contact details and notes will be kept for five years after the completion of sessions. They will then be shredded or deleted.
6. Under Article 17 of the GDPR, the Client has a “right to be forgotten” which entitles the Client to request that under certain conditions, the counsellor erase his/her personal data and cease further dissemination of such data.
7. In the unlikely event of a data breach where the Client’s personal information has been lost or stolen, the counselor will inform the Information Commissioner’s Office and the Client within 72 hours of becoming aware of such breach.